Privacy Policy

Last updated: 2026-05-06

This Privacy Policy describes how Pickrack (https://pickrack.com, "we", "us", "our") collects, uses, and shares information when you visit our website. We respect your privacy and aim to be clear about what data is involved. The full source code that backs every claim below is publicly readable at github.com/pickrack/pickrack.

1. How Pickrack Tools Process Your Files

Pickrack offers 51 free tools across PDF, image, AI, dev, text, and calc categories. Different tools have different data flows, and we want to be specific about each.

1.1 Browser-side tools (31 of 51)

The following tools run entirely in your browser. Your file is loaded into your browser memory, processed by JavaScript or WebAssembly running on your device, and downloaded back. The file never reaches our server. We could not access it even if we wanted to:

• PDF (7): Merge PDF, Split PDF, Rotate PDF, Watermark PDF, JPG to PDF, PDF to JPG, Screenshot to PDF (pdf-lib + clipboard paste)
• Image (8): Image Resizer, Image Compressor, Image Converter, HEIC to JPG (heic2any), Background Remover (@imgly/background-removal WebAssembly), Image Cropper, Image Upscaler, Color Palette Extractor
• Developer (9): JSON Formatter, Base64 Encoder, JWT Decoder, Hash Generator (Web Crypto API), UUID Generator, Regex Tester, Timestamp Converter, Text Diff Checker, CSS Gradient Generator
• Text (5): Word Counter, Case Converter, Lorem Ipsum, Slug Generator, Markdown to HTML (marked library)
• Calc (3): Password Generator, QR Code Generator, Age Calculator (the Tip Calculator, BMI Calculator, and Currency Converter — listed under Calc — are also browser-side; Currency Converter additionally calls exchangerate-api.com directly from your browser for live rates)

You can verify this in your browser's DevTools (Network tab) — no upload requests fire when you use these tools.

1.2 Server-side PDF tools (10 of 51)

Some PDF operations require native binaries (Ghostscript, qpdf, LibreOffice, Calibre, Poppler) that have no browser equivalent. For these, your file is sent to our server. The exact pipeline:

• Your file is written to a unique temporary directory under /tmp
• The native binary processes it and writes the output to the same temp directory
• The output is streamed back to your browser as the HTTP response
• The temporary directory (input + output) is deleted in a JavaScript finally block immediately after the response — typically within seconds
• There is no database. There is no cloud storage bucket. There is no log of file contents

The 10 server-side tools are: Compress PDF, PDF to Markdown, Unlock PDF, Protect PDF (AES-256), Word to PDF, PDF to Word, PPTX to PDF, PDF to PPTX, EPUB to PDF, PDF to EPUB. Source for each route is at github.com/pickrack/pickrack/tree/main/app/api/pdf.

1.3 AI tools (6 of 51)

The AI Summarizer, AI Translator, AI Grammar Checker, YouTube Summarizer, Chat with PDF, and Translate Document tools call Anthropic's Claude Haiku 4.5 API on the backend. Specifically:

• Only the text you typed (or, for Chat with PDF and Translate Document, the text extracted from your PDF entirely inside your browser) is sent — never a file binary, never an IP-linked identifier, never any account information (you don't have an account)
• For the YouTube Summarizer, we additionally fetch the public YouTube transcript from your video URL on our server; the video binary is never downloaded
• Anthropic's API agreement excludes API inputs from training. Inputs are deleted within 30 days per their data retention policy: anthropic.com/api
• Pickrack does not log AI inputs, outputs, or any text content — only a per-IP rate-limit counter (10/day for Summarizer/Translator/Grammar/YouTube; 30/day for Chat with PDF turns; 5/day for Translate Document) which contains no user data

1.4 Information you give us directly

If you contact us via email, we receive your email address and the contents of your message. We use this only to respond.

1.5 Information collected automatically

When you visit Pickrack, our servers and third-party services may automatically log:

• IP address (anonymized in Google Analytics; raw IP used only for per-IP rate-limit counter on AI and server-side PDF tools, then discarded)
• Browser type and version
• Operating system
• Pages viewed, time spent, and referring URL
• Device type (desktop, mobile, tablet)

2. Cookies and Similar Technologies

The Pickrack tool pages themselves do not require cookies to function — every tool works in private/incognito mode and after disabling cookies entirely. Cookies set by Pickrack and our third parties are described below.

Pickrack uses cookies and similar tracking technologies to operate the site and serve advertising. The main categories:

• Essential cookies — needed for the site to function (e.g., security, session).
• Analytics cookies — Google Analytics 4, to understand how visitors use the site (page views, popular content).
• Advertising cookies — Google AdSense, to show ads relevant to your interests and measure ad performance.

For details, see our Cookie Policy.

3. Third-Party Services We Use

3.1 Google Analytics

We use Google Analytics 4 (GA4) to measure traffic. GA4 may set cookies and collect data including IP address, browser, device, and pages viewed. Google's privacy practices: policies.google.com/privacy. You can opt out via the Google Analytics Opt-out Browser Add-on.

3.2 Google AdSense

We display ads served by Google AdSense. Google and its partners use cookies (including the DoubleClick cookie) to serve ads based on your visits to this site and other sites on the internet. You can opt out of personalized ads at google.com/settings/ads.

Third-party vendors, including Google, use cookies to serve ads based on a user's prior visits to our website or other websites. Google's use of advertising cookies enables it and its partners to serve ads based on your visit to Pickrack and/or other sites on the Internet.

3.3 Cloudflare

We use Cloudflare for content delivery, DNS, and security. Cloudflare may collect IP and request metadata for those purposes. See cloudflare.com/privacypolicy.

3.4 Affiliate Links

Some external links on Pickrack are affiliate links. When you click and make a purchase, we may earn a commission at no extra cost to you. Click tracking is performed by the affiliate program (e.g., Amazon Associates, individual SaaS partner programs), not by Pickrack. See our Affiliate Disclosure.

4. How We Use Your Information

• Operate and improve the site
• Measure traffic and content performance
• Serve relevant advertising
• Respond to messages you send us
• Detect and prevent abuse, fraud, and security issues

5. How We Share Information

We do not sell your personal information. We share data only with:

• Service providers listed in section 3 (Google, Cloudflare) acting on our behalf
• Authorities when legally required

6. Your Rights

6.1 GDPR (European users)

If you are in the European Economic Area or UK, you have the right to:

• Access the personal data we hold about you
• Request correction or deletion
• Object to or restrict processing
• Port your data to another service
• Withdraw consent at any time
• Lodge a complaint with your local Data Protection Authority

6.2 CCPA (California users)

California residents have the right to know what personal information we collect, request deletion, and opt out of any sale of personal information. Pickrack does not sell personal information.

6.3 Exercising your rights

To exercise any of these rights, email [email protected]. We will respond within 30 days.

7. Data Retention

• Files processed by tools: deleted from /tmp immediately after the HTTP response, in a finally block — typically within seconds
• AI tool inputs/outputs: not retained on Pickrack's servers at all (not logged, not cached). Anthropic retains API inputs up to 30 days per their commercial terms
• Per-IP rate-limit counter: in-memory only, expires after the rolling 24-hour window. Restarting the server resets all counters
• Analytics data: retained per Google Analytics defaults (14 months for user-level data)
• Email correspondence: retained as long as the conversation is active, then archived for one year before deletion
• Server access logs: rotated and deleted after 30 days; do not contain file contents, only request URL, status code, IP, and timestamp

8. Children's Privacy

Pickrack is not directed at children under 13. We do not knowingly collect personal information from children. If you believe a child has provided us information, contact us and we will delete it.

9. Changes to This Policy

We may update this policy. The "Last updated" date at the top reflects the most recent change. Material changes will be highlighted on the homepage for at least 14 days.

10. Contact

Questions about this policy? Email [email protected].