Privacy Policy

• Most of the 231 tools run entirely inside your browser. Your file or text never leaves your device, so there is nothing for us to store, see or lose.
• A minority need a server. Those upload your file, process it, and delete it about five minutes later.
• We do not sell personal data, and we do not run advertising.
• You do not need an account to use the tools.
• Server-side tools do write a usage row containing your IP address and browser user-agent. This is the least private thing on the site and section 6 says exactly what happens to it.

NKable operates nkable.com and the API at api.nkable.com, and is the data controller for the personal data described here. For any privacy question, correction or deletion request, email [email protected].

If you are in the UK, EU or EEA, the GDPR page sets out your specific rights and how to exercise them.

The large majority of NKable tools are JavaScript running on your own machine. Formatters, converters between text formats, calculators, colour and design utilities, encoders, generators and the image tools all work this way. When a tool runs in your browser:

• your input is never transmitted to us;
• we cannot read it, store it, or hand it to anyone else;
• closing the tab discards it.

This is a property of how those tools are built, not a promise about how we behave. You can verify it: open your browser's developer tools, switch to the Network tab, and run the tool. If nothing is uploaded, no request appears.

A few browser-side tools save your work in your own browser's local storage so it survives a reload. That data stays on your device and is never sent to us. Clearing your browser storage removes it.

Some tasks cannot be done in a browser. PDF manipulation, several document conversions, the SEO audit and the page speed test send data to api.nkable.com. The tool page says so before you use it.

Uploaded files. A file you upload is written to a working directory, processed, offered back to you, and then deleted by a background task roughly five minutes later. We do not read the contents, index them, or use them for anything but producing your output. If you are signed in and the tool saves your result to your file list, the file is kept until you delete it or your account is closed.

URLs you submit. The SEO audit and speed test fetch a public web page you name and store the resulting scores together with the URL. Do not submit a URL that is itself confidential, such as one containing a token in the query string.

This is the complete list of what reaches a database or a log, rather than a general description of the category.

We do not collect payment card details, precise location, contacts, or any special-category data. We do not build advertising or behavioural profiles, and we do not sell or rent personal data to anyone.

A message sent through the contact form is delivered to us by email. It is not written to a database. The reply-to address is set to the email you provide so we can answer you; your message then lives in our mailbox for as long as we keep correspondence, and you can ask us to delete it.

Your IP address is held in memory only for ten minutes, purely to enforce a limit of three messages per address in that window. It is not written to disk and disappears when the window passes or the server restarts.

The last two are deleted by a sweep that runs daily on our server, not on request — nothing has to be asked for. Reports belonging to a signed-in account are excluded from that sweep, because they are yours to keep until you delete them or close the account.

You can still ask us to remove data before the 90 days are up. Email [email protected] with the IP address you used and roughly when, since an anonymous usage row is not otherwise linked to a person.

Analytics is not running. The site contains Google Analytics 4 code, but it only loads when a measurement ID is configured, and none is configured. No analytics script is served and no analytics cookie is set. If that changes, this page and the cookie policy will be updated before it goes live, and EU and UK visitors will be asked for consent first.

• All traffic is served over HTTPS with HSTS.
• Passwords are stored as bcrypt hashes. We never see or store the password itself, and we cannot recover it for you.
• Uploaded files are validated by type and size before processing.
• The contact form is rate-limited and strips header-injection attempts.

No system is perfectly secure. The most effective privacy measure available to you is the design of the site itself: if you use a tool that runs in your browser, we never hold your data in the first place, so a breach of our systems cannot expose it.

NKable is a general-purpose utility site and is not directed at children under 13. We do not knowingly collect personal data from children under 13. If you believe a child has provided us with personal data, email [email protected] and we will delete it.

You can ask us for a copy of the personal data we hold about you, ask us to correct it, or ask us to delete it. Email [email protected] and we will respond within 30 days.

If you are in the UK, EU or EEA, the GDPR page covers your rights in detail, including the legal basis for each kind of processing and how to complain to a supervisory authority.

When this policy changes, the date at the top changes with it. If a change materially affects what we collect or how we use it — for example, switching analytics on — we will say so prominently rather than quietly amending the text.