Privacy & Data Processing
Updated October 26, 2026. This policy covers the current local tools at tools.sysec.cc.
Content processed locally
Files, text, cryptographic keys, plaintext, ciphertext and recognized results are processed in your browser. Tool code does not upload this content, filenames or hashes, or put them in URLs or usage events. Exporting, copying and pasting screenshots are your explicit actions. Keys are not persisted by default. This site is not a certified cryptographic product or production key-management system.
Resource requests and hosting
Pages, algorithms, WASM, PDF fonts and OCR models load from this site when needed. Resource loading is not file uploading. Hosting uses Cloudflare Pages/CDN, whose delivery and security services receive IP addresses, request URLs, times and browser information. The application does not write those details into usage tables, but this does not mean the hosting provider has no access/security logs. Provider policies and configuration govern those records, and requests may be processed across regions.
Optional task completion counts
First-party task counts are enabled by default. Disable them in the footer; browser DNT/GPC signals are respected. Each successful task sends only three predefined fields to /api/usage: tool, action and mode. No input, result, key, filename or visitor ID is included. These are task counts, not visitors. Failed and cancelled tasks do not count. Opting out does not stop the network metadata needed to deliver pages.
Retention and rate limiting
D1 stores only counts grouped by UTC day, tool, action and mode, retaining up to 365 days. Cleanup runs when valid completion events arrive and can be delayed when no new events occur. Rate limiting temporarily uses source IPs in server memory; the Cloudflare collector resets address buckets when its minute window changes and does not store them in D1. There are no analytics cookies or cross-page visitor profiles. Provider logs and backups have separate retention policies.
Browser storage and clearing
Theme and usage preferences use localStorage. OCR models may be cached in IndexedDB, and the browser may cache static site resources. Tools do not persist file contents, keys or recognized results in these stores. Clear site data to remove preferences and cached models. Clearing a tool or refreshing releases its application-held inputs/results; manage exported files and clipboard content yourself. Browser and operating-system memory reclamation is not secure erasure.
Transfers between tools and tabs
Further processing uses in-page memory events or same-origin postMessage to transfer File objects without a server. File content is not put into links. New-tab URLs can temporarily contain a random one-use handoff identifier, removed on receipt. Transfers verify origin and source window, and detach the opener afterward. Source tabs may retain results while the new tab holds its own file references. Refreshing a tab does not restore its files.
Third-party scripts and advertising
The repository currently integrates no AdSense, payments or third-party analytics scripts; sensitive tools use strict CSP. Hosting-platform script injection is separate from task counts and should be checked and unnecessary injection disabled at release. Before adding advertising, this policy will be updated, affected pages identified and appropriate consent management configured. There are currently no advertising requests or advertising consent dialogs in site code.
Feedback and contact
The service name is SYSEC WebTools. Contact us through the main-site feedback link below with the tool name and issue. Do not send private keys, passwords, original files or sensitive content. The feedback link leaves this tool site; the main site has separate data practices. The date on this page changes when the policy is substantively updated.