Privacy Policy

The short version

There are no accounts, no user database and no tracking profile. Files processed in your browser never reach the server. Files processed on the server are deleted within seconds of the job finishing. The main privacy consideration on this site is not the tools — it is the third-party advertising described below.

Your documents

Browser-side tools

Tools labelled Runs in your browser process your file entirely on your own device. The file is read into your browser's memory and never transmitted to us or anyone else. We cannot see it, store it or recover it, and there is nothing for us to delete.

Server-side tools

Tools labelled Processed and deleted transmit your file over an encrypted HTTPS connection to a temporary folder on the server. There:

• It is stored under a randomly generated name with restrictive file permissions, never under its original filename.
• It is processed, and the uploaded original is deleted immediately afterwards — including when the job fails or errors partway through.
• The result is held behind a single-use link containing a 128-bit random token. The file is deleted the moment it is downloaded, and swept automatically after 15 minutes if it never is.
• It is not copied, backed up, indexed, inspected, used for training, or shared with anyone.

Uploads are capped at 32 MB. Result links carry noindex instructions and are disallowed in robots.txt, so they are not crawled by search engines.

Information collected automatically

Server logs

Like effectively every web server, ours records standard request information: IP address, timestamp, requested URL, referring page, and browser user-agent string. These logs exist for security, abuse prevention and diagnosing faults. They are kept only as long as the hosting provider retains them and are not used to build a profile of you.

Abuse throttling

To stop one visitor monopolising the server, the number of jobs run from a single address in a five-minute window is capped. This is enforced by storing a truncated one-way hash of your IP address alongside a list of recent job timestamps — never the address itself. These records expire on their own and are used for nothing else.

Error logs

When a tool fails, a technical description is written to the server error log so the fault can be fixed. Log entries record what went wrong in the code, not the contents of your document.

Storage on your own device

CarenCart does not use cookies for anything of its own. It does use your browser's local storage, which stays on your device and is never transmitted to us, to remember three things: your light/dark theme choice, tools you have marked as favourites, and a short list of recently used tools so they appear at the top of the home page. Clearing your browser storage for this site removes all of it and breaks nothing.

A session cookie is set only on pages with a server-side form, and only to carry the anti-forgery token that protects that form from being submitted by another site. It contains no personal data and expires when you close your browser. Full detail is in the Cookie Policy.

Third parties

Three external services are involved in loading these pages. We do not control their data practices, and each has its own policy.

Advertising

This site may show advertising. Third-party vendors, including Google, use cookies to serve ads based on your prior visits to this or other websites.

These cookies are set by the advertising partners themselves, not by us, so we cannot list them or control how long they last.

You can turn off personalised ads in Google Ad Settings, or opt out of third-party advertising cookies more widely at aboutads.info and youronlinechoices.com. Opting out makes ads less relevant; it does not remove them.

Advertising never sees your documents. Ad code runs in the page, not in the tools. Browser-side files are never transmitted anywhere, and server-side files are handled by a separate path that no advertising code can reach.

Google Fonts

Typefaces are loaded from Google's font service, which receives your IP address and browser information as a normal consequence of serving the file.

Cloudflare cdnjs

A few browser-side PDF tools load their processing libraries from the public cdnjs content delivery network, which likewise receives your IP address when the script is fetched. The library is downloaded to your device; your document is not uploaded anywhere as a result.

Your rights

Depending on where you live — for example under the GDPR in the EU and UK, or the CCPA in California — you may have the right to access, correct, delete or export personal data held about you, and to object to certain processing.

In practice we hold almost nothing to act on: there are no accounts, your documents are already gone, and hashed throttling records cannot be linked back to you. For anything held by an advertising partner, the controls linked above are the direct route. If you believe we hold data about you and want it addressed, write to contact@carencart.com and we will respond as required by law.

Children

This site is a general-purpose utility and is not directed at children under 13. We do not knowingly collect personal information from children.

Security

All traffic is served over HTTPS. Uploads are validated by type and size, stored with restrictive permissions under random names, and deleted after processing. Forms are protected against cross-site request forgery. No system is perfectly secure, but the most effective protection here is structural: we do not keep the data in the first place.

Changes

If this policy changes materially, the revision date at the top of the page will change with it. Continued use after a revision means you accept the updated policy.

Contact

Privacy questions can be sent to contact@carencart.com or through the contact form.