このページの内容は英語のみでご覧いただけます。
Privacy Policy
端末内で処理The short version: the file or text you put into a tool is processed by your own browser and is never sent anywhere.
What is guaranteed
Your file and your payload never leave your browser. Every tool on this site — JSON, text, PDF, image — runs as JavaScript inside the tab you already have open. There is no upload step, no API route, no storage bucket and no file-processing backend. Page assets are served over the network, while the tools process input locally.
That applies to the whole input: the JSON you paste, the PDF you drop, the image you crop, the JWT you decode. None of it is read by us, transmitted, logged, or retained.
How to verify it yourself
You do not have to take this on trust. It is observable in about thirty seconds:
- Open DevTools. F12, or Cmd + Option + I on macOS, or Ctrl + Shift + I on Windows and Linux.
- Go to the Network panel and tick “Preserve log”, then clear it.
- Use a tool with sample data. Paste a large JSON document, merge two PDFs, decode a JWT, compress an image.
- Watch the panel. No request carries your content from the tool. App code, fonts, workers and codecs can still load over the network. This build has no advertising or analytics enabled.
- Disconnect the network. Turn off Wi-Fi or switch on Airplane mode after running the operation once. Processing can continue with loaded resources; a new tool, first-use codec or page reload may still need a connection.
What the security policy does
The production build generates a Content-Security-Policy (CSP) in its hosting headers. The host must apply those headers. The policy restricts script and connection origins, hashes executable inline scripts, blocks object embedding and prevents framing.
Same-origin requests remain allowed so the app can load workers and codecs. Advertising and analytics, when configured, add allowed origins. CSP reduces exposure; it does not prove that input cannot be read by a script already permitted to run in the page.
The tools themselves do not upload input. An operator enabling third-party scripts must review their behavior and required consent configuration. Check the document response headers in DevTools to verify that the deployed host applies the generated policy.
What is stored in your browser
No file content and no payload is written to persistent storage — not to localStorage, not to sessionStorage, not to IndexedDB. Closing the tab releases the application state. Downloaded files, copied clipboard content and browser or operating-system recovery features are outside this storage policy.
| Key | Purpose | Value |
|---|---|---|
| ycd_theme | Remembers light or dark mode | "dark" | "light" |
| ycd_pinned | The tools you pinned, in your order | a list of up to 12 tool addresses |
| ycd_recent | The tools you opened most recently | a list of up to 5 tool addresses |
| ycd_pin_hint_dismissed | Hides the pinning tip once you have closed it | "1" |
| ycd_tool_prefs | The options you last chose in a tool (quality, size, format, indent), so it opens the way you left it | per tool, a few option values — never a file, text or result |
That is the complete list, and none of it leaves your device. Clearing this site's data in your browser removes all of it.
Offline copies. The service worker keeps copies of the pages and site files you have opened — HTML, scripts, styles, icons — in the browser's Cache Storage, so those pages load quickly and work without a connection. It never stores your files, your input or your results.
Third parties
- Hosting and CDN. The site is served as static files from an edge CDN, which processes ordinary connection metadata — IP address and request timestamp — in order to deliver the HTML, CSS and JavaScript. It never sees your tool input, because your tool input is never part of a request.
- Advertising. This build serves no advertisements and loads no ad scripts. The codebase contains an optional AdSense placement that stays inert unless a publisher ID and ad-unit IDs are configured at build time. If that changes, this page changes with it — the text you are reading is generated from the same build-time configuration the ad code reads, so the two cannot disagree.
- Analytics. None. No Google Analytics, no Mixpanel, no PostHog, no Sentry, no session recording, no error-tracking SDK.
Contact
Write to info@toolsbyus.com. The site itself has no contact form and sends nothing anywhere: a message reaches us only when you send an email from your own mail app, and it contains only what you put in it.
We use your message to read and answer it, and your address only to reply. To ask what we hold from you or to have your messages deleted, write to the same address.
Last updated September 2026. Applies to all pages on toolsbyus.com. See also the terms of service and the architecture notes.