Privacy Policy

Who is responsible

ProntoUso is an independent project run by a single operator. For any question about this policy or about your data, write to igor.souza.92@gmail.com.

What we do not collect

Beyond the brief in-memory processing described in the next section, we do not ask for, receive, or store:

• visitor account details, because there are no public visitor accounts — the exception is whatever you choose to send through the tool-suggestion or contact form, described in “Messages sent through a form” below;
• the text you type into a tool;
• the files you open in a tool;
• the passwords or identifiers a generator produces on your screen;
• payment information, since the tools are free and nothing is sold here.

How the tools handle your content

Most tools run entirely in your browser using JavaScript on your device. There is no upload step for them, and this site does not receive what you type, paste, generate, copy, or download from those tools.

The same applies to files in client-side tools. When you drop a file into Character Counter, JSON/YAML/XML Formatter, Base64 Encoder, QR Code Reader, Markdown Previewer, or any other client-side tool, your browser reads it locally with the File API and hands it straight to the tool. The file never travels over the network. Closing or reloading the page discards it from memory.

Image Compressor, Image Resizer, PDF Merge, Split & Image to PDF, Image Format Converter, OCR — Image to Text, Video Compressor, HEIC to JPG Converter, MP4 to MP3 Converter, Animated GIF Compressor, Background Remover, Image Upscaler & Enhancer, PDF Compressor, and Word to PDF Converter are exceptions: image, PDF, OCR, and video encoding work needs libraries that a browser cannot run reliably on its own. For these thirteen tools, your file is sent to a ProntoUso server only for that request and the result is sent back. Video Compressor may use an isolated temporary workspace during encoding; it is deleted automatically when the request ends. Files are never logged or stored afterward.

Password Breach Checker, Security Headers Scanner, Sitemap XML Validator's optional "Fetch from URL", YouTube Thumbnail Downloader, DNS Propagation Checker, SSL/TLS Certificate Checker, and YouTube Tags Extractor are exceptions for a different reason: not because they process an uploaded file, but because each needs a network capability a browser does not have. Password Breach Checker hashes a password in your browser and sends only a 5-character fragment of that hash to our server, which forwards just that fragment to Have I Been Pwned's Pwned Passwords API; the full password is never transmitted. Security Headers Scanner and the optional sitemap fetch send the URL you enter so the server can retrieve public headers or sitemap content, while refusing private and internal network addresses. The two YouTube tools send the YouTube URL or video ID so the server can retrieve public video metadata and the selected public thumbnail; previews are returned through this site's own image route instead of connecting the browser directly to YouTube's image host. DNS Propagation Checker sends a public domain and record type so the server can query Google Public DNS and Cloudflare's public DNS-over-HTTPS endpoints. These values and lookup responses are kept only for the current request and are not stored.

If another tool needs a server in the future, this page will be updated first, naming exactly what is transmitted and why, following the same principle: only what a tool genuinely needs is sent, and nothing is stored after the response is returned.

The site assistant

The optional chat assistant (the message bubble in the corner of the screen, off in some deployments) is a different kind of exception: it isn't tied to one specific tool. What you type is sent to a small language model that runs on ProntoUso's own server — never to a third-party AI provider — is used only to generate that one reply, and is discarded immediately afterward. It is not logged. No conversation is kept once you leave or reload the page; while the panel stays open, the last few messages of that conversation exist only in your browser's memory, not on our server.

Analytics

We use Google Analytics 4 to understand how many people visit, which tools they open, and small product events such as tool views, first use, successful processing, errors by type, copy/download actions, internal search usage, and related-tool clicks. Google acts as our analytics provider and processes this data on our behalf.

The Google Analytics script is not downloaded and no data is sent to Google until you accept the cookie banner described below. If you accept, the script loads and analytics cookies may be set; if you decline, Analytics stays off. You can change your choice in cookie preferences at any time.

Once accepted, analytics receives technical data about the visit, namely:

• the pages you open on this site and the order you open them in;
• approximate location, derived from your IP address (typically city or region level);
• device type, operating system, browser, screen size, and language;
• how you arrived, such as a search engine, a link, or a direct visit.

Google states that Analytics 4 uses the IP address to derive that approximate location and does not log or store IP addresses in Analytics. Google may process this data on servers outside your country. See Google's Privacy Policy for how Google handles it.

Analytics never receives the content of a tool: no text you type, file contents, file names, pasted URLs, JWTs, hashes, passwords, generated secrets, or copied text.

Product usage counters

Separately from Google Analytics above, ProntoUso keeps a small counter of its own: how many times each tool was started, completed successfully, or had its result copied or downloaded, added up per tool per day. This exists to answer one question — which tools people actually use — so the "Popular" section of this site can reflect real usage instead of only a fixed, manually curated list. "Featured" tools remain a manual editorial choice either way.

This is not Google Analytics, and it is not gated on the cookie banner, because it does not need to be: it sets no cookie, uses no local storage, and keeps no identifier for your browser or device. What is stored is a running total, such as "142 starts for JSON Formatter on 2026-08-01" — a number attached to a tool and a date, never to a visitor. It carries no information about who used a tool, from where, or what they typed into it, and, like every other part of this site, it never receives the content you type, upload, generate, or copy in a tool.

The one place an IP address is technically involved is rate-limiting: this counter's endpoint checks the request's IP address in server memory for a short window, purely to stop it from being abused with a flood of fake requests. That check never writes the IP address to this counter, to a log tied to this data, or anywhere persistent.

Restricted administrator security records

ProntoUso has restricted operator sign-ins used only to manage tools and internal settings. It is not a public account system and has no registration, password recovery, or visitor profile. Administrator passwords are stored only as salted Argon2id hashes; plain passwords are never stored. Session and CSRF tokens are stored only as cryptographic digests.

To slow brute-force attacks and investigate administrative access, the server stores time-limited security events. IP addresses and browser identifiers are transformed with a keyed one-way pseudonym before storage, rather than stored in raw form. An operator may also configure an explicit IP/CIDR allowlist; those network ranges are then stored to enforce access. Security events are retained for no more than 90 days and capped at 10,000 records. Tool availability is stored by tool identifier and does not contain visitor data.

Messages sent through a form

The tool-suggestion form and the contact form store what you write — a tool name or your name, a category or reason, the message, and your e-mail address — in the same restricted database mentioned above, so an administrator can read and, where relevant, reply.

These messages are kept until an administrator deletes them by hand from the internal panel, or until an automatic cap of 2,000 messages per form is reached, at which point the oldest are discarded. They are never used for marketing, shared with third parties, or visible to other visitors.

Cookies and your consent

Ordinary visitors do not need a login. ProntoUso sets the two strictly necessary, first-party administrator cookies below only after the restricted operator successfully signs in; both are HttpOnly, Secure, SameSite=Strict session cookies and are not used for analytics or advertising. Your analytics choice stays in your browser's local storage. Google Analytics cookies are set only after you accept analytics:

How the consent choice works

The first time you visit, a banner asks you to Accept or Reject analytics cookies before anything loads. There is no button that quietly counts as acceptance: closing the tab without choosing leaves analytics off, and it stays off until you actively accept. Choosing Reject is just as effective as never being asked — no analytics cookie is set, and if one was set from an earlier visit where you had accepted, it is deleted immediately.

You can change your mind at any time from the Cookie preferences link in the footer of every page, which reopens the same choice.

Other ways to block analytics

Rejecting in the banner above is the direct way to keep analytics off, and every tool keeps working normally either way. If you prefer a browser-level guarantee on top of that, or if third-party cookies are blocked before you even see the banner:

• turn on tracking protection in your browser, or use a content blocker;
• install the Google Analytics opt-out add-on;
• clear the cookies for this site in your browser settings.

Advertising

This site currently serves no advertising: no advertising network is loaded, no advertising script runs, and no advertising cookie is set. If advertising is introduced later, we will update this policy first and describe which network is used and what it collects.

Hosting and server logs

Delivering a web page requires a server, and hosting providers keep short-lived technical logs that can include IP addresses, timestamps, and the page requested. These logs exist for security and reliability, are controlled by the hosting provider, and are not combined with anything else or used to build a profile of you.

Your rights

Under Brazil's LGPD and the European GDPR you have the right to access, correct, and delete your personal data, to object to processing, and to withdraw consent. There is no public visitor profile or stored tool input. The restricted administrator security records are pseudonymous and used only for security; contact us if you believe one may concern you.

For the analytics data held by Google, the fastest routes are the opt-out options above, which stop collection at the source, and Google's own privacy controls. If you would like help with a request, write to igor.souza.92@gmail.com and we will respond.

Children

The tools are general-purpose utilities and are not directed at children. We do not knowingly collect personal data from anyone, including children.

Changes to this policy

If how the site handles data changes — a new analytics tool, advertising, or a tool that needs a server — this page is updated before the change goes live, and the date at the top changes with it.

Contact

Questions about privacy go to igor.souza.92@gmail.com.