Privacy Policy

The short version

• Your files are never uploaded. Every tool runs inside your browser. There is no server-side processing, no upload endpoint and no storage bucket holding your documents.
• No account is required and we do not ask for your name, email address or phone number to use any tool.
• No analytics run unless you accept them. If you decline, the only thing stored in your browser is your consent choice.
• Advertising is optional and controlled by you. You can refuse personalised advertising and still use every tool.
• We cannot read your files, so we cannot lose, leak, sell or share them. There is nothing to breach.

Who we are

ToolForForever (“we”, “us”) operates this website. For the purposes of the UK GDPR and the EU GDPR, we are the data controller for the limited personal data described below, and the data processor arrangements that would normally apply to uploaded files simply do not arise.

You can contact us about anything on this page through our contact page.

Your files

When you choose a file, your browser reads it from your device into the memory of the page you are on. The processing then happens in that tab, or in a Web Worker created by that tab, using JavaScript and WebAssembly that was already delivered to your browser. At no point does the file, or any part of it, travel over the network.

You can verify this yourself. Open your browser’s developer tools, select the Network tab, and use any tool while watching the requests. You will see requests for the page, its stylesheet and its scripts, all served from this domain. You will not see a request carrying your file.

Two tools download a model file the first time you use them. Background removal fetches approximately 40 MB of segmentation weights, and the OCR tool fetches language data for the language you select. These are downloads of model data to your browser, not uploads of your content, and your browser caches them afterwards. If you would prefer these to be served from our own domain rather than a public content network, the project README explains how to self-host them.

What we do collect

Essential storage

We store one item in your browser’s local storage: your cookie consent choice, so that we do not ask you on every visit. It contains no identifier and is not transmitted to us. This is strictly necessary storage and does not require consent, but we tell you about it anyway.

Analytics (only with your consent)

If you accept analytics, we use Google Analytics 4 to count visits and understand which tools are used, in aggregate. This sets cookies and collects your IP address, an approximate location derived from it, your device and browser type, the pages you view and how you arrived. We use it to decide which tools to improve. Google acts as our processor for this data and may transfer it outside the UK and EEA under the EU-US Data Privacy Framework and standard contractual clauses.

We do not send filenames, file contents, or anything you type into a tool to Google Analytics. If you decline analytics, no analytics script is loaded at all and no analytics cookie is set.

Advertising (only with your consent)

If you accept advertising, Google AdSense may set cookies and use device identifiers to show ads, including personalised ads based on your activity across other sites. Google and its partners act as independent controllers for that activity under their own privacy policies. If you decline, we do not load the AdSense script, and no advertising cookie is set.

Server logs

The site is served as static files from a content delivery network. Like any web host, that provider records standard request logs - IP address, timestamp, requested URL, user agent - for security and operational purposes. These logs relate to the pages you request, never to file contents, because file contents are never part of a request.

Email we receive

If you email us or use the contact form, we receive your address and whatever you write. We keep it only as long as needed to answer you and for our own records of the enquiry.

Cookies and how to opt out

We set no cookies before you make a choice in the consent banner. After you choose, the cookies that may be set are listed in our Cookie Policy, together with their purpose and lifetime.

You can change or withdraw your choice at any time using the “Change cookie settings” button in the footer of every page. You can also control cookies directly:

• Google Ads Settings lets you turn off personalised advertising across Google properties.
• Your browser settings let you block or delete cookies; blocking all cookies will not stop any tool from working.
• Industry opt-out pages maintained by the Digital Advertising Alliance and the European Interactive Digital Advertising Alliance cover many ad vendors at once.

Third parties that may receive data

• Google (AdSense, Analytics) - only after you consent to the relevant category.
• Our content delivery network and DNS provider - for serving the site and for security logs.
• Public content networks - serving the optional AI model files described above, on the two tools that use them.

We do not sell personal data, we do not run a data broker arrangement, and we do not share your information with anyone for their own marketing.

Your rights

Under the UK and EU GDPR you have the right to access, correct, delete, restrict or object to the processing of your personal data, and the right to data portability and to withdraw consent at any time. Because we hold almost nothing about you, most of these rights are satisfied trivially: withdrawing consent removes the only identifier we would otherwise hold.

To exercise any right, submit a request via our contact page. You also have the right to complain to your national supervisory authority; in the UK that is the Information Commissioner’s Office.

Legal bases

• Consent (Article 6(1)(a)) for analytics and advertising cookies.
• Legitimate interests (Article 6(1)(f)) for security logging and for answering enquiries you send us.
• Contract (Article 6(1)(b)) where you have asked us to do something specific, such as respond to a support request.

Children

This site is not directed at children under 13, and we do not knowingly collect data from them. There is no account system and no user-generated content, so there is no mechanism by which a child could provide us with personal information beyond sending an email.

International transfers

Where consent-based third-party services transfer data outside the UK or EEA, those transfers rely on the EU-US Data Privacy Framework, UK Extension, or on standard contractual clauses as published by the European Commission.

Security

The site is served over HTTPS only, with HTTP Strict Transport Security enabled. There is no user database, no authentication system and no upload endpoint, which removes the categories of vulnerability that normally put user files at risk. The strongest security property here is architectural: data that is never collected cannot be exposed.

Changes to this policy

If we change how the site handles data, we will update this page and the date at the top, and where the change is significant we will ask for consent again. We will not quietly widen what we collect.