File processing is local
Your selected files and pasted text are inspected and cleaned on your device. You download a separate copy. The file-processing code does not send file contents to our server.
What does use the network
The website still uses the network to load pages and manage your account. File processing is separate from these requests.
- Loading the page and its scripts, like any website.
- Signing in, signing up, resetting a password, and signing out.
- The signed-in allowance counter, which sends a count and receives your remaining balance.
- Anonymous usage counting, which sends a random one-off key, the kind of operation, its outcome and the file family: text, image, audio or video.
- Account deletion, when you ask for it.
What the usage counters receive
The quota API derives your identity from the session cookie. The request body carries a count and nothing else. File names, sizes, hashes, formats, findings and bytes are never sent, and the endpoint rejects a request that carries any other field.
When an operation finishes in your browser, we count it. The report carries a random one-off key, whether it was an inspection, a clean or a failure, the outcome, and one of four families: text, image, audio or video. There is no file, no text, no file name, no finding, no hash and no email address in it, and the time is taken from our clock rather than yours. This usage report does not identify you or connect several operations from this browser. Optional visit analytics is separate and described below.
That counting is aggregate: it records that an operation of a given kind happened on a given UTC day, never who performed it, and it is never presented as a number of people or visits. It is also best-effort and unverified: a report that never reaches us is never counted, and because any browser can reach that endpoint it can also receive reports of operations that never happened. They are reported operations, not verified activity and not a guaranteed minimum. The anonymous daily limit itself is unchanged: a soft counter in this browser's local storage that clearing site data resets.
What an account stores
An email address, a password verifier (never the password), an optional display name, the Google account identifier if you link one, active sessions, and a per-day operation count keyed to a UTC date. Deleting your account removes all of it.
Browser storage
Browser storage holds your theme, anonymous daily counter, session cookie and up to fifty pending usage reports, each discarded after one day. It also remembers your analytics choice for 180 days. Only if you allow analytics do we load Google Analytics on public pages and set its first-party cookies, with a 180-day expiry. Refusing or withdrawing does not limit the tool. Use Analytics preferences in the footer to change your choice; withdrawal stops collection and removes this site's analytics cookies.
Optional Google Analytics measures public-page visits and referrals, using cookie identifiers and browser/device information; Google also receives the network connection's IP address. We send the public page path and referring site's origin, without URL query strings or fragments. We do not send files, file names, pasted text, findings, reports, account IDs or email addresses. Analytics is excluded from login, registration, email verification, password recovery and admin pages. Advertising features and automatic form/download tracking are disabled.