Privacy and document safety: complete guide to uploads, EXIF, and OCR trust

Online converters are as safe as their retention rules, processors, and your judgment about the file. A tax PDF, a prescription scan, and a café menu QR live in different risk buckets. This hub indexes Toolsy trust posts so you can decide upload vs on-device tools without rereading the same privacy FAQ on every tool page. It is not legal advice and it does not claim HIPAA certification. Start with Is it safe to upload documents online? and What happens to files after processing?. Prefer browser-side tools when the product offers them (many QR and text utilities). For photos with GPS, use Strip EXIF. Legal source of truth: the Privacy Policy.

Who this privacy hub is for

This index fits freelancers, clinics, agencies, and small teams who upload because desktop software is slow, then pause when the file looks sensitive. Developers wiring OCR APIs also land here during security review.

If you only need marketplace photo sizes, use Seller photo specs: complete guide. If you only need QR print jobs, use QR codes for small business: complete guide. Come back here when the file itself is the risk.

Decision tree: upload, strip, or stay local

Name the data class before you pick a tool. "Convert this" is not a risk rating.

Your goal	Start here	Deep guide
Judge if any online converter is OK	Privacy Policy	Is it safe to upload documents online?
Retention after a Toolsy job	Privacy Policy	What happens to files after processing?
Medical / prescription OCR caution	Doctor handwriting	Medical document OCR privacy checklist
Remove GPS from photos	Strip EXIF	Remove EXIF GPS before sharing photos
Merge sensitive PDFs	Merge PDF	Merge PDF online security checklist
API vendor trust	API docs	Nanonets vs self-serve OCR API
Handwriting scans of private notes	Handwriting to text	Handwriting OCR: complete guide
PDF toolkit with security notes	Compress PDF	PDF tools online: complete guide
Developer keys and processors	API docs	Developer integrations: complete guide
Seller photos with home GPS	Strip EXIF	Remove EXIF GPS before sharing photos
Markdown export of client docs	PDF to Markdown	Is it safe to upload documents online?
Daily free limits context	Pricing	What happens to files after processing?

When two rows match, choose the stricter path. Medical identifiers beat convenience every time.

Upload safety and file retention

HTTPS only proves the path to the site is encrypted. It says nothing about how long the operator keeps your PDF. Ask who receives the file, how long it stays, whether models train on it, and whether OCR uses a subcontractor for that request.

Toolsy processes uploads for the job you run and designs them to be discarded shortly afterward (typically within about one hour). It does not use uploads to train its own models. OCR and some AI tools may send content to external model providers for that request. Read both trust posts linked above before you upload client passports or sealed contracts.

Everyday office PDFs

Tax packets and bank merges still deserve a checklist. Merge PDF online security checklist walks merge-specific questions. PDF tools online: complete guide indexes compress and split without pretending those tools are local-only. When the same packet later feeds an LLM, prefer a Markdown path from Prepare documents for RAG with Markdown after you clear the privacy bar.

What “after processing” means

What happens to files after processing? states the product retention story in plain language. Prefer that page over marketing adjectives on a tool landing.

Medical OCR, handwriting, and sensitive scans

Medical and prescription images need a calm checklist, not jokes and not a hard sell. Redact what you can before upload. Prefer on-prem or clinician-approved systems when policy demands it.

Prescription and chart photos

Medical document OCR privacy checklist lists what to black out and when to stop. Consumer OCR is for convenience tasks your counsel already allows. It is not a hospital records system.

Handwriting hubs

Handwriting OCR: complete guide indexes recognition scenarios. Pair it with this privacy hub when the page holds names, addresses, or health details. Accuracy posts do not override retention rules.

EXIF GPS, photos, and public sharing

Phones embed GPS, camera serials, and timestamps. Lifestyle listing photos and family genealogy scans often leak a home pin. Strip metadata before you post.

Use Strip EXIF and follow Remove EXIF GPS before sharing photos. Sellers should also skim Seller photo specs: complete guide so resize and privacy happen in one prep pass. Heavy email attachments of the same photos belong under Compress images before email after you strip metadata.

APIs, widgets, and vendor trust

Keyed APIs and embed widgets move the same bytes with more automation. Security review should ask about subprocessors, quotas, and error handling when limits hit mid-upload.

Nanonets vs self-serve OCR API compares vendor shapes. Developer integrations: complete guide maps browser vs API vs widget. Free daily limits and monthly API caps exist to keep shared infrastructure available; they are not a privacy feature by themselves.

Browser-side tools vs cloud processing

Many Toolsy QR generators and text utilities draw or convert in the browser with nothing uploaded. Image, PDF, OCR, and MarkItDown paths usually need a short server hop. Read the tool FAQ on each page. Prefer on-device tools when the product offers them and the file is sensitive.

QR Wi‑Fi passwords stay on-device for static Wi‑Fi QR generation, but the printed card still shares the secret with anyone who scans. Privacy is more than upload retention.

Limits and when not to use a consumer converter

Do not upload classified data, sealed discovery, or regulated health archives to a consumer web tool. Buy a contract with BAAs and audit rights when your counsel requires it. Toolsy’s Privacy Policy is the claim set; this hub only indexes how to think.

Free quotas throttle abuse and cost. Hitting a daily limit is not a signal that your file was stored longer. Upgrade or wait when you need more jobs; change vendors when you need a different compliance posture.

Frequently asked questions

Is it safe to upload documents to online converters?

It depends on retention, processors, and the sensitivity of the file. Read the vendor privacy policy, avoid regulated data on consumer tools, and prefer local software when policy demands it. Start with Is it safe to upload documents online? and Toolsy’s Privacy Policy.

What happens to files on Toolsy after processing?

Uploads are processed for the response and designed to be discarded shortly afterward, typically within about an hour. Toolsy does not use uploads to train its own models. OCR and some AI jobs may involve external model providers for that request. Details: What happens to files after processing?.

Can I run medical document OCR on a free website?

Only when your policies and counsel allow consumer tools for that file class. Redact identifiers first. Prefer clinical systems for charts that must stay inside a covered entity. Use Medical document OCR privacy checklist as a caution list, not as clearance.

Should I remove EXIF before sharing product or family photos?

Yes when GPS or camera metadata could reveal a home or private location. Studio pack shots are lower risk but still often contain timestamps and device info. Use Strip EXIF and Remove EXIF GPS before sharing photos.

Is merging PDFs online safe for tax packets?

Safer than emailing unlocked attachments to random strangers, still riskier than a local merge on an encrypted disk. Follow Merge PDF online security checklist, remove needless pages, and avoid uploading when counsel forbids cloud processing. Prefer a machine you control when the packet includes SSNs or full account numbers you are not allowed to send to a vendor.

How do API OCR vendors differ on trust?

Enterprise vertical platforms often sell BAAs, SSO, and workflow UIs. Self-serve APIs sell keys and quotas with a published privacy policy. Compare shapes in Nanonets vs self-serve OCR API and integration choices in Developer integrations: complete guide.

Do browser QR tools upload my Wi‑Fi password?

Toolsy static Wi‑Fi QR generation builds the image on your device and does not upload the password for that draw step. The printed code still shares network access with anyone who scans. Treat distribution as password sharing.

Why do free tools have daily limits?

Shared compute costs money and attracts abuse. Limits keep free tiers available. They are separate from retention promises. See pricing pages for Pro, Plus, and API plans when volume grows.

Does handwriting OCR change the privacy analysis?

Recognition quality is separate from retention. Sensitive handwriting still leaves your device when a server OCR path runs. Pair Handwriting OCR: complete guide with the medical checklist when notes include health or identity details.

Where should agencies start with client document rules?

Classify data, pick local vs cloud per class, document vendors in your security review, and train staff not to paste client PDFs into random free sites. Use this hub’s decision tree, then lock the choice in your agency SOP. Link clients to the Privacy Policy when they ask how Toolsy handles uploads.

For deeper checklists, keep Is it safe to upload documents online?, GDPR-ish questions for US small business tools, and Medical document OCR privacy checklist beside this hub. For what stays in the browser versus what uploads, see Browser-based vs cloud AI: what leaves the device. For why free tiers cap usage, see Why free tools have daily limits. For agency retention SOPs, see Client documents for agencies: minimum retention. For privileged OCR, see OCR for lawyers: confidentiality basics and Redaction before OCR: what to black out.