Your work stays yours.

Image, PDF, text, developer, everyday and audio-trimming tools process inputs in your browser. Their implementation does not upload file or text contents. Tool code is served from this website; no third-party fonts, analytics or advertising scripts are embedded.

What stays on your device

Theme preferences, favorites and up to 12 recently visited tool names use local storage. You can disable recent history or clear it in All tools → Recently used. Remove favorites using their stars. Clear site data in your browser to remove all preferences and offline caches. We do not store input text, generated passwords or uploaded file contents in local storage or offline caches.

Optional media downloader

The downloader is different: it sends your chosen URL and output format to this installation’s server. The server contacts an approved media source and temporarily stores the result. Temporary files expire 15 minutes after job creation, or are deleted on failure or cancellation. Only use content you are permitted to download. Do not enter secret or private URLs.

Hosting and logs

Visiting any website shares network information, including your IP address, with its host. Hosting operators may retain ordinary access logs. Actual log retention depends on deployment configuration. Downloader job credentials and submitted URLs should never be recorded in access logs.

Optional accounts and mandatory two-factor authentication

Accounts are optional for browser tools. If the account service is enabled, registration sends your email address and password to this installation over HTTPS. Passwords are stored using memory-hard scrypt hashing. Every account must verify its email, enroll a TOTP authenticator and confirm recovery-code storage before account access. Authenticator secrets and queued email links are encrypted at rest. Only hashes of session tokens, API keys, trusted-device tokens and recovery codes are stored.

Verification and password-reset messages pass through the configured provider (Resend by default), which receives the destination email address and message contents. Email links do not bypass two-factor authentication. Password resets for enrolled accounts also require an authenticator or recovery code. Session cookies expire after eight hours; setup and recovery challenges after ten minutes. Optional trusted-device cookies expire within 30 days and can be revoked. Sensitive changes require a recent password and authenticator check.

Account activity and retention

The account service records security and operational events using account identifiers, event types, timestamps and safe request metadata. Temporary abuse-prevention buckets use hashed network and account identifiers. It does not record passwords, authenticator keys, recovery codes, raw API keys, request bodies, private tool inputs, documents or keystrokes. Operational events default to 30 days of retention; operators can configure 1–365 days. Expired session, device, link, API-key and rate-limit records are removed automatically.

Sharing signed-in tool usage counts is optional and off by default. You can enable it in Account; it sends only tool names and associates counts with your account. The preference stays on your device. Your text, files, calculations and generated contents are excluded.

DEV administrators can view necessary account, security and operational records, but cannot view passwords, authentication secrets or private uploaded files, or impersonate users. Access to sensitive records and privileged changes is recorded separately in signed audit files. The deployment must configure privileged-log retention and protected archival, initially 365 days; these logs are not erased from the dashboard. The operator must disclose any differing retention and legal obligations before enabling accounts.

Account deletion removes credentials, tokens, recovery codes and queued messages, and removes account identifiers from operational event records. Restricted privileged audit records retain pseudonymous account IDs for the disclosed security retention period. Protected backups may retain prior account data until their configured backup retention expires; operators must disclose that schedule and reapply deletions after restores. When billing is enabled, Stripe receives your billing email and payment details through hosted Checkout and the billing portal. HandyTechHelper stores provider customer, purchase, subscription, invoice and payment identifiers and status, amounts and currency; card details are handled by Stripe. Test-mode records are separate from live entitlements. Deletion cancels recurring subscriptions first and removes the internal account ID from retained financial records; provider customer and transaction identifiers may remain for accounting. Financial retention must be set by the operator according to applicable obligations. Hosting and email-provider logs follow their separately configured retention.

Paid server tools and saved settings

The existing browser tools still process locally. The separately labeled personal batch, professional API and automation features send only the inputs you choose to the server. Job inputs and results are encrypted at rest and expire after one hour. Saved workflows retain encrypted text until you delete them; saved presets store settings, never files or text input. Usage accounting records operation counts and billing periods, not contents. API and processing limits protect shared resources. Operators must protect encryption keys and restrict database and backup access.

Limits to these protections

Your browser, extensions, operating system and device remain part of the trust boundary. File parsers can contain bugs. This website cannot guarantee complete security or removal of every metadata field. Review sensitive output with tools appropriate to your needs.