Privacy policy

The short version. Almost every tool on this site finishes the job without your file going anywhere at all. It is never sent to us, so there is nothing for us to store, read, sell or lose. The exceptions are named below, and so is everything that is collected — analytics.

Your files

Tools marked “Never stored” — which is nearly all of them — do the whole job without your file going anywhere. No copy of it reaches us, nothing is written down, and turning off your network connection mid-task makes no difference to the result. You can confirm this yourself rather than take our word for it: switch off your Wi-Fi after the page has loaded and run a tool. It works exactly the same, because nothing was ever going to be sent.

The exceptions

A few conversions need software a web page cannot provide — Office documents and spreadsheets converted with full layout fidelity, and HTML rendered to PDF exactly as it prints. Those tools say “Deleted right after converting” rather than “Never stored”, and the label is the honest signal of which you are using.

When you use one of those, your file is sent to our server over an encrypted connection, converted, returned to you, and deleted immediately afterwards. It is not backed up, not indexed, not inspected and not used to train anything. If you would rather it never left your machine at all, those pages fall back to an in-browser converter when the server-side one is unavailable, and the in-browser tools elsewhere on the site cover most of the same jobs.

What the site stores here

No cookies of our own. These pages set none of their own — no session cookie, no identifier, nothing to clear. Some tools remember a preference, such as an output format or a quality setting, in this browser's own local storage; that stays on this computer and is never sent anywhere. Google Analytics, described below, sets its own cookies when it runs — in the EEA, the UK and Switzerland only after you accept it. Clearing your site data removes all of it.

We count which tools are used. When a tool finishes a job, the page tells us that that tool ran. What gets stored is three things: the tool's name, the date, and a number. No file name, no file size, no contents, nothing derived from your document, and nothing that identifies you. It exists so we know which tools are worth improving, and so the homepage can show what people actually use rather than what we guess they do.

We count page visits. Each page tells us it was opened. What gets stored is a date, the page, a two-letter country code (supplied by our network provider, not looked up from your address) and two numbers: views and visitors. To count one person once a day, your address and browser are hashed with a secret that changes every day into a key that expires at midnight and is never written to the database. No cookie is set and nothing that identifies you is kept, so this happens whether or not you accept analytics.

One detail worth stating rather than glossing, because it involves your IP address. The count is capped at five per tool per day so that one person having a busy afternoon does not distort it, and recognising a repeat visit for a few hours means hashing your address with a secret unique to this server into a short-lived cache key. That key expires the same day, is never written to the database, and is never joined to anything — your address itself is not stored at any point. This happens whether or not you accept analytics, because nothing about you survives it.

We count clicks on our Product Hunt badge. When you click it, the page tells us so. What gets stored is a date, the page you were on, a two-letter country code and a number. Nothing that identifies you is used or kept — not even briefly — and closing the badge is not counted.

Analytics

Asked first where the law says so. In the EU, the UK, Iceland, Liechtenstein, Norway and Switzerland, Google Analytics is not loaded when the page opens: you are asked once, in a bar at the bottom of the screen, and nothing is requested from Google unless you choose Accept. Everywhere else it starts when the page opens, and you can turn it off at any time from Cookie settings in the footer. If your browser sends Global Privacy Control, it never runs, wherever you are. Your region comes from the country our network provider reports for your connection; if that is unknown, you are asked. Your answer is remembered in this browser's local storage, not in a cookie, and it is not sent anywhere.

When it runs, we use Google Analytics to count visits and see which tools are used, so we know what to build and fix. It records things like the page you are on, roughly where in the world you are, your browser and screen size, and how you arrived. It sets cookies to do this.

It does not receive your files, their names, their contents or anything derived from them. That is a deliberate boundary in the code, not a promise: no filename or file content is ever passed into an analytics event. Google describes what it collects in its own privacy policy, and you can opt out with the Google Analytics opt-out add-on.

Change your answer. Withdrawing is as easy as giving it: this clears your stored answer and asks again. Analytics already running in this tab stops at the next page load.

Visit counts without cookies. Every page also loads Ahrefs Web Analytics, which counts visits, the pages viewed, the site you came from and your country. It sets no cookies and keeps no personal data, so it cannot recognise you from one visit to the next. That is why it does not ask first. Like Google Analytics, it never receives your files, their names or their contents. Ahrefs describes it in its own documentation.

Advertising

This site does not currently show advertising and sets no advertising cookies. If that changes, this page will be updated before any ad is served, and readers in the EEA, the UK and Switzerland will be asked for consent first.

What we never do

• We do not ask you to create an account, and we do not want your email address.
• We do not keep copies of your files.
• We do not sell data, because we do not have any worth selling.
• We do not watermark your output or degrade it to sell you an upgrade.

Children

This site is a general-purpose set of utilities and is not directed at children under 13. We do not knowingly collect personal information from them.

Who is responsible for this data

The data controller is Fakhrul Hasan, in Bangladesh. Write to hello@toolifine.com about anything on this page.

What we rely on to process anything at all

Consent, for analytics in the EEA, the UK and Switzerland. You are asked first, nothing loads until you answer, and you can withdraw at any time from Cookie settings in the footer — withdrawing is as easy as agreeing. Legitimate interests, for analytics everywhere else, which you can turn off the same way, and for the things that happen regardless: the per-tool and page-visit counts described above, and server logs kept to keep the site standing up and to stop abuse. We think that balance is fair, because none of the counts or logs keeps anything that identifies you — but if you disagree, you can object.

How long any of it is kept

• Your files: not kept. On the tools that use a server, the working directory is deleted the moment the conversion returns, whether it succeeded or failed.
• The per-tool count: a tool name, a date and a number, kept indefinitely because it is a statistic and not a record of anyone. The short-lived key behind its daily cap expires the same day.
• The page-visit count: a date, a page, a country code and two numbers, kept indefinitely because it is a statistic and not a record of anyone. The daily key behind the visitor count expires the same day.
• The badge-click count: a date, a page, a country code and a number, kept indefinitely because it is a statistic and not a record of anyone.
• Server logs: rotated and discarded within weeks, not months.
• Analytics: held by Google under Google's own retention settings, not ours. Their policy is linked above.

Where in the world it goes

Nowhere, for your files — they do not travel, and on the server-side tools they do not survive the request. Google Analytics is run by a United States company, and when it runs, data about your visit is transferred there. Google relies on the EU-US Data Privacy Framework and on standard contractual clauses for that transfer; declining, or turning it off in Cookie settings, means it never happens.

Your rights

Where data protection law gives you rights over personal data — access, correction, deletion, restriction, objection and portability — you can exercise them by writing to us, and we will answer within a month. In practice there is very little to act on, because the site is built so that the sensitive thing, your file, never reaches us in the first place.

You also have the right to complain to a data protection authority. In the EEA that is the supervisory authority where you live or work; in the UK it is the Information Commissioner's Office. You do not have to come to us first, though we would rather you did, because most of what looks like a problem here turns out to be something we can simply explain.

Changes, and how to reach us

If this policy changes in a way that affects what is collected, the date at the top of this page changes with it. Questions about anything here are welcome — get in touch.