Privacy Policy
Last updated 2 September 2026
The short version. The tools on this site run entirely inside your own browser. Files you open in them are never uploaded to us and never leave your device. We don't run accounts, we don't ask for your name or email, and we don't sell anything.
The only thing we'd like to collect is anonymous visitor statistics, and that stays switched off unless you say yes.
Who we are
CitiIT Limited trades as dPaul Software and operates dpaul-software.uk. We are the data controller for the information described here.
- Registered in England and Wales, company number 15811174
- Registered office: C/O SG Accounting, 1 Cedar Office Park, Cobham Road, Wimborne, BH21 7SB, United Kingdom
- VAT number 473 5892 49
- Contact: david@dpaul.studio
What the tools do with your files
Every tool hosted on this site is client-side. The processing happens in the JavaScript engine of your own browser, on your own machine. Nothing you load into a tool is transmitted to us, stored by us, or seen by us, because there is no server on our side that receives it.
When you close the tab, whatever the tool was holding in memory is gone.
Bring your own API key: the tts tool
The tts tool works differently in one respect, and it's worth understanding.
You supply your own API key from a speech provider. That key is stored locally in your browser, on your device. It is never sent to us and we have no way of reading it.
When you use the tool, the text you enter is sent directly from your browser to the provider you chose. It does not pass through us. What happens to that text after it arrives — how long it's kept, whether it's used for training, who can see it — is governed by that provider's own privacy policy and terms, not by this one. Read theirs before you paste anything sensitive in.
Any usage charges from your provider are between you and them.
Analytics cookies
We use Google Analytics 4 to count visits and see which tools people use. It is not loaded at all until you press "Allow analytics" on the banner. Choose "No thanks" and the script is never fetched, no analytics cookies are set, and any that already existed are deleted.
IP addresses are anonymised before storage. We don't use analytics for advertising, remarketing, or profiling, and we never try to identify individuals from it.
| Cookie | Purpose | Expires |
|---|---|---|
| _ga | Distinguishes one browser from another so repeat visits aren't double-counted | 2 years |
| _ga_<ID> | Keeps the session state for the property | 2 years |
Google Ireland Limited acts as our processor for this. Data may be transferred to the United States under Google's standard contractual clauses and the UK addendum. Google's own description of the practice is at policies.google.com/technologies/partner-sites.
Legal basis: your consent, which you can withdraw at any time using the Cookie settings link in the footer.
Things stored on your device that aren't cookies
Two items may sit in your browser's local storage. Neither is transmitted anywhere.
- dpaul-consent — records your cookie choice and the date you made it, so we don't ask again on every page. This is set regardless of which option you pick, because remembering a refusal is the whole point of asking.
- Your tts API key, if you've entered one, plus any tool settings you've saved.
Clearing your browser's site data for this domain removes both.
Fonts and hosting
Page fonts are loaded from Google Fonts. Your browser's request to Google discloses your IP address and the page you're on. [[If you self-host the fonts, delete this section.]]
The site is hosted on GitHub Pages, operated by GitHub, Inc. GitHub logs the IP address of every visitor to a Pages site and stores it for security purposes, whether or not the visitor has a GitHub account. This happens at the hosting layer and is outside our control — we have no access to those logs and cannot see them. GitHub sets its own retention period, described in the GitHub Privacy Statement.
GitHub is based in the United States, so this involves a transfer outside the UK, made under standard contractual clauses with the UK addendum. Legal basis: our legitimate interest in keeping the site available and defending it against abuse.
Links to other sites
Some links here lead to separate websites, including clever-clog.com. Those sites are operated separately and have their own privacy policies and terms. This policy stops at the edge of dpaul-software.uk.
How long we keep things
- Analytics data: retained by Google for 14 months, then deleted automatically.
- Your consent record: until you clear it or 12 months pass, whichever comes first.
- Hosting logs: held by GitHub for the period set out in its own privacy statement. We hold no copy.
Your rights
Under UK GDPR you have the right to access the personal data we hold about you, to have it corrected or erased, to restrict or object to its processing, to data portability, and to withdraw consent at any time.
In practice, we hold almost nothing about you: no account, no name, no email, no file contents. The analytics data isn't linked to you as an identifiable person, so we usually can't isolate "your" records. The fastest route to erasure is clearing your browser data and declining analytics.
To make a request, email david@dpaul.studio. We'll respond within one month.
If you're unhappy with how we've handled it, you can complain to the Information Commissioner's Office at ico.org.uk/make-a-complaint or on 0303 123 1113.
Children
These tools aren't aimed at children and we don't knowingly collect anything from them.
Changes
If this policy changes materially we'll update the date at the top. Where the change affects what we do with cookies, the banner will ask you again rather than assuming your old answer still applies.