Security headers
Every page is served with Strict-Transport-Security (HTTPS enforced for one year), X-Content-Type-Options: nosniff, X-Frame-Options: SAMEORIGIN, Referrer-Policy: strict-origin-when-cross-origin, Permissions-Policy (geolocation and payment disabled) and a Content-Security-Policy.
Content Security Policy (CSP)
The connect-src directive restricts where the site may send requests: itself and a few named services (compromised-password check, Cloudflare audience measurement, Google advertising). A file you process therefore cannot technically be sent elsewhere. Embedded objects and base tags are forbidden. If you import a file from Google Drive, Dropbox, OneDrive or Box, those services' domains are also allowed, only to download into your browser the file you chose.
Local processing
Files are read and transformed by your browser. You can verify it: go offline after the page has loaded and most tools keep working.
What we collect
No file content, no account, no advertising identifier without your consent. To suggest your language and, on the day, a national holiday, the site reads your approximate country from Cloudflare; it is neither stored nor transmitted.
Third-party services and their limits
Password check: only the first 5 characters of its SHA-1 hash are sent (Have I Been Pwned k-anonymity method), never the password. Audience measurement and advertising: loaded only after your consent.
GDPR and COPPA
We apply the principles of the GDPR (minimisation, consent, rights of access and erasure) and of COPPA (no personal data requested from children). These are principles we follow, not labels or certifications we hold.
No antivirus, and why
The site receives no file: there is nothing for us to scan, so we claim no antivirus protection. For files you download, keep your own antivirus up to date.
Report a vulnerability
Write to contact@maxytools.com describing the issue; we reply and fix it as quickly as possible.