Skip to main content
MegaToolskit
All Tools
Back to Home
Data Protection & Privacy

Privacy Policy

How Mega Toolskit processes your data, respects your privacy, and handles advertising.

Last revised: September 2026

1. Introduction

Welcome to Mega Toolskit (“we”, “our”, or “us”), accessible at megatoolskit.com. We are committed to protecting the privacy of our visitors. This Privacy Policy explains what information is collected when you use our website, how we handle files you process with our utilities, how advertising partners interact with your browser, and what rights you have regarding your personal data.

2. Information We Collect

Mega Toolskit does not require user accounts, registration, or payment credentials to use our tools. We collect only the minimal technical information necessary to operate and improve our online utilities:

  • Standard Web Request & Infrastructure Logs: Like standard web platforms, our hosting infrastructure logs HTTP request metadata, browser user-agent strings, approximate geographical region, referring URLs, and timestamps for operational stability and security. These logs do not contain the contents of your uploaded files or passwords.
  • Anonymous Tool Usage Analytics (Google Analytics 4): We use Google Analytics 4 (G-2QZ5KF8KYM) and Google Tag Manager (GTM-WLB6PMPB) to measure aggregate tool usage. When you use a tool, our analytics module records strictly anonymous event parameters: tool_slug, tool_category, file_count, file_format, total_size_bytes, output_format, and duration_ms. We never send file names, file contents, passwords, decryption keys, or personal calculator numbers to Google Analytics.
  • Client-Side Local Storage & Preferences: We store functional preferences (such as Light/Dark theme, language/currency selection, local calculator history, and optional local tool ratings) in your browser's HTML5 localStorage. You can inspect or clear this data at any time on our Privacy Settings page.
  • Tool Ratings & Comments (Local Browser Storage Only): Individual tool pages include an optional 5-star rating and feedback form requesting your Name, Email, Rating, and Comment. By architectural design, Mega Toolskit does not transmit or store tool ratings or comments in any external server or database. Your sanitized Name, Star Rating (1–5), and plain-text Comment are saved exclusively inside your own browser's localStorage on your device so you can view your local feedback history. Your Email address is validated on the client side solely for anti-spam verification at the moment of submission and is immediately discarded—it is never written to localStorage, memory, or any server, and is never displayed publicly.
  • Direct Communications: If you contact us via email ([email protected]), we receive your email address and message contents solely to respond to your inquiry.

3. How Uploaded Files Are Processed & File-Processing Privacy

We recognize that PDF documents, images, and calculations may contain confidential information. Below is the exact technical architecture governing every file-processing tool on Mega Toolskit:

A. 100% Client-Side (In-Browser) Processing Tools

The following tools execute 100% locally inside your web browser using client-side JavaScript, WebAssembly, PDF.js, pdf-lib, and HTML5 Canvas: Merge PDF, Split PDF, Compress PDF, Rotate PDF, Image to PDF, PDF to Image, PDF to Word, PDF to Excel, Protect PDF, Watermark PDF, and all Calculators & Network Utilities. In these tools, your files are read into local browser memory (ArrayBuffer / Blob), are never uploaded to our backend servers, and are released from browser memory when you reset the tool or close the tab.

B. Ephemeral Server-Side Processing for Unlock PDF (/api/pdf/unlock)

Our Unlock PDF tool performs an initial structural header check in your browser and then transmits the encrypted PDF (and your supplied password) over encrypted HTTPS to our backend API route (/api/pdf/unlock) powered by the native qpdf cryptographic engine:

  • Where temporary processing occurs: During the active HTTP request, the backend writes isolated temporary files with random UUID names (/tmp/qpdf_in_<uuid>.pdf, /tmp/qpdf_out_<uuid>.pdf, and /tmp/qpdf_pw_<uuid>.txt with strict 0600 owner-only permissions) in the server's ephemeral /tmp directory so the qpdf binary can inspect or decrypt the file.
  • When and how files are deleted: Immediately inside a finally block—before the HTTP response is even completed, and regardless of whether decryption succeeds or fails—the temporary password file is overwritten with zero bytes (Buffer.alloc(size, 0)) and all temporary files (tempPass, tempIn, tempOut) are synchronously deleted via fs.unlinkSync().
  • Zero retention & no-cache headers: The decrypted output is streamed directly back to your browser with Cache-Control: no-store, no-cache, must-revalidate headers. Neither your PDF, your password, nor your file metadata is ever saved to a persistent disk, database, or server log.

C. Ephemeral URL Fetching for Webpage to PDF (/api/pdf/website-to-pdf)

When you use our Webpage to PDF utility, your browser submits the target public website URL to our server-side API route (/api/pdf/website-to-pdf) because web browsers cannot fetch cross-origin HTML directly due to CORS restrictions:

  • Security & SSRF protections: Our server-side fetcher strictly blocks private network IP ranges (such as 127.0.0.1, localhost, RFC 1918 subnets, and cloud metadata endpoints) to prevent Server-Side Request Forgery.
  • In-memory ephemeral rendering: The remote page markup is rendered into PDF format entirely in volatile server memory, streamed directly back to your browser with Cache-Control: no-store headers, and immediately discarded.
  • No history retention: We do not log, retain, or store your target URLs, rendered HTML, or generated PDF documents on persistent disks or databases.

We never train AI or machine learning models on your files, and we never share, sell, or disclose uploaded documents to any third party.

4. Cookies, Google AdSense & Advertising Technologies

Mega Toolskit is funded through third-party digital advertisements, allowing us to keep all tools 100% free for everyone.

  • Google AdSense: We may display advertisements served by Google AdSense and its certified advertising partners. Google uses cookies (including the DoubleClick cookie) to serve ads based on your prior visits to our website or other websites across the Internet.
  • Personalized & Non-Personalized Ads: Depending on your location and cookie consent choices, ads may be personalized based on your interests, or non-personalized based on page context.
  • Opting Out of Personalized Advertising: You can opt out of personalized advertising by visiting Google's Ads Settings or by visiting aboutads.info.

For comprehensive details on the specific cookie categories used across the website, please consult our dedicated Cookie Policy.

5. Third-Party Services

We only engage reputable third-party infrastructure providers necessary to operate the service:

  • Hosting & Cloud Infrastructure: Google Cloud Platform / Cloud Run for secure, scalable serverless container execution and CDN delivery.
  • Advertising Networks: Google AdSense for serving display advertisements.

We do not sell, rent, or trade your personal data to any external parties.

6. Data Security

We implement industry-standard technical measures to safeguard the integrity of our platform:

  • Strict TLS 1.3 encryption across all website routes (`https://`).
  • Modern Content Security Policy headers preventing unauthorized script execution.
  • Browser sandbox isolation preventing cross-origin data leakage.

7. Children's Privacy

Mega Toolskit does not knowingly collect any personal identifiable information from children under the age of 13. Our tools are general-utility web applications intended for general audiences. If you believe that a child has provided personally identifiable information to us, please contact us immediately so that we can promptly remove such information.

8. User Rights (GDPR & CCPA)

Depending on your jurisdiction (such as the European Union under GDPR or California under CCPA/CPRA), you have rights regarding your personal information, including the right to access, rectify, or request erasure of personal data, as well as the right to opt out of the sale or sharing of personal data for cross-context behavioral advertising. Because we do not require accounts or store uploaded documents, we retain negligible personal data.

9. External Links

Our website may contain links to third-party websites (such as external standards, documentation, or social profiles). We have no control over and assume no responsibility for the content, privacy policies, or practices of any third-party sites or services.

10. Changes to This Policy

We may update our Privacy Policy periodically to reflect improvements in our tool architectures, legal requirements, or advertising practices. Any updates will be posted on this page with an updated revision date.

11. Contact Us

If you have questions, feedback, or privacy-related requests, please visit our Contact Page or review our Terms and Conditions.