Local tools
Browser-local tools keep files on your device
Tools labelled Browser-local read your file with the browser's File API and process it in JavaScript on your device. The file is never uploaded to our servers.
Privacy
How your files are handled, in plain words
Every tool tells you whether it runs locally in your browser, on our server, or via an AI service. This page collects the rules in one place.
Last updated: 17 October 2026
Server tools
Uploaded, processed, deleted
Tools labelled Server-side upload your file over HTTPS, process it, return the result, and delete the input within minutes. Retention is capped at 1 hour. We do not train models on your files.
AI tools
Sent to a model provider
Tools labelled AI send the relevant input to our AI provider to produce a response. We use providers with no-training defaults and short retention windows. The badge on each tool names the provider.
Third-party code
What runs on this page
To keep our local-first promise honest, we vendor third-party libraries instead of loading them from a CDN at runtime. The bundles below ship from our own origin.
- pdf-lib — read and write PDF files (MIT)
- pdf.js — render PDF pages, extract text (Apache 2.0)
- JSZip — pack multiple results into a single ZIP download (MIT/GPL)
- node-qrcode — generate QR codes (MIT)
These are the only third-party libraries needed for tool processing. If you accept analytics, Google Tag Manager loads Google Analytics 4, Microsoft Clarity and Clicky. None of these analytics tools load before consent. We do not load third-party fonts or ads.
Cookies
None for tool use
Free use of the tools does not require cookies. Google Analytics, Microsoft Clarity and Clicky can set cookies only after you accept analytics.
Passes
Stripe handles payment
You can buy a Day Pass or Project Pass online through Stripe Checkout. Stripe collects payment and contact details. After payment, this browser stores the pass token locally.
Ads
Reserved space, never in the flow
If we add ads, they will sit below the result area or in sidebars — never inside the upload or download steps.
Reach us
Privacy questions and data requests
Email hello@niftywebtools.dev for privacy questions, data deletion, or to report a security issue.
First-party measurement
Usage counts (no cookies)
If you accept analytics, our /api/events endpoint adds to daily totals. It does not set cookies or store a persistent visitor ID. We never send file contents, file names, pasted text, QR contents or tool results.
What the endpoint counts
- pricing_view: the pricing page becomes visible.
- checkout_click: a pass button is selected, with the pass type.
- checkout_return_success: a verified checkout returns to the success page, with the pass type.
- entitlement_active_first_render: a supported tool opens with an active pass, with the pass type and tool name.
- tool_used: a supported tool runs with an accepted file, with the tool name. This counts at most once per page load.
- limit_hit: a file or batch reaches a limit, with the tool name and limit type.
- web_vitals: a broad page speed rating, with the metric and page type.
The endpoint stores daily totals for 90 days. It does not store a row for each event. The server uses your network address to limit request rates, but does not save it with the totals.
Google Analytics 4 (only if you accept)
Google Tag Manager loads Google Analytics 4 after you accept analytics. GA4 measures visits and page use. It never receives your files or anything you type into a tool. Like any web request, requests to Google Analytics, Clarity and Clicky include your network address and basic browser and device details.
GA4 can set _ga and _ga_MVNSE0EX77. The second name follows Google's _ga_<container-id> pattern. These cookies contain a random browser ID and last up to two years by default. Google Analytics keeps this data for 14 months.
Microsoft
Microsoft Clarity (only if you accept)
Clarity records clicks, scrolling, mouse movement and session replays. We mask all page text and inputs. This keeps tool contents and file names out of recordings.
On our domain, Clarity sets _clck for up to one year and _clsk for up to one day. These cookies connect page views to a browser and session.
Clicky
Clicky (only if you accept)
Clicky records visits and page views. It never receives your files or anything you type into a tool.
Clicky can set _first_pageview and _heatmaps_g2g_* for 10 minutes; _no_tracky_* for one hour; _referrer_og, _utm_og, _custom_data_* and aff for 30 days; and _jsuid for one year.
Your choice
Withdraw analytics consent
Use the link below to reject analytics again. We delete known Google Analytics, Clarity and Clicky cookies from this site and its parent domain. We also deny Google analytics storage and reload the page, which stops tags that are already running.