Privacy Policy

HandoutPress ("we", "our", or "us") operates handoutpress.com (the "Service"), a suite of free browser-based tools for creating handouts and converting documents. This Privacy Policy explains what information is — and is not — collected when you use the Service, and it applies to all visitors and users worldwide.

All document and image processing is performed locally in your web browser using standard web technologies (File API, JavaScript, WebAssembly). Your files are never uploaded to our servers, never transmitted over the network, and never seen by us. When you close the browser tab, all processed data exists only on your own device.

We do not require registration, and we do not collect: the content of the files you process; names, email addresses or other contact details (unless you contact us voluntarily); account credentials; analytics or advertising identifiers; or any behavioral profile of your activity.

Like virtually all websites, our hosting infrastructure (operated by Cloudflare, Inc.) automatically records limited technical request data, such as your IP address, request time, requested URL, browser type, and referring page. This data is used exclusively to ensure the security, stability and availability of the Service (for example, protection against abuse and attacks). The legal basis is our legitimate interest in operating a secure service (Art. 6(1)(f) GDPR).

We store a single entry in your browser's local storage (localStorage) to remember your language preference. This is strictly functional: it is not a tracking cookie, it is never shared, and it contains no personal identifiers. We do not set any advertising, analytics or cross-site tracking cookies. You can clear this entry at any time through your browser settings.

The Service is hosted by Cloudflare, Inc., which acts as a data processor only for the limited log data described in Section 4. We do not use analytics platforms, advertising networks, social media pixels, or any other third-party trackers. We do not sell, rent, or share personal information with anyone ("we do not sell or share" within the meaning of the CCPA/CPRA).

For visitors from the European Economic Area and the United Kingdom: request-log data is processed on the basis of our legitimate interest in security and service availability (Art. 6(1)(f) GDPR); the language preference is stored on the basis of your consent, given by your active selection (Art. 6(1)(a) GDPR, read together with § 25 of the German TTDSG / the UK PECR).

EEA/UK (GDPR): you have the right to access, rectify, erase, restrict the processing of and port your personal data, the right to object to processing, and the right to lodge a complaint with your national supervisory authority.

US (CCPA/CPRA): California residents have the right to know, delete, and correct personal information, and to opt out of its sale or sharing — please note that we do not sell or share personal information as defined by these laws. Other jurisdictions (e.g., LGPD in Brazil, PIPEDA in Canada, APPI in Japan) provide similar rights. Because we collect almost no personal data, in most cases there will be no data subject to such requests.

The Service is not directed to children under the age of 13 (or the equivalent minimum age in your jurisdiction, such as 16 in the EEA). We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us and we will delete it.

Files: never stored, because they are never received. Language preference: kept in your browser until you clear it. Server logs: retained for the limited period defined by our hosting provider's security policies. Email inquiries (if you contact us): kept only as long as necessary to handle your request.

Our hosting provider may process log data in data centers located in various countries. Where personal data is transferred outside the EEA/UK, the provider relies on recognized safeguards such as adequacy decisions and Standard Contractual Clauses. Your document content is unaffected: it never enters this scope, because it is never transmitted.

All connections are encrypted with TLS. The Service applies a strict Content-Security-Policy and modern security headers. Because file processing happens locally, the single greatest privacy risk of online tools — a server-side breach exposing your documents — is eliminated by design.

We may update this Privacy Policy from time to time to reflect legal or technical changes. The "last updated" date at the top of this page indicates the current version. Material changes will be highlighted on this page.

If you have questions about this Privacy Policy or wish to exercise your rights, please contact us. Residents of the EEA/UK also have the right to contact their local data protection supervisory authority.