Most sites make this claim in a policy document. Here it's a property of how the site is built — and you can verify it yourself in about thirty seconds.
Open any tool and press F12 for developer tools
Switch to the Network tab
Process any file and watch the requests
Requests carrying your file: zero
Concrete measures, not reassurance.
Every library and font is served from this site's own folder — no CDN, no Google Fonts, no QR service. Your documents are never fetched from or sent to anywhere. Two outbound calls exist: Google Analytics, which records the page visit only, and the contact form, which delivers the message you typed and is blocked on every other page.
default-src 'self' with object-src 'none', base-uri 'none', form-action 'none' and frame-ancestors 'none'. Injected external scripts, clickjacking frames and form hijacking are all blocked.
This is a static site. There is no backend to breach, no database to leak, no accounts to steal and no upload endpoint to attack. Entire categories of vulnerability simply do not apply.
Only six libraries ship, each pinned to an exact version and vendored locally. Nothing updates itself behind your back — the polyfill.io style attack is impossible here.
A no-referrer policy is set site-wide. There are no advertising cookies and no accounts. Google Analytics is used to count visits — it never sees your files. See Analytics below.
Plain HTML, CSS and JavaScript. Press Ctrl+U and read every line, or open the folder and check the files. There is no build step hiding what actually runs.
A privacy page that only lists strengths is marketing. Here are the real boundaries.
Only on the contact page, the message you type is passed to EmailJS so it reaches our inbox. It carries just what you wrote — never a document, never anything from the tools. Every other page is blocked from contacting them at all, and you can always copy the text and email us yourself instead.
Because everything is local, the safety of your files depends on your own machine. If your device has malware, no website can protect your documents from it.
Whoever hosts these files can see that a browser downloaded the page, as with any website. They never see your documents — those are never sent.
OCR needs a 15 MB language model that would have to come from an external CDN. Rather than break the no-third-party rule, it ships disabled. The README explains how to enable it locally.
Real PDF encryption cannot be done safely in a browser. We mark that tool unavailable rather than ship a fake lock that gives false confidence.
Removing the server and the CDN doesn't make a site magically secure — it removes entire categories of attack that cannot happen when there's nowhere for your data to sit and nothing being fetched from a third party. What remains is protecting the hosting account itself, which is standard practice: strong passwords and two-factor authentication.
This site uses Google Analytics 4 to count visits. Here is exactly what that means.
Which page you opened, roughly when, the referring link, your approximate location from a truncated IP address, and basic device and browser details. It sets cookies to tell a returning visit from a new one.
Your files. Every tool runs inside your browser and no document is uploaded anywhere, so there is nothing about your PDFs, photos or marksheets for analytics to collect — no names, no page counts, no contents.
IP anonymisation is on, and Google Signals plus ad personalisation are switched off, so the data is not fed into advertising profiles. The Content Security Policy permits Google's analytics domains only — no other external script can load.
Turn on “Do Not Track” or a tracker blocker such as uBlock Origin, use a private window, or install Google's official opt-out browser add-on. Every tool keeps working normally with analytics blocked.
We would rather say this plainly than claim the site collects nothing. The important promise is unchanged: your documents never leave your device.