Most operations on Modifyle happen entirely in your browser using client-side JavaScript and canvas APIs. When you merge PDFs, compress an image, or create a static QR code, those files never leave your device and never touch our servers.
1. The Short Version
Modifyle ("we," "us," "Modifyle") operates modifyle.com. This policy explains what data we collect, why, and how it is handled — written to reflect how the product actually operates, rather than generic boilerplate.
Most of what Modifyle does happens entirely on your machine. For the specific subset of features that do require a server (heavy server-side PDF processing, dynamic QR code redirects, and account subscriptions), this document details exactly what is collected and why.
2. Data We Collect
2.1 Client-Side Tools (Merge, Split, Image-to-PDF, Watermark, Lock/Unlock, Compress, Convert, Resize, Static QR)
We collect nothing about the files themselves. These tools run using client-side JavaScript and modern browser APIs directly on your device. Your files are never uploaded to Modifyle's servers, never stored, and never accessible to us.
2.2 Server-Side Heavy Processing (Ghostscript Compression, PDF-to-Word, Watermark Removal)
When you use credit-based heavy conversion features, your file is temporarily transmitted to our isolated worker service strictly to perform the requested operation:
- Files are written to ephemeral temporary disk space solely for the active duration of the conversion task.
- Temporary processing files and directories are deterministically deleted immediately upon response streaming completion or immediately if an error or cancellation occurs.
- We do not retain copies of your documents in persistent object storage or databases, and we never inspect, read, or use your document contents for any secondary purpose.
2.3 Account Data
If you create an account (for dynamic QR codes, vanity short links, credits, and subscriptions), we collect your email address and basic profile attributes provided by Google OAuth or Apple Sign-In. We use Supabase as our secure authentication and database provider.
2.4 Dynamic QR Codes & Telemetry
For each dynamic QR code or short link you create, we store: destination URL, styling preferences, and creation timestamp. When a visitor scans your QR code or clicks your link, our edge router logs aggregated analytics:
- Approximate country (derived via edge headers without storing raw visitor IP addresses).
- Device category (Mobile, Desktop, Tablet) and browser parsed via User-Agent headers.
- Referrer domain (where the click originated).
- For duplicate click detection and PWA install metrics, we use privacy-preserving daily-keyed HMAC hashes. We do not store raw visitor IP addresses in persistent telemetry logs.
2.5 Payment Data
Payments are processed by Dodo Payments, our global merchant of record. We never receive or store complete credit card or debit card numbers. We only retain subscription status, credit balances, masked IP addresses for fraud prevention, and transaction timestamps for your billing dashboard and statutory accounting.
2.6 Transactional Emails
We use Resend to deliver necessary account notifications (welcome messages, receipt confirmations, quota notices, and feature waitlist alerts). We do not send marketing newsletters without explicit opt-in.
2.7 Cookies & Session Management
We use strictly essential cookies and local storage tokens to maintain secure authentication sessions via Supabase SSR and privacy-preserving returning session metrics. We do not place third-party cross-site advertising or tracking cookies on your device.
2.8 Privacy-First Web Analytics (PostHog)
To measure platform health, identify popular file tools, and understand search discoveries without compromising user confidentiality, we use PostHog configured with strict privacy guardrails:
- Zero File Telemetry: File names, image pixels, PDF contents, and converted outputs are processed strictly in your browser and are never transmitted to analytics.
- Anonymous Visitors: We do not identify anonymous visitors with personal names or email addresses.
- No Session Replay / Keystrokes: Session recording and keystroke tracking are permanently disabled.
- Do Not Track (DNT): We automatically honor browser "Do Not Track" signals.
3. Browser Extension — Modifyle Image Tools
Modifyle Image Tools is a browser extension for Google Chrome (in review), Microsoft Edge, and Mozilla Firefox that provides browser-based tools for compressing, resizing, converting, and optimizing images.
3.1 Local Image Processing
Modifyle Image Tools performs its image-processing operations locally in the user's browser. Images selected for processing are handled on the user's device using browser-based image-processing APIs. Images are not uploaded to Modifyle servers for the extension's image-processing operations, and the extension does not use a remote image-processing service.
3.2 Information We Do Not Collect Through the Extension
The current version of Modifyle Image Tools does not intentionally collect or transmit personally identifiable information, location information, browsing history, authentication credentials, financial or payment information, health information, personal communications, behavioral analytics, or image content to Modifyle servers.
The extension does not implement analytics or telemetry, including user or session tracking, country/source tracking, behavioral event tracking, or third-party analytics services.
3.3 Image Access and Browser Permissions
When a user explicitly invokes an image tool from the browser context menu, the extension may access the selected image from the active webpage so that the requested operation can be performed locally. This access is part of the requested functionality and is not used to monitor the user's browsing activity.
If a webpage prevents direct access to an image because of browser security or cross-origin restrictions, the extension may provide a user-initiated drag-and-drop or paste workflow. Images processed through these workflows remain processed locally in the browser.
The extension may use browser permissions such as context-menu access (contextMenus), active-tab access (activeTab), and local extension storage (storage) where required by its functionality. These permissions are used only to provide the extension's user-requested image tools and related local preferences.
3.4 Analytics and Tracking
Modifyle Image Tools does not currently implement application-level analytics, telemetry, behavioral tracking, advertising tracking, or user-identification systems.
The extension does not send installation events, image-processing events, user identifiers, country information, or browsing activity to Modifyle servers.
3.5 Browser Store Distribution
Modifyle Image Tools may be distributed through the Chrome Web Store, Microsoft Edge Add-ons, and Mozilla Firefox Add-ons. Each browser store may provide its own developer-facing installation, usage, or store statistics. Those statistics are provided by the respective browser-store platforms and are separate from analytics implemented by Modifyle.
3.6 Changes to This Extension Privacy Information
If the functionality, permissions, data practices, or tracking behavior of Modifyle Image Tools changes in the future, this privacy policy will be updated to accurately describe those changes.
4. What We Never Collect
- The content of any file processed client-side (impossible for us to see — it never leaves your machine).
- Credit card numbers, bank routing numbers, or CVV security codes.
- Government identification numbers, biometric markers, or location data beyond country level.
- Persistent raw IP addresses of QR scanners or PWA visitors.
5. How We Use Your Data
- To provide the core services requested (file conversion, link routing, analytics dashboard).
- To authenticate your sessions and manage credit balances.
- To prevent fraud, malicious link phishing, and platform abuse.
- We never sell, rent, or monetize your personal data.
6. Third-Party Service Providers
Modifyle relies on carefully evaluated infrastructure partners to deliver high reliability, edge performance, and processing:
| Provider | Function | Category of Data |
|---|---|---|
| Supabase | Authentication, PostgreSQL database, and Row Level Security | Account email, metadata, QR definitions |
| Vercel | Frontend application hosting and edge serverless runtime | HTTP request routing, edge performance |
| Render | Isolated compute worker for server-side conversions | Ephemeral file streams (deleted after response) |
| Cloudflare | Edge DNS, DDoS mitigation, and SSL security | Edge traffic routing, Country header |
| Dodo Payments | Merchant of Record, payment gateway, and billing management | Payment card checkout, transaction IDs |
| Resend | Transactional service notifications and receipts | Recipient email, notification content |
| Google & Apple | Federated OAuth single sign-on | OAuth tokens, verified email address |
7. Your Rights & Self-Service Data Deletion
Depending on your jurisdiction (such as GDPR in the EU/UK, CCPA/CPRA in California, or DPDP in India), you have rights regarding your personal data, including the right to inspect, export, or permanently delete your account records.
Self-Service Erasure: You can initiate complete self-service account deletion at any time directly from your Billing & Account Settings page. Initiating deletion immediately revokes your authentication sessions, deletes your QR codes and analytics, anonymizes support records, and anonymizes payment records to fulfill statutory tax and accounting retention requirements.
You may also request account erasure or data inquiries by contacting privacy@modifyle.com.
8. Children's Privacy
Modifyle is intended for general audiences and professionals. We do not knowingly collect personal data from children under the age of 13. If you believe a minor has created an account, please contact us immediately for prompt deletion.
9. Contact Us
For any inquiries regarding this Privacy Policy or your personal information, please reach out to:
privacy@modifyle.com