Privacy
How we handle your files
A plain-English summary of what each tool sees, plus the technical commitments for the one tool that uploads to our server.
Four tool suites live at tools.campaign.help. Three of them — PDF, Image, and Quick utilities — run entirely inside your browser. Your files never leave your device. The fourth, Image Pro, runs on our server because some image formats and the background-removal model need real compute. This page explains what that means concretely.
Browser-only tools (PDF, Image, Quick utilities)
These three tool suites process your files locally — they're JavaScript apps running in your browser tab. We don't have a backend that handles them. There's nothing for us to log because the file never reaches our server.
You can verify this yourself: open your browser's DevTools (Network tab), drag a file into one of these tools, and watch — no upload request fires. Or read the source: each tool is a fork of an open-source project, and our forks are public.
Image Pro
Image Pro is different. It uses Python libraries (Pillow, libheif, rembg) that don't have JavaScript equivalents capable of the same conversions and background removal. So your file does upload to our server briefly. Here's what happens:
Per-request isolation
Every upload gets its own UUID-keyed temporary directory under /tmp/imgcompress-uploads/<uuid>/. Your file and any conversion outputs live only in that directory.
Cleanup within 60 seconds
When the request finishes (you get your converted file back), Flask's teardown_request hook deletes the entire UUID directory. In practice this happens within milliseconds of the response. A separate sweeper thread also runs every 60 seconds and purges any directory older than 10 minutes, in case a request fails to clean itself up.
No logging of file contents or metadata
Our access logs record HTTP method, path, and response code — standard nginx and gunicorn output. We don't log original filenames, EXIF data, file sizes, or content hashes. The server doesn't read EXIF at all.
Cache-Control: no-store
Every Image Pro API response sets Cache-Control: no-store, max-age=0. That tells your browser (and any proxy between us) not to store the response, so your converted file isn't cached on a shared edge.
100 MB upload cap
Image Pro accepts files up to 100 MB per upload. Larger files get a 413 response without being read. This is a deliberate limit — it caps how much disk space a single bad actor could fill, and matches the size of typical RAW photo bundles.
Verify any of this
The forks are all public. Read the code:
- bentopdf-ch — PDF tools
- snapotter-ch — Image tools
- imgcompress-ch — Image Pro (the privacy code is in
backend/image_converter/presentation/web/ch_privacy.py) - it-tools-ch — Quick utilities
What we collect
Page views and search queries via Plausible Analytics. Plausible doesn't use cookies, doesn't fingerprint visitors, and doesn't sell data. Search queries are recorded as event properties so we can see what people search for and improve the tool list — they're truncated to 100 characters and not associated with any identifier.
We don't have user accounts, login, ad networks, or third-party scripts beyond Plausible.
Questions
If something on this page is wrong, unclear, or has drifted from the actual code, tell us — we'll fix it.