Privacy policy

You can use most of the suite without an account. If you make one, we hold:

• Your email address, which is how you sign in and how we send verification and password mail.
• A hash of your password. Django hashes it before it is stored; we never see the password itself.
• Your name and profile picture, only if you signed in with Google and Google supplied them.
• Your preferences, your plan, and the counters that say how much of today's allowance you have used.

Signing in with Google tells Google that you signed in here. It does not give us access to your Gmail, Drive or contacts, and we do not ask for it.

Most tools here never send your file anywhere. Merging, splitting, compressing, converting, resizing, editing a PDF, OCR and the Markdown tools all run inside your browser tab, on your own machine. Nothing to upload means nothing to leak, and it is why those tools are free and unmetered.

Two tools do send a file to a server, and this is what happens to it:

Background removal

• Your image is sent to our server, then on to the model that removes the background.
• Both the original and the cutout are written to disk behind a link containing a random token, served with Cache-Control: private. That token is the whole of the access control on an anonymous visitor's image, which is why it is random and short-lived.
• A job running every five minutes deletes both once they are ten minutes old.

Chat with a PDF

• This is the one tool that keeps your file on purpose: a conversation you cannot come back to is not a conversation. The document, the text extracted from it and your messages are stored.
• Signed out, a document is deleted after one day. On a free account, after seven days. On a paid plan it stays until you delete it.
• The pages relevant to your question are sent to our AI provider to be answered, under terms that forbid using them for training.

When you run a tool that touches our servers, we record with it:

• Your IP address, and an approximate city and country resolved from it. This is city-level at best and is not your location.
• Browser, operating system and device type, read from the user-agent string your browser sends to every site.
• The page you came from, and any gclid or utm_* parameters in the link you arrived on, so we can tell which ads paid for themselves.
• Counts and timings: how many files, how large, which format, how long the job took, whether it succeeded.

We use this to enforce allowances, to spot abuse, and to know which tools are worth working on. For a signed-out visitor the IP address is also what the daily allowance is counted against — a signed-in visitor is counted by account instead, which is the only way an allowance survives clearing cookies.

Paddle.com Market Ltd is the merchant of record for every subscription sold here and processes all payments. Card details are entered on Paddle's own checkout and never reach our servers — we store no part of your card number, not even the last four digits.

What we keep is what a receipt needs: the amount, the currency, the date, Paddle's invoice number, and which plan you are on. Paddle's own handling of your data is covered by Paddle's privacy policy.

Each of these windows is enforced by a scheduled job, not by intention:

We do not sell, rent or trade personal data, and there is no advertising audience built out of anything you upload. These are the services that see part of it because the product cannot run without them:

• A cloud hosting provider, which is where the servers, the database and stored files sit.
• The AI providers behind the two server tools — one removes the background from an image, one answers questions about a PDF. Each receives only what that job needs, and neither trains on it.
• Google, for sign-in if you choose it, for analytics, and for the ads shown on the free tiers.
• Paddle, our merchant of record, which handles payment in full.
• An email provider, for verification and password mail.
• A geolocation service that turns an IP address into an approximate city.

Each is bound by its own contract to use the data only to provide that service. We will also hand over data where the law requires it, and would tell you unless we were forbidden to. If the site were ever sold, accounts would move with it and you would be told before that happened.

We set three cookies of our own — a session, a CSRF token, and a language preference — and Google sets its own for Analytics and for the ads shown on the free tiers. There is no advertising profile built from your files or from what you make with them.

Signing in and turning off analytics tracking in your settings stops the analytics script loading at all; taking a paid plan removes every ad on the site. The cookie policy names each cookie, says what it does, and is honest about the consent step this site does not yet have.

The site is run from Pakistan, hosted on Amazon Web Services, and the services listed above are run by companies in the United States, the United Kingdom and the European Union. Using these tools means your data crosses borders — including out of the EEA and the UK. Where that needs a legal basis, it rests on the standard contractual clauses those providers publish, and on the fact that performing the service you asked for is not possible without it.

Wherever you live, you can ask us for a copy of what we hold about you, ask us to correct it, ask us to delete it, ask us to stop using it, or object to us using it at all. If you are in the EU or the UK these are rights under the GDPR; we apply them to everyone rather than keeping two standards.

Email privacy@qikkstools.com from the address on the account. We answer within 30 days. Deleting an account deletes the account row, its preferences, its usage counters and its chat documents; billing records we have to keep for tax purposes stay, and are not used for anything else.

These tools are not built for children and accounts are not for anyone under 16. If you believe a child has made an account here, write to us and we will remove it.

When the code changes, this page changes with it, and the date at the top is the date it last did. A change that gives us more of your data or keeps it for longer will be announced by email to account holders before it takes effect, not backdated into a paragraph.