Security and how it works

How a tool handles your file

1. Your browser downloads the app from capyfiles.com, the same way it downloads any web page.
2. When you pick or drop a file, the browser reads it into memory on your device. Nothing is sent.
3. The work happens in your browser, using WebAssembly builds of open-source engines such as pdf.js, pdf-lib, qpdf, Mediabunny, Squoosh, Tesseract and Transformers.js, plus your graphics card and hardware video encoder where available.
4. The result is handed back to you as a download. When you close the tab, the browser frees the memory.

We never receive your files, their names, or anything made from them, such as text, thumbnails or page counts. There is no server that could process a file, so there is nothing to store, log or leak.

Check it yourself

You don’t have to take our word for it.

• Watch the network. Open your browser’s developer tools (F12, or Cmd+Option+I on a Mac), go to the Network tab and run a tool on a file. You’ll see the app and, for AI tools, a model download. You won’t see a request carrying your file.
• Go offline. Open a tool once so the app is saved, then turn off Wi-Fi or switch on airplane mode. The tool keeps working, because it never needed the internet to handle your file.
• Read the policy. Every page is served with a Content-Security-Policy header, which your browser enforces. Its connect-src list is the complete set of places our scripts are allowed to send data to. You can see it in the developer tools under the page’s response headers. It is listed in full below.

Where the site is allowed to connect

This list comes from the same code that sets the real header. Anywhere else is blocked by your browser.

If you accept advertising cookies on a build that uses Google’s tags, Google’s analytics hosts are added to this list. The privacy policy covers that.

Everything we ever receive

• Page and app downloads. Like every website, our host Cloudflare sees your IP address and which pages and files your browser asked for.
• AI models. AI tools download their model from capyfiles.com once and keep it on your device. That is a download to you. The model then runs locally.
• Signing in, if you choose to. Your email address, and your name and picture if you use Google, go to Firebase, Google’s sign-in service.
• Error reports, only when you click “Send report”. The tool name, your browser version and the error message, with quoted text and file names replaced before sending.

Sharing tools

A tool that sends a file to someone has to upload it, since that is the point. No such tool is live today. If we add one, it will be clearly labelled, it will say what it uploads and where, and it will ask before sending anything.

What we can’t protect against

Your files are only as safe as the device they’re on. Malware or a browser extension with access to every page can read what the page reads, on any website. You also trust the code we serve: the policy above stops it from sending your data anywhere else, and anyone can inspect that policy.

Report a security problem

Write to hello@capyfiles.com with “Security” in the subject. We reply within a few working days and will credit you if you want. Please give us a reasonable time to fix a problem before you publish it. Our security.txt has the same details.