This site collects nothing. Here is the detail.

This policy covers ream.tools and every page and tool served from it. It describes what happens to information when you use the site, and what happens to your documents — which is nothing.

It does not cover any service you reach by leaving. If you configure an AI provider, that provider’s own policy governs what it does with the text you send it.

No cookies. Not analytics cookies, not preference cookies, not a consent cookie. Because none are set, there is no banner, and nothing to consent to.

No analytics. No Google Analytics, no Plausible, no Sentry, no session replay, no heatmaps, no error beacon. The page has no mechanism to report what you did with it.

No document content. Files are read into the memory of your own tab. They are never encoded into a request, never written to a cache, never retained.

No identity. No registration form, login, newsletter, comment system or support portal — and therefore no database of users, because there are no users to store.

No fingerprinting. The site does not read canvas hashes, installed fonts, WebGL renderer strings or battery state in order to identify you.

The site is served as static files by a hosting provider. As with any web server, that provider will typically log the request: an IP address, a timestamp, the URL, a user agent and a referrer. Those are infrastructure logs, generated by the host rather than by Ream’s code.

Ream has no server-side code, so the application cannot read those logs, and does not use them for profiling or advertising. A Do Not Track or Global Privacy Control signal changes nothing here, because there is no tracking to switch off.

A service worker and the browser cache store the application itself: the HTML shell, the JavaScript bundles, the WebAssembly modules and four font files. That cache is what makes offline use work. It contains no document and no identifier for you.

There is no localStorage or IndexedDB record of your files. Settings live in the open tab and vanish when it closes or reloads. Clearing your browser’s site data removes everything this site put there, and it re-downloads on the next visit.

In normal use every request goes to this origin: the page, its scripts and styles, the WebAssembly modules, the PDF.js worker, the fonts, the icon and the manifest. There are no third-party script tags, no font CDN and no embedded widget.

There are exactly two exceptions, and neither fires unless you ask for the feature that needs it.

OCR language data. The first time you run OCR in a language, Tesseract downloads that language’s model from the tessdata CDN at tessdata.projectnaptha.com. The request carries a model filename and ordinary headers — nothing about your document. Recognition then happens locally.

An AI provider you configure. Summarise PDF and Translate PDF need a language model, and this site has none. You paste a key for a provider you choose. The extracted text goes from your browser directly to the endpoint you selected, authenticated with your key, and does not pass through any server belonging to this project — there is no such server. What the provider then does with it is governed by your agreement with them. Point the tool at a model on your own machine and nothing leaves the machine at all.

No other outbound request is made. If you observe one, that is a bug worth reporting.

Your documents stay on your device. That is a statement about architecture rather than intent: with no upload endpoint in the codebase, there is no route by which a file could be sent.

Closing the tab releases the in-memory copy. Downloaded files are ordinary files on your disk, under your own control and your own backups. On a shared computer, remember that the Downloads folder and browser history are shared too. Local processing removes the network copy; it cannot remove the local one.

Data protection law — the UK GDPR, the EU GDPR and comparable regimes — gives you rights of access, rectification, erasure, restriction, portability and objection over personal data held about you.

This project holds no personal data about you. There is no account to look up, no document store to search and no profile to export. A subject access request would be answered honestly: there is nothing to disclose. The only record that exists is the host’s access log described in section 3, which this project does not control.

Because there is no processing of personal data, there is no lawful basis to state, no retention period to publish and no international transfer to disclose. That is not a loophole; it is the consequence of collecting nothing.

No data is collected from anyone, so there is no special provision to make beyond the ordinary one: nothing is collected, profiled or advertised to. These are general-purpose document utilities, not a service directed at children under 13.

If this policy changes, the “last updated” date changes with it and the changelog records that a revision happened. Material changes — a new network request, a new storage mechanism — would get their own changelog entry rather than being folded into a quiet revision.

The policy will never quietly acquire a section about analytics or advertising. Either would require changing the content security policy in the site’s response headers first, and that header is visible to anyone who looks.

Questions, corrections and requests go to hello@ream.tools, where a person reads them. There is no ticket system, no chatbot and no form, because a form is a server-side feature this site does not have.