Privacy policy

I don't want it. Any of it.

This is my privacy policy. It's short because there's not much to say when you don't collect anything. The funny part is on top, the legally precise part is below.

TL;DR

  • Your files never leave your device. Ever.
  • No cookies, no localStorage, no tracking, no analytics.
  • No third-party scripts, fonts or embeds. Everything is served from my own domain.
  • My host briefly sees your IP address, because that's how the internet works.
  • If you donate, the payment provider handles that. Not me.

1. Who is responsible

The controller within the meaning of the General Data Protection Regulation (GDPR) is:
Shahir Sherali
E-mail: shahirsherali.work@outlook.com

2. The files you edit

All tools on this website run entirely in your web browser. When you open a PDF, image, video or other file, it is read and processed locally on your device. Your files and their contents are never transmitted to me or to any third party, and I have no technical means to access them. When you close or reload the page, everything is gone from memory.

Some tools find faces or people in your photos (blurring faces, passport photos) or turn speech into text (transcribe). They use AI models that are downloaded from this website and run on your device, like everything else. The AI privacy filter doesn't use AI at all: it recognises personal details with patterns, in your browser, and the list of what it replaced disappears when you close the tab. The “Take a photo” button in the document scanner opens your own camera app; the photo it takes is handled exactly like a file you pick.

One exception you control yourself: when the metadata remover finds GPS coordinates in a file, it shows a “map” link. Only if you click it, your browser opens OpenStreetMap in a new tab with those coordinates. Nothing is sent before you click.

3. Cookies and similar technologies

I do not use cookies, local storage, session storage, IndexedDB, fingerprinting or any similar technique to store or read information on your device. That's why there's no cookie banner: there is nothing to consent to.

4. Analytics, tracking and third parties

I use no analytics, no tracking pixels, no advertising, no social media plugins and no third-party scripts. Fonts and all other assets are served from my own domain. My Content Security Policy technically prevents this website from connecting to any other domain.

5. Hosting

To show you any website, your browser has to send a request to a server. That request includes your IP address, the page requested, the time, and your browser's user agent. This website is hosted as static files by Cloudflare, Inc. (Cloudflare Workers static assets), which processes this data on my behalf only to deliver the website and to protect it against abuse (for example DDoS attacks). I have not enabled any analytics or visitor statistics at my host and I do not view, collect or store access logs myself.

Besides the static files, one tiny script runs at my host: once a night it asks four independent scanners to check this website and stores their scores, which the homepage shows. It never sees you or your files.

Legal basis: Art. 6(1)(f) GDPR (my legitimate interest in delivering a working and secure website). I have a data processing agreement with my host. Where data is processed outside the EU/EEA, this is covered by an adequacy decision (such as the EU-US Data Privacy Framework) or Standard Contractual Clauses. More info: privacy policy of my host.

6. Donations

Donating is voluntary. The donate buttons are plain links: nothing from the payment provider is loaded on this website until you click one and leave for their site. The provider (see my donate page) processes your payment details as an independent controller under its own privacy policy.

Depending on the provider and what you enter there, I may receive the name or e-mail address you provided, the amount and an optional message. I use this only to keep my financial records, which I am legally required to keep (Art. 6(1)(c) GDPR; I'm based in the Netherlands, where tax law requires a retention period of 7 years). I never use it for marketing and never share it.

7. Contacting me

If you e-mail me, I use your e-mail address and message only to reply to you (Art. 6(1)(f) GDPR) and delete it once the conversation is done, unless I have to keep it by law.

8. Your rights

You have the right to access, rectification, erasure, restriction of processing, data portability and to object to processing. Since I generally hold no data about you, most requests will be answered with “I have nothing”, but please do ask: shahirsherali.work@outlook.com.

You also have the right to lodge a complaint with a data protection authority, usually the one in the country where you live. Since I'm based in the Netherlands, the authority responsible for me is the Autoriteit Persoonsgegevens.

9. Changes

If I ever change how this works, I'll update this page. I won't e-mail you about it. You know why.

Last updated: 2026-09-25