File processing is local
Your selected files and pasted text are inspected and cleaned on your device. You download a separate copy. The file-processing code does not send file contents to our server.
What does use the network
The website still uses the network to load pages and manage your account. File processing is separate from these requests.
- Loading the page and its scripts, like any website.
- Signing in, signing up, resetting a password, and signing out.
- The signed-in allowance counter, which sends a count and receives your remaining balance.
- Anonymous usage counting, which sends a random one-off key, the kind of operation, its outcome and the file family: text, image, audio or video.
- Account deletion, when you ask for it.
What the usage counters receive
The quota API derives your identity from the session cookie. The request body carries a count and nothing else. File names, sizes, hashes, formats, findings and bytes are never sent, and the endpoint rejects a request that carries any other field.
When an operation finishes in your browser, we count it. The report carries a random one-off key, whether it was an inspection, a clean or a failure, the outcome, and one of four families: text, image, audio or video. There is no file, no text, no file name, no finding, no hash and no email address in it, and the time is taken from our clock rather than yours. Nothing in it identifies you or ties several operations from this browser together, and the site loads no third-party analytics.
That counting is aggregate: it records that an operation of a given kind happened on a given UTC day, never who performed it, and it is never presented as a number of people or visits. It is also best-effort and unverified: a report that never reaches us is never counted, and because any browser can reach that endpoint it can also receive reports of operations that never happened. They are reported operations, not verified activity and not a guaranteed minimum. The anonymous daily limit itself is unchanged: a soft counter in this browser's local storage that clearing site data resets.
What an account stores
An email address, a password verifier (never the password), an optional display name, the Google account identifier if you link one, active sessions, and a per-day operation count keyed to a UTC date. Deleting your account removes all of it.
Browser storage
Theme preference, the anonymous day counter, the session cookie, and a small queue holding at most fifty usage reports waiting to be sent or retried, each discarded after a day. Nothing else is written, and the reset-password page loads no third-party resources at all.