Privacy policy

UtiloNest is a collection of free online tools. This policy explains what happens to your data when you use the site. The short version: many tools work in your browser, so the files and text you put into them stay on your device. Tools that need more power, such as Word to PDF, OCR PDF and the AI tools, run on our own server. They receive only the file you choose, never pass it to anyone else and delete it within 1 hour. Every tool page says which kind it is.

Tools that work in your browser

Many of our tools (most PDF, image, QR, developer and text tools) run entirely inside your web browser. We call them browser tools, and their pages say "Works in your browser". When you pick a file or paste text, it is read and processed on your own device using JavaScript and WebAssembly. It is not uploaded to us or to anyone else, and we cannot see it.

Some browser tools download extra code the first time you use them, for example the HEIC photo decoder or the barcode reader. These are plain downloads of our own static files: nothing about you or your files is sent with them.

We do not record the names, sizes or contents of the files you process. If analytics is switched on (see below), it only receives anonymous events such as "a file was processed" with rough size and time ranges.

Tools that run on our server

Some jobs need software or computing power that a browser doesn't have, so these tools run on our own server:

• Word to PDF, Excel to PDF and PowerPoint to PDF, which convert with LibreOffice;
• OCR PDF, which reads the text with the Tesseract OCR engine;
• Remove background and Upscale image, which use the open AI models MODNet and Real-ESRGAN.

Their pages say so. This is what happens when you use them:

• What we receive: only the file you choose and its settings (for example the OCR language or the background colour), nothing else from your device.
• How it travels: over an encrypted HTTPS connection.
• What we do with it: we process it on our own server, where the software and the AI models run. No third party receives your file, and it is never used to train AI.
• How long we keep it: the uploaded file is deleted as soon as it has been processed, and the result when its 15-minute download window closes. Everything is gone within 1 hour at the latest, or at once if you press "Delete from our server now" on the result.
• What we log: never file names, file contents or recognised text. To enforce the daily limits we count jobs per account, or per IP address for visitors without an account. The IP address is hashed with a salt that changes every day, so the count cannot be traced back to you after that day.

Blur faces

Blur faces blurs your photo in your browser, but uses our server to find the faces. Your browser sends a smaller copy of the photo (at most 1024 pixels on its longest side) over HTTPS. Our server looks for faces in memory, sends back only their positions and doesn't store the copy. The full-size photo and the blurred result stay in your browser. Finding faces counts towards a daily limit in the same way as the server tools.

Accounts

You don't need an account to use any tool. A free account raises the file size and daily limits of the tools that run on our server. If you create one, we store:

• your email address and, if you give it, your name;
• a one-way hash of your password (we never store the password itself);
• whether you have confirmed your email address;
• sign-in sessions (as hashed tokens) so you can stay logged in, and when they were created and expire;
• one-time tokens for email confirmation and password reset (hashed, deleted from use once used or expired).

We use this only to run your account and to send you account emails (confirmation, password reset). You can delete your account at any time from the Account page; this deletes the account and its sessions and tokens.

Feedback

If you answer "Was this tool helpful?", we store which tool it was about, the page language, your answer and any comment you type. Please don't put personal details in comments.

Cookies

We set these cookies only when you sign in, and they are needed for the account to work:

• utilo_at: a short-lived sign-in token (HttpOnly, 15 minutes);
• utilo_rt: a longer-lived token to renew the first one (HttpOnly, sent only to our sign-in endpoints);
• utilo_session: a flag that tells the page to show "Account" instead of "Log in" (it contains no personal data).

When advertising or analytics are switched on, Google AdSense and Google Analytics may set their own cookies. For visitors in the European Economic Area, the UK and Switzerland, they ask for consent first through Google's consent message, and without consent only non-personalised or limited ads are shown. You can change your choice at any time with the Privacy settings link at the bottom of every page.

Advertising and analytics

The site is funded by ads served by Google AdSense. Google may use cookies to show ads based on your visits to this and other websites; see Google's explanation at policies.google.com/technologies/ads. We use Google Analytics to understand which tools are used, with the anonymous events described above, and Cloudflare Web Analytics, which does not use cookies.

Service providers

• Cloudflare delivers the site, protects it from attacks and provides cookie-free analytics.
• MongoDB Atlas hosts our database (accounts and feedback).
• Our email provider delivers account emails.
• Google provides advertising and analytics, as described above.

These providers process data on our behalf only to provide their service.

Server logs

Our servers keep short technical logs (time, address requested, response status; never the names or contents of files) to keep the service running and secure. IP addresses are removed from these logs. To limit abuse (for example password guessing), we count requests per visitor using a one-way hash of the IP address that changes every day and is kept only in memory.

How long we keep data

Files sent to the server tools are kept for at most 1 hour, as described above, and the smaller photo copies used by Blur faces are not stored at all. Account data is kept until you delete your account. Feedback is kept to improve the tools. Logs are kept for a short period and then deleted.

Your rights

You can see and delete your account data yourself on the Account page. For any other request about your data, or a question about this policy, contact us at [email protected]. Depending on where you live, you may also have the right to complain to your data protection authority.

Children

UtiloNest is not directed at children under 13, and we don't knowingly collect their personal data.

Changes

If we change this policy, we will update this page and the date below.