🔍

Privacy Policy

Last updated: July 2026

Utilao is built and maintained by one independent developer — see Ivan Daniel. This page describes, as precisely as we can, what actually happens to your data. If any part of it stops matching reality, tell us.

Uploaded Files (Server-Side Tools)

PDF and image tools that require server processing (merge, compress, split, protect, resize, convert, background removal, etc.) upload your file to our own server over HTTPS. The file is processed automatically only to perform the operation you requested — there is no human review, no use of file contents to train any model, and no indexing or unrelated analysis of what's inside. The output is placed at a randomly generated, non-guessable URL for you to download.

Input and output files become eligible for automatic cleanup once they are older than one hour; a scheduled cleanup job runs roughly every 15 minutes and only deletes files that have actually passed that age, so real removal timing varies with cleanup activity rather than happening at an exact minute. Avoid uploading highly sensitive files, since they exist on our server, unencrypted at rest, for that window.

Browser-Side Tools

Unit converters, all calculators (finance, health, and everyday), the word counter, and the JSON formatter run entirely in your browser using JavaScript. No file, input, or result from these tools is ever sent to our servers.

One exception: the IP Address Lookup tool sends the IP address you enter (or your own, auto-detected, if you leave it blank) directly from your browser to ipapi.co, a third-party geolocation API — this is the only client-side tool on the site that contacts a third party, it only happens when you explicitly click "Look Up," and it's disclosed on that tool's own page before you use it.

Analytics (Application Database)

Utilao runs a self-hosted, first-party analytics system — no Google Analytics, Facebook Pixel, or third-party ad-tracking service. For each page view we record: the page path, the referring site (or "internal" if you came from another Utilao page), an approximate device/browser/OS, an approximate country (from Cloudflare's edge, not your IP directly), and a traffic classification (human/bot/monitor/etc.) used to keep dashboard numbers honest.

We also store two one-way hashed identifiers, both derived from your IP address and browser combined and neither reversible back to an IP:

  • Session ID — sha256(ip + user-agent + day). It changes every day and cannot be linked across days.
  • Visitor hash — sha256(ip + user-agent), with no day component, so it stays the same across days for the same IP+browser combination. Its only use is answering "have we seen this IP+browser before" for a new-vs-returning-visitor count. It is not a cookie, sets nothing in your browser, is never sent to any third party, and does not enable cross-site tracking. It is a coarse signal — it changes whenever your IP address changes (new WiFi, mobile network, VPN) or your browser/OS updates, so it under- and over-counts returning visitors in ways a real fingerprint or account ID would not.

Your raw IP address itself is never written to the analytics database — only these one-way hashes are. Analytics data is visible only to the site administrator.

Web Server Logs

Separately from the application database above, our web server (Nginx, behind Cloudflare) keeps standard access logs for the domain, which do include the source IP address for each request, along with the requested path, status code, referrer, and user agent. These logs exist for operational and security purposes — diagnosing abuse, investigating errors, and responding to incidents — and are not used for analytics, advertising, or profiling. They are rotated daily and kept for 14 days, then permanently deleted, per our server's logging policy. Cloudflare, as our proxy, also has its own short-term logs of the same traffic under its own privacy policy.

Cookies

Utilao sets exactly one cookie: a session cookie for the admin panel, created only when an administrator logs in. No tracking cookies, no advertising cookies, and no third-party cookies are set for regular visitors using the tools.

Third Parties

The application and file processing run on our own self-hosted server — not a third-party file-conversion API or cloud function. Cloudflare provides DNS, HTTPS proxying, and edge security in front of that server, so HTTPS traffic passes through Cloudflare's network; Cloudflare's own privacy practices apply to that layer. We do not use Google Analytics, Facebook Pixel, or any advertising/tracking network. The one exception is the IP Address Lookup tool, which sends the IP you're looking up directly from your browser to ipapi.co (see Browser-Side Tools above) — Utilao's own servers are never involved in that request. We may display third-party advertising in the future — if we do, this policy will be updated first, and any such change will be disclosed here before it goes live.

What We Don't Do

  • We don't sell or share file contents or analytics data with third parties
  • We don't use uploaded files to train machine learning models
  • We don't require an account, collect your name or email, or set advertising/tracking cookies
  • We don't use your IP address for advertising, profiling, or cross-site tracking — the only uses are the one-way analytics hashes above and standard server security logs

Corrections and Contact

Privacy questions, correction requests, or data-handling concerns: smartulethtb@gmail.com, or see Contact. If this policy is ever wrong about what the site actually does, we will fix the text — not just the disclosure — as soon as it's reported and verified.