Comprehensive Privacy Policy &
Client-Side Data Governance

1. Executive Summary & Zero-Server Philosophy

InnoxTools ("InnoxTools," "the Service," "we," "us," or "our"), engineered, operated, and funded by INNO XPERT Enterprise Software ("INNO XPERT," accessible at innoxpert.com), is fundamentally architected upon a non-negotiable premise: user data should never be collected, inspected, or transmitted to external servers when executing computational web utilities.

Traditional online converters and utility portals routinely upload multi-megabyte customer PDFs, confidential financial sheets, employee payroll records, uncompiled source code, and API tokens to remote cloud servers. Once uploaded, those files are written to remote hard drives or cloud object storage buckets (such as Amazon S3 or Google Cloud Storage), creating persistent attack surfaces, regulatory non-compliance liabilities, and severe data breach exposure.

In stark contrast, InnoxTools operates as an air-gapped web client. When you interact with any of our 101 tools—including PDF mergers, image converters, word counters, and password generators—the processing occurs strictly within the local memory registers of your own workstation or mobile phone. We maintain zero access to your document contents, file names, or cryptographic tokens.

2. 100% In-Browser RAM Architecture

Every computational operation supported across our 7 engineering suites executes via client-side WebAssembly (Wasm) compiled binaries, HTML5 OffscreenCanvas, Web Workers, and typed array memory buffers (such as ArrayBuffer, Uint8Array, and Float64Array).

Because no network packets containing your document or data are ever constructed, your confidential information cannot be intercepted, monitored, or logged by INNO XPERT, your Internet Service Provider (ISP), or any intermediate network router.

3. Categories of Data We NEVER Collect

To provide absolute legal and architectural clarity to enterprise compliance officers, legal counsel, and privacy auditors, InnoxTools expressly certifies that we NEVER inspect, ingest, harvest, store, or sell any of the following data categories:

• Document Files: PDFs, Word DOCX files, EPUBs, text files, and images.
• Source Code: JSON payloads, SQL scripts, YAML files, and Regex strings.
• Credentials: Passwords, private keys, HMAC secrets, and JWT access tokens.
• Financial Values: Mortgages, incomes, salaries, loan terms, and crypto balances.

4. In-Memory Blob Lifecycles & Immediate Purging

All downloaded outputs generated on InnoxTools (such as a split PDF document, an optimized WebP image, or an exported Markdown file) utilize ephemeral browser Blob URLs created via window.URL.createObjectURL().

These Blob URLs map exclusively to temporary blocks in your device's physical random-access memory (RAM). When you initiate a download, your operating system copies the byte buffer directly from browser memory onto your local storage drive. Once the download finishes, or when you navigate away from or close the browser tab, the browser garbage collector immediately deallocates the underlying RAM registers.

We do not write user files to browser LocalStorage, SessionStorage, or IndexedDB databases, ensuring that subsequent forensic analysis of your local browser cache yields zero document artifacts.

5. Google AdSense & Third-Party Advertising Disclosures

To maintain all 101 web utilities as 100% free and accessible to the global developer community without mandatory subscription fees or paywalls, InnoxTools partners with third-party advertising vendors, specifically Google AdSense, to display non-intrusive advertisements across our platform.

6. Non-Identifying Edge Telemetry & CDN Logs

Like all high-availability internet applications, our web delivery infrastructure and Content Delivery Network (CDN) partners automatically collect routine, non-identifying server access logs when static assets (such as HTML pages, CSS stylesheets, and WebAssembly binary modules) are initially requested by your browser.

These edge logs may include: internet protocol (IP) address, browser client user-agent string, operating system version, HTTP referrer URL, requested asset path, and timestamp. This data is utilized strictly for:

• Detecting and mitigating Distributed Denial of Service (DDoS) attacks and malicious web scrapers.
• Monitoring global Content Delivery Network (CDN) caching hit-ratios and latency metrics.
• Aggregating anonymized geographic utilization numbers to provision server edge capacity.

7. GDPR Article 25 (Data Protection by Design & Default)

For individuals residing in the European Economic Area (EEA), the United Kingdom, or Switzerland, processing of personal data is governed by Regulation (EU) 2016/679 (General Data Protection Regulation - GDPR).

Under GDPR Article 25 ("Data protection by design and by default"), controllers are legally mandated to implement technical and organizational measures ensuring that only personal data necessary for each specific purpose of processing is processed. InnoxTools exceeds this requirement by engineering a technical architecture where zero personal data is transmitted from the user endpoint to our infrastructure.

Because INNO XPERT neither receives, stores, nor manipulates your uploaded files on remote infrastructure, INNO XPERT does not act as a "Data Processor" under GDPR Article 4(8) with respect to your tool content. Consequently, your organization incurs zero cross-border transfer exposure, zero requirement for Standard Contractual Clauses (SCCs), and zero notification burdens in relation to our utility runtimes.

8. HIPAA & Protected Health Information (PHI)

Under the United States Health Insurance Portability and Accountability Act of 1996 (HIPAA) and the Health Information Technology for Economic and Clinical Health (HITECH) Act, healthcare covered entities and business associates must ensure the confidentiality, integrity, and availability of electronic Protected Health Information (ePHI).

Traditional online PDF converters represent catastrophic HIPAA compliance hazards because transmitting patient medical records to third-party web servers without a formal Business Associate Agreement (BAA) constitutes an unauthorized disclosure.

Because InnoxTools executes entirely within the local web browser memory of the authorized clinical or administrative endpoint, ePHI is never transmitted to, received by, or stored on INNO XPERT servers. Healthcare professionals and medical clinics can merge patient charts, redact confidential information, and compress medical scans with complete HIPAA architectural compliance.

9. California Consumer Privacy Rights (CCPA / CPRA)

Under the California Consumer Privacy Act of 2018 (CCPA) and the California Privacy Rights Act of 2020 (CPRA), California residents are afforded specific statutory rights regarding their personal data, including the right to know what personal information is collected, the right to delete personal data, and the right to opt out of the sale or sharing of personal information.

InnoxTools DOES NOT sell, rent, monetize, or trade any personal information, documents, or data derived from utility tool interactions to data brokers or third parties.

To exercise any rights under California law regarding your optional user account profile, please contact our Data Protection Officer at privacy@innoxpert.com.

10. User Accounts & Optional Authentication

All 101 tools on InnoxTools are 100% operational without creating a user account. However, users who voluntarily register an optional account (via email/password or Google OAuth) to track tool execution counts and sync reading progress store the following minimal profile fields in Google Firebase Authentication and Cloud Firestore:

• Email address and user-chosen display name.
• Profile avatar image URL (optional).
• Aggregated numeric counters (e.g., number of tools used, reading bookmarks).

Users can permanently delete their account and all associated profile records at any time directly through their Profile Settings tab, triggering an immediate irreversible deletion.

11. Cross-Border Data Transfers & Sovereignty

Because file conversions occur exclusively within your local hardware endpoint, your confidential documents never cross international borders, cloud availability zones, or sovereign state lines.

Whether you access InnoxTools from the United States, Germany, the United Kingdom, Canada, Australia, Japan, or Sri Lanka, your documents remain physically bounded to the workstation on which they reside.

12. Vulnerability Disclosure & Bug Bounty

INNO XPERT takes web security with paramount gravity. We continuously audit our Content Security Policies (CSP), sub-resource integrity (SRI) hashes, and third-party dependencies.

If you are a security researcher who has identified a potential vulnerability in our WebAssembly compilers or client-side sanitizers, please disclose it responsibly to our security incident team at security@innoxpert.com. We acknowledge qualifying vulnerability reports within 24 hours.