Tools

Privacy

This site has no accounts and almost all of its tools run only in your browser: what you type into them is not sent anywhere. It is funded by Google ads, which do use cookies. This page explains what data is processed, by whom and for how long.

Who is the controller

Jose Miniño Diego. For any question about your data, write to wkielw@gmail.com.

What stays in your browser

The texts, numbers, passwords, documents and codes you type into the tools, and the PDFs and images you choose in them, are processed on your device. They are not sent to or stored on any server, with the three exceptions below.

Advertising

Most pages show Google AdSense ads. To do so they load code from Google, which may use cookies and your IP address to show ads, limit how many times you see each one and measure their results and, if you agree, personalise them based on your activity on this and other sites.

• Your consent: if you visit the site from the European Union, the United Kingdom or Switzerland, Google asks you before using advertising cookies, and you can accept, refuse or change your choice whenever you like from that same notice.
• Elsewhere: Google may not ask first and may show personalised ads by default. You can turn personalisation off at the address below.
• Where there are no ads: on the pages where a password or a secret is typed or shown (the secret link, file sending, the password generator, the pwned password checker and the QR code generator, which accepts your Wi-Fi password) no advertising and no other third-party code is loaded.
• More information: Google explains how it uses data from the sites that show its ads at policies.google.com/technologies/partner-sites, and you can adjust personalisation at adssettings.google.com.

The ad code runs on the page, but the tools do not send it what you type into them. The site uses no other cookies: the visit statistics explained further down do not need them.

One-time secret links

When you create a secret link, your browser encrypts the text before sending it. The key travels in the link itself and does not reach the server, so we cannot read it.

• What is stored: the encrypted text, a check for the key, how long it will be visible once opened and the date it expires.
• For how long: until someone opens it, at which point it is deleted, or until it expires (one hour, one day or seven days, as chosen by whoever creates it). Expired ones are removed by the next day at the latest.
• What for: to provide the service you ask for, which is to deliver that text once to whoever has the link.
• Legal basis: providing the service you request (Art. 6(1)(b) GDPR).

File sending

When you send a file, your browser encrypts it together with its name before uploading it. The key travels in the link itself and does not reach the server, so we can see neither the file nor what it is called.

• What is stored: the encrypted file and name, a check for the key, the size, when it was sent and when it expires, and whether a download has started and when.
• Where: the encrypted file, in the Cloudflare R2 storage of Cloudflare, Inc., which may be outside the European Union; the rest, in our database.
• Who receives your IP address: your browser uploads the encrypted file directly to Cloudflare R2, and the recipient’s browser downloads it from there, so Cloudflare receives the IP address of both, like any website you visit.
• For how long: until someone downloads it, at which point it is deleted, or until it expires (15 minutes, 30 minutes or one hour after upload, as chosen by the sender). If nobody downloads it, it is deleted at most one day after it expires.
• What for: to provide the service you ask for, which is to deliver the file once to whoever has the link.
• Legal basis: providing the service you request (Art. 6(1)(b) GDPR).
• Reports: if a link is distributing illegal or malicious content, let us know at wkielw@gmail.com with the address of the link without the part after “#”, which is the key, and we will take it down. Without the key we cannot see the content, but we can delete the file. How reports are handled is in the terms of use.

Usage limits against abuse

So that nobody can overload the service, from the same connection you can create 30 secret links per hour and 100 per day, send 10 files per hour, 30 per day and 2000 MB per day, and confirm uploads or download files 120 times per hour. To count this, your IP address is processed, as is that of whoever downloads a file.

• What is stored: not the address, but a fingerprint computed with a secret key held by the server, from which the address cannot be recovered, together with the number of links created, files sent or downloads.
• For how long: the count resets after one hour and after 24 hours, and is deleted at most 48 hours after your last link or transfer.
• Legal basis: the legitimate interest in keeping the service secure and available.

Pwned password checker

Only when you click “Check” in the checker does your browser query the Pwned Passwords service by Have I Been Pwned, which runs on Cloudflare’s network and is outside the European Union. Your password is not sent: only the first five characters of its fingerprint leave, which hundreds of different passwords share. That service receives your IP address, like any website you visit. If you do not want it to, do not use this tool; the rest of the site does not contact it. That page carries no ads.

Visit statistics

To know which pages are used, the site counts visits with Vercel Web Analytics, from the same provider that hosts it. It uses no cookies and stores nothing on your device, and it does not follow you from one site to another or from one day to the next: to avoid counting the same visit twice, Vercel derives from the request an identifier that does not keep your IP address and stops being valid after one day.

• What is recorded: the page visited, the page you came from, the country or approximate area, and the type of device, operating system and browser. Nothing you type into the tools.
• Loading speed: with Vercel Speed Insights, from the same provider and on the same pages, the site also measures how long each page takes to load and to respond on your device and how much its content shifts while loading, in order to find slow pages. Each measurement carries the page, which element of it took longest to paint or to respond (not its content) and the type of connection; from the request, Vercel adds the type of device and the country. It uses no cookies either and stores nothing on your device.
• Where nothing is measured: the password and secret tools, the QR code generator, file sending, the pages that open a secret link or a file link, “About” and the terms of use do not load the measurement code. This page is measured.
• Legal basis: the legitimate interest in knowing which tools are used and whether they load quickly, in order to improve them, using aggregate data. You can object by writing to the address above.

Who hosts the site

The site is served from Vercel, through Cloudflare’s network, and the database is at Turso (Ireland). Like any web server, Vercel and Cloudflare log the requests they receive for a limited time, with the IP address and the page requested, to operate the service and protect it. Those logs do not include the key of secret links.

Your rights

You can ask for access to your data, for it to be corrected or erased, for its processing to be restricted, or object to it, by writing to wkielw@gmail.com. Bear in mind that what is stored does not reveal who you are: an encrypted secret cannot be read and the fingerprint of an IP address cannot be reversed. If you believe your data is not being handled properly, you can lodge a complaint with the Spanish Data Protection Agency (www.aepd.es) or with the data protection authority of your country.

Last updated: 10 October 2026. This page is a translation of the Spanish version, which prevails if the two differ.