Privacy policy
SPOTTOOLS processes your files on your own device and never receives, stores or transmits them; this policy explains the little that the site does handle.
Effective {{ site.effective }}. Operator: {{ site.legalEntity }}, {{ site.address }}. Business Registration number: {{ site.brNumber }}. Privacy contact: {{ site.privacyEmail }}.
1. Summary
- Files you process never leave your device. When you upload a file here, it is opened and processed in your browser and never sent to us.
- By default the site stores nothing about you except, in your own browser, your cookie choice and theme.
- Google Analytics 4 and advertising cookies are off until you accept them, and can be switched off again at any time on the cookie settings page.
- We never send filenames, file contents, image data or anything derived from a file to analytics or advertising partners.
2. Files you process
When you upload a file here, it is opened and processed in your browser and never sent to us. “Upload” on this site names your action — choosing or dropping a file — not a transfer: the file is read into the tab’s memory, transformed there, and the result is offered for download from memory. No copy is sent to us or to anyone else. When you close or reload the tab, the browser discards it.
When you choose to continue a batch in another tool (for example Compress after HEIC to JPG), the finished files are placed in your browser’s local IndexedDB storage on your device, read once by the next page, and deleted. Entries not collected within 15 minutes are discarded. This storage is on your device only and is never synchronised to us.
On browsers that cannot decode HEIC natively, the page loads an open-source decoder hosted on this site’s own domain. No file is sent to obtain it.
3. Data we collect
Essential storage (always on). One entry in your browser’s local storage, named {{ site.storageKey }}, records your consent choice and the date you made it; another records your light or dark theme. These are not cookies, are not transmitted, and are removed when you clear site data.
Server logs. Our hosting provider records standard request logs (IP address, requested URL, browser type, timestamp) to serve pages and defend against abuse. Logs are retained by the provider for a limited period and are not used to profile you.
Analytics (off until you consent). We use Google Analytics 4, operated by Google LLC, in Consent Mode. Until you accept the Analytics category, the Google Analytics script is not loaded and no data is sent to Google. When you accept, GA4 collects: pages viewed, referring site, approximate location derived from IP, device and browser type, and the events listed in section 4. IP addresses are not stored by GA4. Data is retained for 14 months. You can withdraw consent at any time on the cookie settings page; the change applies immediately without reloading.
Advertising (off until you consent). Ads are shown in fixed positions to keep the tools free. Until you accept the Advertising category, ad partners may show only non-personalised ads and may not store advertising cookies (Consent Mode signals ad_storage, ad_user_data and ad_personalization as denied). When you accept, partners may set cookies to personalise and measure ads. The list of partners will be published on this page when advertising goes live; no advertising scripts are loaded on the site before then.
4. What analytics events contain
With analytics consent, the site records these events: which tool card was clicked; that files were selected, with the number of files and total size as ranges (for example “2–5 files, 10–50 MB”); that a conversion started and finished, with its duration; that a chain step was taken from one tool to another; that a download was made, single or ZIP; that an error was shown, by category; and which fancy-text style was copied. No event ever includes a filename, file contents, image data, dimensions of a specific file, or any identifier derived from a file.
5. Cookies and similar storage
| Consent choice (local storage) | Essential. Stores whether you accepted or rejected analytics and advertising, and when. Kept until you clear site data. |
|---|---|
| Theme (local storage) | Essential. Stores light or dark preference. Kept until you clear site data. |
| Chain hand-off (IndexedDB) | Essential, on your device only. Temporarily holds finished files between two tool pages. Deleted when read or after 15 minutes. |
| Google Analytics cookies (_ga, _ga_*) | Analytics, only after consent. Distinguish returning visits. Expire after 2 years or when you withdraw consent and clear site data. |
| Advertising cookies | Advertising, only after consent. Set by ad partners for personalisation and measurement. Durations are set by each partner and will be listed here when advertising goes live. |
6. Legal basis and jurisdiction
The operator is established in {{ site.jurisdiction }} and handles personal data in accordance with the Personal Data (Privacy) Ordinance (Cap. 486). For visitors in the European Economic Area and the United Kingdom, analytics and advertising rely on your consent (GDPR Article 6(1)(a)); essential storage relies on our legitimate interest in operating the site (Article 6(1)(f)). For visitors in California, we do not sell personal information; the advertising category, once live, may constitute “sharing” under the CCPA, which you can decline by rejecting it in the banner.
7. Your rights
You can withdraw consent at any time on the cookie settings page. Depending on where you live you may also have rights to access, correct, delete or export personal data about you, and to object to or restrict its processing. Because we hold no account data and never receive your files, most requests concern analytics data held by Google; contact {{ site.privacyEmail }} and we will help you exercise them. You may also complain to your local data protection authority or, in Hong Kong, the Office of the Privacy Commissioner for Personal Data.
8. Children
The site is not directed at children under 13 and does not knowingly collect personal data from them. With analytics and advertising off by default, a visitor who never accepts the banner is not tracked at all.
9. Changes
If this policy changes materially — for example when advertising partners are added — the effective date above is updated and the banner is shown again so you can review your choice.