Privacy Policy

Last revised: 2026-10-31
Effective date: 2026-10-31

ToolMoru, operated by WEFTWARE, treats users' personal information with care and handles it as described below.

1. Files you open

Image and PDF files you select in a tool are read and processed only inside your browser, and are neither sent to nor stored on the service's servers. File names, contents and document text are also not included in analytics events or logs. When you close the browser tab or reload the page, the data being processed is discarded.

In short: files created with the image tools automatically carry the ToolMoru name and site address in their properties. Details: Every JPG, PNG and WebP file newly created by Compress, Convert or Resize always records the service name and the site address automatically as file metadata. By format: JPG gets EXIF Software and XMP (CreatorTool: ToolMoru, source: https://toolmoru.com), PNG gets a Software text chunk and XMP (the same values), and WebP gets XMP (CreatorTool: ToolMoru, source: https://toolmoru.com) without a Software field. This information stays inside the file, is not sent to a service server, and does not identify you. Metadata from the original, such as location (GPS), camera make and model, photographer, copyright or description, is not copied into the result; only display-related technical details that the browser adds when saving, such as the color space, may remain. If you upload or share the result file, whoever receives it can see this information.

2. Information we collect

• Account information: There is no sign-up or login, and we do not ask for your name, email address, phone number or similar details.
• Private support board (optional): Only if you post a question, we process: (1) the question type, title, message and page language you enter; (2) creation/update times, status and the operator's replies; (3) your post password (8–64 characters) — never stored as entered, only as an irreversible hash (Argon2id) mixed with a server secret. The "Generate a random password" button creates the password in this browser only and does not send or store it before you submit the question; (4) a deletion-only recovery code — generated once by the server when you submit, shown only on the completion screen and stored only as a hash mixed with a server secret; it can delete that question but cannot view or edit it; (5) a random request identifier used to prevent duplicate submissions. We do not ask for email, phone numbers or attachments. Please do not include personal information (contact details, ID or bank numbers, etc.) in your message.
• Abuse-prevention records: To limit repeated posting and password guessing, we store a keyed hash of your IP address (the original IP cannot be recovered from it) with attempt counts and times. The original IP address is not stored. These records expire after 2 days and expired records are deleted automatically when later questions are posted (deletion may be delayed when few questions are posted).
• Spam protection (Cloudflare Turnstile): The question form page uses Cloudflare Turnstile by Cloudflare, Inc. To check that a person is posting, Cloudflare processes browser/device signals and connection information under Cloudflare's Turnstile privacy terms. We only receive the result (pass or fail).
• Visit statistics (Cloudflare Web Analytics): To understand the number of visitors, popular pages and tools, where visits come from, and page performance, WEFTWARE, the operator, uses Cloudflare Web Analytics provided by Cloudflare, Inc. For this, your browser loads Cloudflare's analytics script (static.cloudflareinsights.com) and sends measurements to /cdn-cgi/rum on this site's own address. According to Cloudflare's documentation, this covers the visitor's country, the host and page path visited, the referring page, device type, browser and operating system, and performance measurements such as page load time and Core Web Vitals. Cloudflare states that this measurement does not use cookies or browser storage such as localStorage and does not fingerprint visitors, and this service does not use cookies or browser storage for analytics either. Original image or PDF files, file names, file contents and document text are never sent for analytics. Processing and retention follow Cloudflare's own policies, and this service does not set a separate retention period.
• Visit statistics and question links: Visit statistics process page paths, so the question number in a question link (/en/support/ticket/<number>/) may be included. Message content and passwords are not included, and a question cannot be opened with its number alone.
• Access logs: The website is hosted by Cloudflare, Inc. Cloudflare may process general access records, such as IP address, request time and browser information, to deliver the service and keep it secure; how long they are kept follows Cloudflare's own policies and is not set by this service.

2-1. Use, retention and deletion of support board data

• Purpose: receiving and answering questions, investigating and improving the service, preventing abuse of the board.
• Retention: until you or the operator delete the question. Deletion immediately removes the question and its replies from the database, so they can no longer be opened on this board (but they may remain in the recovery history described below for up to 30 days).
• Recovery history: the database (Cloudflare D1) keeps a change history for up to 30 days for disaster recovery. A deleted question may remain in this history during that period; the operator uses it only to recover from failures. It disappears automatically after 30 days.
• Deletion by the operator: posts that break the board rules, contain personal information, or have long been resolved may be deleted by the operator.
• Children: the board does not ask for or check age. Users under 14: please write your question together with a parent or guardian, and do not enter unnecessary personal information such as your name or contact details in the message. If a parent or guardian asks us to delete a child's question, we handle it by the methods in section 5 (direct deletion with the post password or recovery code, or verification of the request by email); a question number alone is not enough.

3. If advertising or further analytics are introduced

The only analytics in use today is Cloudflare Web Analytics described in section 2; we do not use Google AdSense advertising, Google Analytics (GA4) or any other advertising or analytics service. If we introduce them in the future, those services may collect advertising identifiers, device information and visit information through cookies and similar means. Before introducing them, we will first update this policy and provide any consent procedure that is needed. Even if we later measure tool usage events, they will use only minimal information, such as the type of tool and whether it succeeded or failed, and will not include file names or contents.

4. Disclosure to third parties and outsourcing

We do not sell or provide your personal information to third parties. We use services of Cloudflare, Inc. (a U.S. company) to deliver the website, measure visits, store support board data (Cloudflare D1) and prevent spam (Cloudflare Turnstile); the information in section 2 is processed and stored in Cloudflare data centers. Processor: Cloudflare, Inc. (United States; 101 Townsend St., San Francisco, CA 94107, USA; privacy contact dpo@cloudflare.com; Korean entity Cloudflare Korea LLC). Entrusted tasks: storing and processing questions (Cloudflare D1 and Workers) and spam protection (Turnstile, which Cloudflare runs directly in your browser). Items transferred: the support board information in section 2. Countries: the United States and other countries where Cloudflare operates data centers (the question database is requested in the Asia-Pacific region, but Cloudflare does not guarantee its location). When and how: over the network, immediately when you submit, view, edit or delete a question. Retention: until the question is deleted (plus up to 30 days in recovery history). Refusal: if you do not submit a question nothing is transferred; the board then cannot be used, and you may email support@toolmoru.com instead. Basis for the overseas transfer: entrusted processing and storage needed to provide the service you request (receiving and answering your question), disclosed in this policy under Article 28-8(1)(3) of the Personal Information Protection Act of Korea.

5. Your rights

If you posted a question, you can view, edit (while it is still "received") and delete it at any time with its question number and post password. Because the password is stored irreversibly, a forgotten password cannot be recovered and the operator cannot tell it to you, so you cannot open or edit the post without it. If you forget it you can still delete that question with the deletion-only recovery code shown once when you submitted it (it cannot view or edit). If you lost both, you can ask for deletion at support@toolmoru.com; the operator replies within 10 days with the result (or the reason it cannot be deleted and how to object). The ticket number, title and time alone do not prove you are the author, so requests that cannot be verified are not deleted; however, if you report that a post contains personal or sensitive information, the operator may review it and delete it under the Terms of Use. For other information (connection logs and visit statistics processed by Cloudflare) see section 2. If you do not want your visits measured, you can block the analytics script (static.cloudflareinsights.com) with your browser's content blocking or a tracker-blocking extension, and all tools keep working in the same way. After advertising or further analytics are introduced, you can delete or block cookies in your browser settings.

6. Contact

For questions about personal information, please use the support email support@toolmoru.com or the Contact page.