Privacy & data use

Image tools and everyday generators

Image editing, resizing, compression and conversion run in your browser. The image-tool code does not upload your source images to a processing server. QR codes, barcodes, passwords and color utilities are also generated locally.

The site still makes ordinary requests to load its pages and resources. A file you explicitly pass from an image tool to a PDF workflow follows the PDF processing path described below when you run that operation.

PDFs and document conversion

Choosing a source file lets the browser show its preview. Running a PDF operation uploads the source bytes, file names and selected settings to this site’s processing endpoint. Generating an edited PDF also sends its source and edits to this site. The response returns the generated download; these processing and download responses use private, no-store cache instructions.

The direct PDF endpoints do not create a saved-document history or database record. Some processing engines work in memory. Native security, OCR and Office conversion engines can use temporary files on the server’s disk and attempt to remove their working directories when the request finishes. This is not a guarantee of immediate erasure after a crash, interrupted process or infrastructure failure.

Public PDF tools do not require an account. Separate legacy account and document-job services remain in the application; their storage and retention depend on the backend and deployment configuration. This page does not establish their retention period.

Health calculations and optional tracking

Health calculators send the calculator name and entered values in a POST request body to this site. Downloading a health PDF summary sends the values needed to create it. Those endpoints calculate a response without saving the inputs to a database or logging their content in the application code. Responses use private, no-store cache instructions, and measurements are not placed in the request URL.

The separate health tracker is off by default. If you explicitly enable tracking, records are stored in unencrypted localStorage in this browser. The tracking module does not send those records to an API. Tracking is device and browser specific, with no account sync.

The tracker provides export and erase controls. Anyone with access to the browser profile may be able to read saved records. Clearing site data, changing browsers or losing the device can remove them; exported copies remain wherever you save them.

Career drafts and exports

Resume and cover-letter drafts stay in this tab’s memory by default. They can survive navigation within the site in that tab, but reloading or closing it can lose unsaved work.

Save on this device is optional. It stores that builder’s draft, including personal details and any profile photo, in unencrypted localStorage. Turning it off deletes that builder’s saved draft. JSON backup and import are separate actions you control; downloaded backups may contain personal information.

PDF and Word / DOCX exports send your current document to this site’s career-export endpoint. That endpoint generates the requested file without persisting the document or logging its content in application code, and returns a private, no-store response.

Recent tools, cookies and accounts

The site automatically stores up to six recent tool shortcuts in localStorage. Only recognized non-health tool names are allowed. This list contains tool slugs, not your uploaded files, document contents or health measurements. Use Clear recent tools on the recent-tools list to remove it.

Sign-in uses Auth.js session cookies and communicates with the configured account backend. Account registration, authentication and legacy document jobs are separate from the public tools. Account-data and backend-job retention are deployment specific and have not been established by this frontend description. The profile’s disabled account-deletion control does not currently provide a deletion workflow.

Browser site-data controls can remove this site’s cookies and localStorage. That can sign you out and remove saved drafts, tracking records and recent shortcuts; it does not by itself delete backend account data or copies you downloaded.

Service requests and infrastructure

Page loads and server requests expose ordinary connection information, such as an IP address and user agent, to the hosting and network services that deliver the site. The frontend code alone does not establish which infrastructure logs are enabled, who can access them or how long they are retained.

Private, no-store response headers ask caches not to retain a response. They do not establish complete infrastructure retention, erase a user’s download, or certify a security or legal-compliance standard.

Advertising and analytics

The current advertising spaces reserve room in the layout. They do not load an advertising SDK or make advertising or analytics requests. An ad-account identifier or site-verification tag, when configured, is metadata rather than a live ad script.

Before live advertising or analytics is enabled, this disclosure needs to identify the actual providers and their data use, and the site needs any required consent controls. Current placeholders do not mean that live advertising or consent management has been implemented.

For practical storage and download instructions, visit Help.