Privacy Policy
1. Who we are
This website, , is run by . If you have a question about your data, write to .
2. The photo and document tools
Tools such as Shrink, Convert and Studio process your files on your own device, in your browser. The files you open in these tools are not sent to us. The result is encrypted in your browser and then saved to your Vault, from where you download it. You must be logged in to use the tools.
Some tools load extra helper code the first time you use them (for example PDF reading, ZIP, HEIC and text recognition). That code is downloaded from public content delivery networks. Only the helper code is downloaded; your files are not sent to them.
3. The Vault (optional account)
An account is needed to use the tools and the Vault. We store:
- Account details: your username and a scrambled (hashed) login code made from your password in your browser. Your real password never reaches us. We do not ask for an email address or phone number. We also keep your encryption key in locked form (locked by your password and, separately, by your recovery code) and a scrambled login code made from your recovery code. They cannot open your files without your password or recovery code.
- Your documents: the results you save, stored only as encrypted data. File names are encrypted too. We can see the file type (for example PDF or JPG), the size and the date it was added.
- Security counters: a count of recent wrong password attempts and, if needed, a temporary lock time, to protect your account from guessing.
We use this information only to run the service: to log you in, store your encrypted files, let you delete them, and protect the service from abuse. Because your files are encrypted with a key that stays on your device, we cannot open, read or scan them.
The site administrator can see usernames, sign-up dates, and how many files and how much storage each account uses, and can block or delete accounts. The administrator cannot see or open file contents or file names, and cannot see or reset passwords.
4. Cookies and browser storage
| Name | What it is for | How long |
|---|---|---|
vault_session (cookie) | Keeps you logged in. Essential, so it is set only when you log in or sign up. It cannot be read by page scripts (HttpOnly). | Up to 7 days, or until you log out |
ptk-cookie-ok (browser storage) | Remembers that you closed the cookie notice. | Until you clear your browser data |
ptk-snd (browser storage) | Remembers your sound on/off choice. | Until you clear your browser data |
ptk-vault (browser storage) | Holds your encryption key on this device so your files can be locked and unlocked. It cannot be exported, and it is removed when you log out. | Until you log out or clear your browser data |
ptk-vault (browser storage) | Holds your encryption key on this device so your files can be locked and unlocked. It cannot be exported, and it is removed when you log out. | Until you log out or clear your browser data |
ptk-vault (browser storage) | Holds your encryption key on this device so your files can be locked and unlocked. It cannot be exported, and it is removed when you log out. | Until you log out or clear your browser data |
We do not use advertising or analytics cookies.
5. Services that help us run the site
- Vercel hosts the website and runs the Vault code. Like most hosts, it may log technical details of each request such as IP address, browser and time.
- Supabase provides the database and private file storage for the Vault.
- Google Fonts supplies the fonts, and cdnjs, jsDelivr and unpkg supply helper code libraries. When your browser fetches these, those services can see your IP address and browser details.
These providers process data on our behalf or to deliver their own service, under their own privacy terms. We do not sell your personal data.
6. How long we keep data
Your Vault files stay until you delete them. You can delete any file, or your whole account, from the Vault page. Deleting your account removes your account and all your files from our systems. Copies in provider backups or logs, if any, are removed on the provider’s normal schedule.
7. Security
Connections use HTTPS. Your files and their names are encrypted in your browser (AES-256-GCM) with a key made from your password, so only you can open them. We cannot recover that key. If you forget your password, you can set a new one with the recovery code you saved when you signed up. If you lose both your password and your recovery code, your files cannot be recovered by anyone, including us. The login code that reaches our server is stored with a slow, salted hash. No system is perfectly secure, and a compromised device or browser could expose your files. Please do not rely on the Vault as your only copy of anything important.
8. Your choices and rights
You can view, download and delete your documents and delete your account yourself at any time. You can also contact us at to ask about your data. Depending on where you live, laws such as India’s Digital Personal Data Protection Act, 2023 may give you additional rights, and we will respond as those laws require.
9. Children
The Vault is not meant for anyone under 18. If you think a child has created an account, please contact us and we will delete it.
10. Changes
If we change this policy, we will update the date at the top of this page. If the changes are significant, we will make that clear on the site.