Privacy Policy

Every PDF and image tool on the site, with the four exceptions named below, processes your file entirely inside your browser tab. The file is read into memory, transformed, and handed back to you as a download — it is never sent to a WaryTools server or any third party.

Closing or refreshing the tab discards everything. We have no record of what you processed, because the file never reached us in the first place.

Four tools are an exception: PDF to Word, Word to PDF, PowerPoint to PDF, and Excel to PDF. They are covered separately below.

Four tools convert between PDF and an Office format, and all of them need a server.

PDF to Word has to rebuild paragraphs, headings, and tables from text that a PDF stores only as characters placed at coordinates. Word to PDF has to do the reverse: resolve styles, flow text through sections, break tables across pages, and paginate the result. PowerPoint to PDF has to render slides — resolving slide masters, theme fonts, placeholders, and embedded charts. Excel to PDF has to lay out a grid that has no page size of its own — resolving column widths, number formats, and charts, then deciding where the sheet is cut into pages. None of these is something a browser can do — the first needs layout analysis, the other three need a real office layout engine — so these four tools, and no others on the site, send your file to a server we operate.

What happens: your file is sent over an encrypted connection to our converter, which produces the output (pdf2docx for PDF to Word, LibreOffice for the two directions that produce a PDF), returns it to you, and deletes the file. The file is written to a temporary directory that is removed as soon as the conversion finishes, including when it fails. Nothing is kept after your download, and no copy is made anywhere else.

What we do not do: we do not store your document, read it, index it, log its contents, log its filename, or pass it to any third party. Our converter logs record only whether a conversion succeeded or failed. To limit abuse of a shared server we keep a count of recent conversions against a one-way hash of your IP address — the hash cannot be reversed to an IP, and it is discarded after a day.

All four tools state this on the page before you choose a file. If a document is confidential enough that sending it to any server is unacceptable, use desktop software such as Word, PowerPoint, Excel, or LibreOffice, which convert in every one of these directions locally.

Every calculator on the site runs entirely client-side too. Whatever you type into them stays in your browser and is never transmitted anywhere.

This is the one tool that stores anything, because a short link only works if something remembers what it points to. (The four converters above also use a server, but only for the length of a single conversion — they keep nothing.) When you shorten a URL, the destination URL, the generated short code, and a click count are stored in a Supabase database.

Links you create are also saved to your browser’s localStorage so they show up in your history if you come back — this is local to your device, not an account system, and clearing your browser storage clears it.

We do not log who clicked a shortened link, their IP address, or any identifying information — only an aggregate click count on the link itself.

If you send us a message through the contact form, the name, email address, and message you type are sent to our server and delivered to our inbox by email through Resend, our email provider. Your email address is used only to reply to you.

We do not store contact messages in a database, add you to the newsletter, or share what you send with anyone. Writing to us never subscribes you to anything — the newsletter is a separate, explicit opt-in described below. To limit abuse we keep a count of recent submissions against a one-way hash of your IP address — the same method the other server-backed tools use, and the hash cannot be reversed to an IP.

If you subscribe to the newsletter, we store your email address in a Supabase database, along with when you subscribed and when you unsubscribed if you do. That is the entire record — no name, no location, and nothing about which tools you use.

Subscribing takes effect immediately, and we send a welcome email confirming it. That email — like every one we send — carries a one-click unsubscribe link, so if someone entered your address by mistake, or on purpose, one click ends it permanently. Emails are delivered by Resend, our email provider, the same one the contact form uses.

Every newsletter email carries a one-click unsubscribe link that works without logging in or replying, and Gmail and Outlook show their own unsubscribe button on them too. We use no tracking pixels, so we do not know whether you opened an email; links in the emails are ordinary links and are not wrapped in a click tracker.

We never sell, rent, or share the subscriber list, and we do not use it for anything other than telling you about new posts and tools.

WaryTools uses Sentry to catch and report unexpected errors (e.g. a tool crashing partway through). When an error occurs, technical details — the error message, stack trace, and the page you were on — are sent to Sentry so it can be fixed. This is not used for tracking behavior or building a profile of you.

WaryTools uses Google Analytics to understand how the site is used — which tools get visited, roughly where visitors are located (country/city level, derived from IP, not the IP itself), what device and browser they’re using, and how they got here (search, direct link, referral). This runs by placing a cookie in your browser and sending that usage data to Google.

We use this in aggregate, not to build a profile of any one visitor: it tells us which tools are worth improving, not who you are. Google may combine this data according to its own privacy policy, available at policies.google.com/privacy.

Your file contents, calculator inputs, and the URLs you shorten are never sent to Google Analytics — it only ever sees which page you’re on, not what you do inside a tool.

WaryTools shows ads served by Google AdSense to keep every tool free with no paywall or account requirement. AdSense sets its own cookies and may use device identifiers to select and measure ads, including ads personalized to your interests based on your browsing across sites that also use Google’s advertising services.

We don’t control what AdSense collects beyond enabling it on our pages, and we never hand AdSense anything from inside a tool — no file, no calculator input, no shortened URL. Google’s own policies govern how ad data is collected, used, and retained; see How Google uses advertising cookies.

You can opt out of personalized advertising from Google at Google Ads Settings, and the industry-wide aboutads.info opt-out covers other participating ad networks.

If you’re visiting from the European Economic Area, the UK, or Switzerland, you’ll see a consent message before personalized ads are shown. It’s served through Google’s certified Consent Management Platform, and it asks whether you agree to cookies and data being used for personalized advertising and the related measurement.

You can consent, refuse, or open “Manage options” to make a choice per purpose and per vendor. Refusing is a single click, exactly like accepting — there’s no penalty for saying no, and every tool on WaryTools works identically either way, because none of them need advertising cookies to run. If you refuse, you’ll still see ads; they just won’t be personalized.

Your choice is stored in your browser so you’re not asked on every page, and it’s passed to Google’s advertising services as a consent signal.

You can change it at any time using the button below, which reopens the same message. Withdrawing consent is meant to be as easy as giving it, so this doesn’t ask you to clear cookies or dig through settings. The button appears only if a consent message applies to you — if you’re browsing from outside the EEA, UK, or Switzerland there’s no stored choice to change.

Analytics and advertising on WaryTools rely on cookies to function. You can block or delete cookies in your browser settings at any time — WaryTools’ tools themselves don’t require cookies to work, since all processing happens locally, so blocking them won’t break a PDF, image, or calculator tool. It may reduce ad relevance and stop analytics from counting your visit.

Browser-level controls (tracking protection, “Do Not Track”, private browsing) and extensions that block third-party scripts will also reduce or eliminate what Analytics and AdSense can see.

Every page on WaryTools is served over HTTPS with HSTS enforced, so your connection to the site is always encrypted and browsers are instructed to never fall back to plain HTTP. On top of that, we run a strict Content Security Policy and other security headers (frame-blocking, MIME-sniffing protection, strict referrer rules) designed to limit what a compromised or malicious script could do on the page.

Because almost all PDF, image, and calculator processing happens entirely on your device, the biggest category of risk in an online tool — your files sitting on someone else’s server — mostly doesn’t apply here. For those tools there is no upload endpoint to secure and no file storage to breach, because the file never leaves your browser. The four document converters are the exception: they receive files, so each holds a file only for the length of the conversion, deletes it immediately afterwards, accepts requests only from this site, and stores nothing.

The two pieces of persistent backend state — the URL shortener’s database and the newsletter subscriber list — are access-controlled so they only accept the exact, narrow operations needed (creating a link, reading a redirect, incrementing a click count; subscribing, confirming, and unsubscribing an address) — nothing broader. In particular, the public key the site ships in your browser cannot read the subscriber list at all: no request from a browser can retrieve an email address from it. No system is unbreakable, and if we ever learn of a security issue that affects your data, we’ll disclose it here.

Shortened URLs and their click counts are kept indefinitely so links keep working; there’s currently no self-serve way to delete one. Analytics and advertising data is retained by Google under its own retention policies, not ours. Messages sent through the contact form aren’t stored in a database, but they do stay in our email inbox the way any email does — ask and we’ll delete yours. Newsletter subscriptions are kept until you unsubscribe; after that we keep a record that the address opted out, so that it is not accidentally re-added, and you can ask us to erase it entirely. Files, images, and calculator inputs are never stored in the first place, so there is nothing to retain or delete.

If what WaryTools stores or how it processes data changes meaningfully, this page will be updated and the date at the top will reflect that.