Trust Center
Most Quickaboo tools run entirely in your browser, so your files stay on your device. The few that use our server say so on the page and delete your file automatically.
How on-device processing works
When you add a file to an on-device tool, your browser reads it into memory and the tool's code (JavaScript and WebAssembly, downloaded from our site like any web page) changes it right there. The result is handed back to you as a download. The file itself is never part of a network request, which you can check in your browser's developer tools (Network tab) while using a tool.
Tool pages load no advertising or analytics scripts, and their Content Security Policy only allows scripts from our own domain.
Operations that use our server
| Tool | Why a server is needed | Retention |
|---|---|---|
| Protect PDF | Strong AES-256 encryption is applied with qpdf on our server. | Deleted after processing, result deleted on download or within 24 hours |
| Unlock PDF | Decryption with the password you enter runs with qpdf on our server. | Deleted after processing, result deleted on download or within 24 hours |
| Favicon & App Icon Generator | The icon set and ZIP file are generated on our server. | Deleted after the ZIP is built, saved sets deleted after 72 hours |
| Percentage Calculator | The numbers you type are calculated on our server, no files are involved. | Numbers only, not stored |
Every other tool runs on your device. Each tool page shows a badge saying which applies.
Data retention
| Data | Kept |
|---|---|
| Files processed on your device | Never sent to us |
| Files uploaded to a server tool (Protect PDF, Unlock PDF, Favicon & App Icon Generator) | Original deleted right after processing, result deleted when downloaded, or within 24 hours |
| Numbers sent to the Percentage Calculator | Not stored |
| QR codes and favicon sets you save to your account | 72 hours, then deleted automatically |
| Account (email address, optional name and country) | Until you delete your account |
| Sign-in codes | Stored hashed, expire after 10 minutes and are then deleted |
| Security log (IP address of failed or suspicious requests) | 90 days |
| Contact form messages | 12 months |
| Anonymous usage counts (for example "Merge PDF: 120 downloads today", no IP address, no cookie) | 24 months |
| Error reports (error message and page, never file contents) | 30 days |
Third-party processors
| Service | Purpose | When |
|---|---|---|
| Google Analytics | Aggregated traffic statistics | Content pages only (home, categories, blog), and only after you accept analytics cookies |
| Google AdSense | Advertising | Content pages only, never on tool pages. Non-personalised unless you accept advertising cookies |
| Google reCAPTCHA | Spam and abuse protection | Contact form and sign-in only |
| Email delivery provider | Sending sign-in codes and replies to your messages | When you sign in or contact us |
| Hosting provider | Runs our website and the server tools listed above | Every visit (standard web server logs) |
What we measure
To find broken tools we count events per tool and day (opened, file added, success, error, download, share) and keep error messages for 30 days. These counts have no IP address, cookie or user identifier, and never include file names or contents.
Who we are
- Service
- Quickaboo (quickaboo.com)
- Contact
- quickaboo@cosvire.com · Contact form
Reporting a security issue
Please report vulnerabilities through the contact form with the subject "Security". See also our Privacy Policy and Terms of Service.