Privacy Policy

The short version

Most tools on Prathom send your file or text to our server. It is processed there and deleted: the thing you uploaded as soon as the operation finishes, and the result within 30 minutes. Nothing is stored beyond that, no account is required, and nothing you submit is read by a person or used to train anything.

A minority of tools do the work in your browser and transmit nothing at all. Which ones is not a matter of opinion, so here is the list: every calculator, every developer tool — the encoders, the hashers, the regex tester, the JWT decoder, the UUID and password generators, the cron builder, the timestamp converter — and, among the others, the color picker, the palette sampler, the favicon generator, the SVG optimizer, image-to-base64, the non-AI background remover, find-and-replace, the lorem generator and the subtitle converter.

Everything else uploads. That includes every file converter, every PDF tool, every image tool not named above, the OCR tools, and the text tools that are not named above.

This section said the opposite until 1 September 2026, and that was wrong. It described the browser tools as the rule and the converters as the exception. The reverse became true when the processing libraries moved to the server, and this document was not updated with them. It is corrected here rather than quietly reworded, because a privacy policy that misdescribed where files go is the kind of error a reader deserves to see acknowledged.

You can still check rather than take our word for it. Open your browser's developer tools, switch to the Network tab, and use a tool: a server tool makes an upload request, a browser tool makes none.

Separately from the tools, this site measures traffic and shows advertising. Both are described below. Advertising is asked about, and can be switched off after you have already agreed, through the certified message that asked. Analytics is not asked about by us; the next section says so plainly and says what does stop it.

Cookies and similar storage

Everything this site stores on your device is listed here. There is nothing that is not in this table.

One question, asked by the system qualified to ask it

This section said something different until 3 September 2026, and the correction is the point. It described a banner of our own that asked about analytics, and said "the analytics library is not loaded at all until you answer". That was not what the site did. The region-gating setting behind it had been switched off, so analytics loaded for everyone who had not actively pressed Decline — verified against the live site on that date, on a browser with no consent cookie: the library loaded and a measurement was sent. A privacy policy that describes a stricter behavior than the software performs is the worst kind of inaccuracy, because it is the kind a reader relies on.

The banner has been removed rather than repaired, and this page now says what actually happens.

Advertising is our advertising partner's question. Serving personalized ads in Europe requires a consent platform certified under the IAB Transparency and Consent Framework, which our own banner was not and could not casually become. Our partner's certified message asks instead and records the answer directly. Its own dialog is where that answer is changed.

Analytics is not gated by a question of ours. Google Analytics loads on this site and sets its own cookie, and there is no first-party control that turns it off — we would rather say that than offer a switch which, as above, was not doing what it claimed. It records which pages and tools are used, never what you put into them. Your browser's own controls stop it: blocking third-party cookies, or any content blocker, and every tool on this site works identically if you use them.

If you are in the EEA, the UK, or Switzerland

The advertising library is loaded, because it is what presents the certified consent message — but every advertising storage signal is held at denied until you answer that message, so no advertising cookie is written or read before you do.

What we collect

Tool usage counts

When a tool produces a result you copy or download, we increment a single number: how many times that tool ran today. No cookie is set, no identifier is created, your IP address is not stored, and nothing is written to or read from your device. It is one integer per tool per day, and it is what decides which tools get built next.

Because it involves no storage on your device and no personal data, this one runs whether or not you accept cookies. We think that is the right trade and we would rather say so plainly than bury it: it means we can keep improving the site without needing to track anyone.

Site search

What you type into the site search is stored, and that is worth saying plainly rather than hiding it inside “tool usage counts.” Each query is recorded with the number of tools it matched, so a popular search that returns nothing becomes the roadmap for the next tool we build. The query text itself is the personal data being kept, so we cap what we hold: queries are retained for up to 90 days, after which they are dropped automatically, and nothing in this buffer is ever linked to an identifier, a cookie, or your IP address. If you want a search deleted sooner, email the address below.

Google Analytics

We use Google Analytics 4 to measure page views and tool usage. Google acts as our data processor and may process the data on servers outside your country. Google receives your IP address as part of the request; GA4 does not log or store it. We do not enable advertising features, audience export, or data sharing for benchmarking in our Analytics configuration.

We use Google Consent Mode, and it is the ADVERTISING signals it holds at denied until the certified message is answered. The analytics signal is not held behind a question of ours — see the section above, which explains why a switch that was not doing what it claimed was removed rather than kept.

Google AdSense

With the consent you give in Google’s message, Google and its partners serve ads on this site and use cookies to select them, cap how often you see the same one, and measure whether they worked. The AdSense library itself loads on every page, since it is what presents that message; until you answer it, Consent Mode holds the advertising storage signals at denied. Google’s use of advertising cookies is described in How Google uses information from sites that use its services . You can review and change Google’s own ad settings at My Ad Center .

Ads never see what you put into a tool. The tools do not send their input anywhere, so there is no mechanism by which the content of a document you opened could influence an ad.

There are no accounts

We removed sign-in, accounts and payments from this site on 3 September 2026. There is nothing to register for, no password, no profile, and no way to buy anything — so there is no account data to hold, and the sections that used to describe OAuth sign-in with Google or Facebook and the payment processor's handling of your card details no longer apply to anything.

If you signed in before that date, the sign-in is gone but the row we had may still exist in our database. Email [email protected] and we will delete it. We are not keeping it for any purpose.

Server logs

Our hosting and CDN provider records standard request logs, including IP address, user agent, and requested URL. These are used for security and abuse prevention and are retained for a limited period. This is necessary to operate the site safely and is not something consent is asked for.

AI features

Some generator tools offer an optional “Enhance with AI” action. That action is the one exception to everything above: if you choose to use it, the text in that specific input box is sent to our AI provider to produce a result. The free, default generator on the same page does not do this. If you do not press the AI button, nothing is sent.

We apply a per-visitor daily limit to this feature. To do that without storing your IP address, we keep a salted one-way hash of it that expires daily and cannot be reversed to recover the original address.

The browser extension

Prathom Workbench is a Chrome extension that recommends tools from this site and runs some of them without leaving the browser. It is a separate program from this website, so it is described separately here. What follows is what it tells you on its own first screen, before you can use it.

What it reads. What you type into its box. Text you select on a page and send to it yourself, using the right-click menu. The address and title of the tab you have open, to guess what you might need.

What leaves your device. Nothing, to make a recommendation. The catalog of tools is stored in the extension and searched on your device, so no keystroke is sent anywhere. When you open a tool you go to its page on Prathom like any other link, and the text you brought with you goes into that page.

There is no sign-in. The panel had an optional Google sign-in until 3 September 2026; it is gone, along with accounts everywhere else. The bigger conversions send you to the website, where they are free. Files sent to Prathom for conversion are deleted after the download window, exactly as they are on the site, and the tools marked "Runs here" never upload anything at all.

What is never sent. The address of a page you visit, its title, its content, or anything you have selected. On banking, health, government, webmail and password sites the extension does not look at the tab at all.

No setting changes those last two paragraphs, because a setting would mean the capability exists and is merely switched off. The extension can reach Prathom and no other site on the internet, which its listing page lets you check rather than take on trust.

Counting. If you agree on that first screen, the extension adds to the same per-tool daily counters described under “Tool usage counts” above: which tool was recommended, whether it was opened, and which ones ran in the panel. One integer per tool per day, no identifier, and nothing that links two of them together. It is what tells us when a recommendation is wrong. Declining is remembered, and the extension works identically either way.

The tools that run inside the extension’s own panel process what you give them on your device and upload nothing. A list of what you ran is kept in the browser’s memory so you can get back to it, is never written to disk, and disappears when you close the browser.

Requests from public authorities

Police forces, courts, tax authorities and regulators can compel a company to hand over data about the people who use it. Here is what we would do, what we would refuse to do, and how little there is to hand over in the first place.

We require formal legal process. We do not disclose personal data to a public authority on the strength of a phone call, an email from an official-looking address, or an invitation to “cooperate voluntarily”. A request has to arrive as a legal instrument — a court order, a warrant, a statutory notice — and we check that the authority has the power to make it, that it reaches us through a jurisdiction that applies to us, and that it is properly issued and in force. A request that fails any of those is refused in writing.

We narrow what is overbroad. Where a valid order asks for more than the matter needs — every user rather than a named one, a date range with no end, “all records” — we say so and disclose the minimum that actually answers it. We do not volunteer adjacent data because it happened to sit in the same table.

We tell you, unless we are forbidden to. If we are compelled to disclose data about you, we will tell you wherever we have a way to reach you, before disclosure where the timing allows. With no accounts there is usually no address to write to, and that is a limit worth stating rather than a promise worth making. The exception is a legal prohibition on telling you — a non-disclosure order attached to the request — in which case we delay notice until that prohibition lapses, and we ask for it to lapse.

One exception, stated plainly. Where there is a credible and immediate risk to someone’s life or of serious physical harm, we may disclose without waiting for an instrument. That exception is deliberately narrow, it is for emergencies rather than for urgency, and each use of it is logged and reviewed afterwards like any other request.

No authority has standing access. There is no government portal into this site, no bulk feed, no arrangement giving anyone direct access to our database, and no way to query it without us seeing the request. Every disclosure goes through a person applying the steps above.

What there is to give. The most useful thing in this section is how little we hold, because a request can only reach what exists. Your files are not on our servers by the time you could ask: the upload is deleted when the operation finishes and the result within 30 minutes, and the browser tools listed above never send anything at all. Search queries carry no account, cookie or IP address. This paragraph listed four more things until 7 September 2026 — what an account holds, what a session record holds, and what deleting an account removes — and by then none of them existed. Accounts and sign-in were removed on 3 September 2026, so there is no display name, no email address, no avatar and no session record to compel. Saying otherwise in a document about what can be taken from you is exactly the kind of inaccuracy this policy should not contain. What could still be compelled is the request logs our hosting and CDN provider keeps, described above, and we do not link them to a person.

Transparency. As of 17 August 2026 we have received no request for user data from any public authority, and have disclosed no user data to one. This paragraph is updated when that stops being true. Questions about this section: [email protected].

Your rights

If you are in the EEA or UK you have the right to access, correct, erase, restrict, and object to the processing of your personal data, to data portability, and to lodge a complaint with your supervisory authority.

In practice there is usually nothing to act on, because we do not hold your documents and there are no accounts — the site removed them on 3 September 2026, so there is nothing here with your name on it to export or erase. (This paragraph described a dashboard and a delete button until that date; both are gone with the accounts they belonged to.) Where we rely on consent, you can withdraw it at any time and doing so is as easy as giving it was — for advertising, through the certified message that asked. Analytics is not gated by a question of ours; your browser's own controls are what stop it. If you believe we hold information about you and want it removed, email [email protected] and we will act on it.

Children

This site is not directed at children under 13 and we do not knowingly collect information from them.

Changes

If this policy changes materially, the date at the top will be updated. If the change affects what you consented to, the question is asked again rather than your previous answer being carried over to something you did not agree to.

Contact

Questions about this policy: [email protected].