/ LEGAL

Privacy policy

Last updated: September 28, 2026. What inyourbrowser.com collects, what it does not collect, and how to verify the claims for yourself.

The short version

• Everything you process is handled locally in your browser; our servers receive no file content.
• No cookies. The only browser storage the site writes is two localStorage keys: theme (light/dark mode) and nc_dismissed (whether you closed the floating request counter).
• Your browser keeps some records of its own, such as your history and its list of downloads. What your browser may keep explains what the site does to limit them.
• No analytics, tracking, or advertising. No third-party scripts on any page.
• No account or email address is required for any feature.
• We do not sell, share, or monetise personal data.
• Verify all of the above in your browser's developer tools at /verify-local.

How the tools work locally

Every tool is a small JavaScript program that runs inside your browser tab. Files you select or text you paste are loaded into the browser's memory and processed using standard browser APIs (File API, Canvas, Web Crypto, Web Workers). The result is returned to you as a download or as text in the page, then released from memory when you close the tab. The site's code keeps no copy of what you process: it writes none of it to localStorage, IndexedDB or Cache Storage, and sends none of it to our servers. Your browser may still keep some records of its own on your device; the next section explains which ones.

What your browser may keep

Browsers keep records of the pages you use, on any website. This is what the site does to keep your data out of them, and what can remain:

• Restoring tabs. Browsers save what you type into a page, and which files you picked, with the tab's history, so they can put it back when you press Back, reopen a closed tab or recover from a crash. The site marks its text boxes autocomplete="off", which Chrome, Edge and Firefox honour by not saving them. Safari may still save their contents. File pickers are cleared as soon as you choose a file, so the file's name and folder are not saved with the tab.
• Downloads. Every download is handed to your browser through a temporary blob: link created in the tab, never a data: link, which in Chrome and Edge would put the file's contents into the download history. Your browser's download list still records the file name, the folder you saved it to, its size and the page address, but not the file's contents. The downloaded file stays wherever you saved it until you delete it.
• Search. The site search puts your search term in the page address after a #. That part of the address is not sent to our servers, but your browser saves the full address in its history, and history sync, if you have it on, copies it to your browser account. Nothing you enter in a tool is put in the address.
• Back and forward. If you leave a tool for another page in the same tab, your browser may keep the tool page, with your work in it, in memory for a while so that Back can show it again instantly. Closing the tab clears it.
• Copying. When you copy a result, your operating system may keep it in its clipboard history or sync it to your other devices (for example Windows clipboard history and cloud clipboard, or Apple's Universal Clipboard).
• Spell check and writing aids. Some browsers check spelling or suggest text using an online service. The site turns spell checking and writing suggestions off on every page.
• AI assistants and extensions. AI assistants built into some browsers (such as Gemini in Chrome, Copilot in Edge and Firefox's AI chatbot) and browser extensions can read the page, including what you type and the results, and may send it to their providers. No website can opt out of this.

On a shared computer, use a private window and close it when you are done, and delete any downloads you no longer need.

The Content Security Policy

Every page carries a Content Security Policy (CSP) header containing the directive connect-src 'none'. This instructs your browser to block the usual network requests a script would use to upload data: no fetch(), no XMLHttpRequest, no WebSockets, no Server-Sent Events, no beacons. The browser blocks these before any data can leave your tab. Each page also lists the exact inline scripts it was built with, so a script added later is refused, and in current browsers Trusted Types stop code from writing raw markup into the page and a guard in each page cancels attempts to move the tab to another site. None of this covers every channel, though: a WebRTC connection, a link hint that makes the browser look up or contact an address, or a new tab opened on your next click are not blocked. The technical guide lists them. The site's own code uses none of them.

This is the technical mechanism behind the no-upload promise. You can inspect the header yourself in your browser's Network tab; /verify-local walks through how. The CSP is enforced by your browser (Chrome, Firefox, Safari, Edge all honour the spec), not by us.

What we actually collect

Server access logs

When you request a page, the hosting provider's servers record standard access log data: IP address, requested URL, HTTP status, timestamp, and user-agent string. These exist for operational reasons (outage diagnosis, abuse blocking, debugging) and are managed by the provider under its standard practices. We do not link them to any other identifier.

Browser localStorage

The site writes two keys to your browser's localStorage. theme stores light or dark (your visual preference). nc_dismissed stores 1 if you have closed the floating request counter, so it stays hidden on later visits. Both keys live on your device only and you can delete them through your browser's site-data settings.

That is the complete list

We do not collect or retain:

• any file content you process with the tools, or its output;
• your name, email address, phone number, or any other personal identifier;
• any data through cookies (there are none) or third-party analytics (there are none);
• your behaviour across other websites; or
• your precise or coarse location.

Camera permission (QR code scanner only)

The QR code scanner can optionally use your camera. The camera is activated only when you click "Start camera" in that tool, and your browser then prompts for permission. Once granted, the video feed is attached to a <video> element, individual frames are sampled into an off-screen <canvas>, and the open-source jsQR library decodes them locally. The stream is not recorded, transmitted, or retained, and the camera is released when you stop the scanner or close the tab. You can revoke the permission at any time in your browser's site settings.

Cookies and third parties

This site sets zero cookies, has no cookie banner (nothing to consent to), and includes no third-party analytics, advertising, tag managers, error trackers, social-media widgets, or external iframes. There are no <script> tags pointing to any external domain.

The site does use open-source JavaScript libraries: pdf-lib, pdfjs-dist (PDF.js), qrcode, jsqr, jsbarcode, marked, js-yaml, sql-formatter, and cronstrue. These are bundled into the site at build time and served from the same origin. They run in your browser without contacting their original authors. See the licenses page.

Architectural commitment, not warranty

The local-only architecture is a design intent and a best-effort technical commitment, not a contractual warranty. Software contains bugs, browsers contain bugs, and third-party libraries can in principle be compromised. The CSP described above is the reasonable measure we have taken, and we encourage you to verify the behaviour yourself before processing sensitive content. Legal terms are in Section 3 of the Terms of Service.

GDPR (users in the European Economic Area)

The site is operated from Sweden. Processing of personal data falls under the GDPR (Regulation (EU) 2016/679). The only personal data we process is the standard server-access log data described above; the legal basis is our legitimate interest (GDPR Article 6(1)(f)) in operating, securing, and debugging the site. Logs are retained for the limited period required for those purposes and are not used for anything else.

Because we do not maintain a queryable database linking log entries to identities, we cannot fulfil data-subject access requests beyond what is in those logs. You may lodge a complaint with the supervisory authority in your country of residence. In Sweden the supervisory authority is Integritetsskyddsmyndigheten (IMY), www.imy.se.

California residents (CCPA / CPRA)

The only category of personal information collected through this site is the server-access log data described above (which may include IP address). We do not sell or share personal information for cross-context behavioural advertising, and do not use sensitive personal information for any purpose beyond operating the site.

Children's privacy

The site is a set of general-purpose utilities and is not directed to children under 13 (United States) or under 16 (European Union, where applicable). We do not knowingly collect personal information from children. Since the site requires no accounts or personal data beyond server logs, this section is included for completeness.

Data retention & policy changes

The localStorage keys persist in your browser until you clear site data. Server access logs are retained by the hosting provider for the period needed for technical operation and security. No other data is retained because no other data is collected. If we make material changes to this policy we will update the date at the top of this page; continued use after a change constitutes acceptance.

Contact

Technical questions about how the tools work are addressed on the about page and the verification page. For direct enquiries, email contact. EEA residents may also contact their national supervisory authority (in Sweden, IMY at www.imy.se).