Privacy

Sheafkit is a file converter. It is not a place to store files.

Free tools

You can use the tools without an account. If you do not sign in, the daily counter is tied to a hash of your IP address, not the address itself. The hash uses the server secret, so the raw address is not written to the database.

Files

Uploads are held in memory or a temporary directory for the length of the conversion, then deleted. Image compression, resizing, WebP conversion, and QR codes can run in your browser when JavaScript is on. HEIC and PDF tools run on the server because browsers and pure page scripts cannot reliably do that work.

A Wi-Fi QR code is drawn in the browser by default, so the password is not uploaded. If JavaScript is off and you submit the form, the password is used once to draw the PNG and is not stored.

Accounts

An account stores an email address and a password hash. The password is not kept in a form we can read back. Sessions are a signed cookie. The plan on the page is read from the database, not from the cookie.

Payments

Card details go to PayPal, not to Sheafkit. We store the PayPal payer id, subscription id, status, and payment amounts that PayPal reports through the webhook.

The Free plan may show Google AdSense units. Pro and Business responses omit the ad markup entirely. If you have not set an AdSense client id, the slot is an empty labeled placeholder. AdSense, when configured, can set its own cookies. That is the main third party on the free pages.

Fonts