Privacy policy

Data controller

• Controller: eThorns, run by Felipe Ospina Montoya (an individual).
• City: Medellín, Colombia.
• Email: hola@ethorns.com, with the subject "Personal data". Requests are handled by email only.

The controller also handles queries and complaints about personal data.

What we process, why, and for how long

Tools that run in your browser

Tools marked "Runs on your device" process your files and text locally with JavaScript. Nothing you enter or upload into them is sent to us or to anyone else.

Online checks

• Data: the link, domain or name you submit to a tool marked "Online check", and your IP address.
• Purpose: running the check you asked for, and limiting abuse (each connection gets a few checks per minute).
• Retention: the result is kept only in the server's memory, so a repeated check is fast: at most 10 minutes for links and at most 1 hour for domain checks. The name you checked and your IP address stay in memory for about 2 minutes to enforce the per-minute limit. None of it is written to disk.

File tools that use our server

• Data: the file you send to a tool marked "Uses our server" (EPS to PNG or JPG, Compress PDF, Word, Excel, PowerPoint to PDF, PDF to Word, Scanned PDF to text (OCR), PDF to SVG, Remove PDF password), and your IP address. The file name is never sent: your browser names the download. Remove PDF password also sends the password you type, which is used only to open that file and is never stored or logged.
• Purpose: converting the file you asked us to convert, and limiting abuse (each connection gets a few conversions per minute).
• Retention: the file and its result exist only in the memory of an isolated converter that has no internet access, and are deleted as soon as the result is sent back to you, or as soon as the conversion fails. We never store the file, look at it or use it for anything else, including training any system. The converter's log records only which tool ran, whether it worked and how long it took.

Each tool page says exactly what it sends and to whom. Some tools send what you type straight from your browser to another service instead of to us; they're listed under "Service providers" below.

Server logs

• Data: IP address, date and time, the page requested without anything after the "?", response code and browser type. The links and domains you check are never written to these logs.
• Purpose: protecting the service from abuse and fixing faults.
• Retention: the log isn't kept by date. It has a fixed size (three files of 10 MB, shared by all our sites), and the oldest lines are deleted automatically as new ones come in. At current traffic that is a few weeks.

Emails you send us

• Data: your email address, your name if you give it, and what you write.
• Purpose: answering you and following up on your message.
• Retention: we keep the conversation while it's useful for that, and delete it when you ask.

Donations

If you buy us a coffee, the payment happens on Buy Me a Coffee's site and is processed by its payment provider, under Buy Me a Coffee's privacy policy. We never see your card details. We see only what you choose to share there, such as a name and a message, and the email address Buy Me a Coffee gives us to send a receipt or a thank-you. We don't use it for anything else and we don't copy it into any other system. It stays in Buy Me a Coffee until you or we delete it there.

Purchases

If you buy a kit from our shop, the checkout happens on Polar's site. Polar is our reseller and the merchant of record: it sells you the product, processes the payment through its payment provider and handles the receipt, sales taxes and refunds, under Polar's privacy policy. We never see your card details. Polar shares with us your name, email address, country and what you bought, so that we can deliver it and help you if something goes wrong. We don't use them for anything else and we don't add you to any mailing list. They stay in Polar for as long as tax and accounting rules require us to keep sales records.

Cookies and browser storage

eThorns sets no cookies of its own. The side menu remembers which sections you folded in your browser's session storage, which is deleted when you close the tab and never sent to us. If you pick the light or dark theme, or close the note that offers the page in the other language, your browser remembers it in its local storage: it stays on your device until you clear the site's data, and is never sent to us. Cloudflare, which delivers the site, may set a security cookie to tell people from bots.

How long the databases last

Each database this policy describes exists for as long as we use it for the purposes given here, and each piece of data in it is kept only for the period set out above.

Your rights

Under Law 1581 (art. 8) you have the right to:

• Know, update and correct your data.
• Ask for proof of any consent you gave us.
• Be told how we have used your data.
• Withdraw your consent and ask us to delete your data, unless a legal or contractual duty requires keeping it.
• Access your data free of charge.
• Complain to Colombia's data protection authority, the Superintendencia de Industria y Comercio (sic.gov.co), after first making the request to us.

How to exercise them

Write to hola@ethorns.com with the subject "Personal data". Include your name, the email address or data the request is about, and what you're asking for.

• Queries (what data we hold and how we use it): we answer within 10 business days. If we can't, we tell you why and answer within the following 5 business days.
• Complaints (correction, update, deletion or withdrawal): we answer within 15 business days of the day after we receive them. If we can't, we tell you why and answer within the following 8 business days. If a complaint is missing information, we ask for it within 5 days. If we don't receive it within 2 months, the complaint is treated as withdrawn.

Service providers and international transfers

Our server is in Colombia. These providers process data on our behalf or receive it from your browser, on servers outside Colombia:

• Cloudflare (United States) delivers ethorns.com and api.ethorns.com and protects them from attacks. It sees the IP address and the full address of every request, including the link or domain sent to an online check, and files sent to a tool that uses our server pass through its network. When a request fails, your browser may send Cloudflare an error report with that address. Cloudflare Web Analytics counts visits without cookies: it gets the page address without anything after the "?" or "#", load times and browser version, never what you type or upload into a tool.
• Cloudflare's public DNS resolver (1.1.1.1, DNS over HTTPS): the DNS lookup and email-security tools send it the domain name you type, straight from your browser.
• Have I Been Pwned: the leaked-password check sends it only the first 5 characters of your password's SHA-1 hash (k-anonymity). Your password never leaves your device.
• The sites, registries and DNS resolvers a check asks. A check reaches whatever it is about: the site you check sees a visit from our server (not from you), domain checks ask the domain's registry, and the DNS propagation check asks 10 public DNS resolvers in several countries. They receive only the link or name being checked.
• Buy Me a Coffee (United States), only if you donate (see above).
• Polar (United States), only if you buy from the shop (see above).
• Google (United States), only once ads are on (see below).

Advertising

eThorns may show ads from Google AdSense to stay free. There are none yet, and we won't turn them on until a consent message is in place for visitors where the law requires one. When ads are on, Google and other third-party vendors use cookies to show ads based on your prior visits to this and other websites. Google's use of advertising cookies lets it and its partners show you ads based on those visits. Learn more in how Google uses information from sites that use its services.

You can opt out of personalized advertising in Google's My Ad Center, and opt out of other vendors' personalized advertising at youradchoices.com.

No ads will ever appear on the tools that handle secrets or private files (PDFs, documents, photo metadata), use your camera or put what you check in the page address: Is it a scam?, Is this file safe?, Short link expander, Website security scan, SSL certificate checker, Lookalike domain detector, Domain age checker, Password generator, Certificate decoder, Leaked password check, Link cleaner, Watermark an ID copy, Encrypt text, Email security, DNS lookup, Email header analyzer, DNS propagation checker, DMARC report reader, Is it down?, Link preview checker, HEIC to JPG, Remove EXIF & GPS, EPS to PNG or JPG, QR code reader, SHA-256 hash, JWT decoder, Compress PDF, Word, Excel, PowerPoint to PDF, PDF to Word, Scanned PDF to text (OCR), PDF to SVG, Remove PDF password, Merge PDF, Split PDF, Rotate PDF, Delete PDF Pages, PDF Page Numbers, Watermark PDF, JPG to PDF, PDF to JPG, PDF to PNG, Sign PDF. We never pass what you type or upload into a tool to Google or any other advertiser.

Children

eThorns is a general tool site with no accounts. We don't knowingly collect data from minors.

Changes to this policy

If we change this policy, we'll post it on this page with a new date. If a change affects a purpose you consented to, we'll ask for your consent again.