Privacy Policy

This policy applies to zyff.io: every tool page, the API endpoints behind those tools, and widgets you build here and embed on your own site. It describes what the software actually does, not a generic template, and it is written to be read rather than skimmed past.

Two facts shape everything below. First, Zyff has no accounts, so we hold no username, password, profile or payment record. Second, Zyff's tools run on our servers rather than in your browser, so files do reach us for the length of a request. What happens to them in that window is the subject of the next section.

This is a general privacy policy for a general-audience utility site. It is not legal advice, and it does not cover your own obligations if you publish a Zyff widget on a site you operate.

Uploads are processed in memory on Zyff's servers and are not stored. Your browser sends the file over HTTPS to an API endpoint, the server decodes it, applies the settings you chose, and returns the finished bytes in the response. The upload exists only as a buffer for the life of that single request, then it is gone with the request.

Nothing is written to disk, queued, or copied into a database, object store or backup. There is no gallery of past jobs, no history, and no link that lets anyone retrieve a file later, because there is no file to retrieve. Results come back with a no-store cache header, and your browser assembles the download from the response it already holds.

Uploads are never used to train or improve a model. The background remover runs a pre-trained open-source segmentation model on our own servers using weights stored with the application, so your image is not sent to a third-party AI service. That model finds the outline of a subject; it does not identify people, and no face template is created or kept.

Several tools also reduce what your files carry outward. The compressor and resizer bake in EXIF orientation and then drop embedded metadata, so GPS coordinates, camera serial numbers and capture timestamps do not survive into the output. The converter keeps metadata only if you explicitly turn that option on.

Because there is nothing to sign up for, whole categories of data never enter the picture. Zyff collects no email address to use a tool, no password, no phone number and no payment details. There is no payment processor connected to the site at all, so card data cannot be collected even by accident.

Zyff also runs no advertising. There are no ad networks, no conversion pixels, no cross-site tracking scripts, no retargeting tags and no data brokers. We do not sell, rent or share personal information for advertising, and we do not build a profile of you from the pages you visit.

Zyff uses two privacy-friendly measurement tools from Vercel, and it is more honest to name them than to claim the site has no analytics. Vercel Web Analytics counts page views and records the referring source, approximate country and device type. Vercel Speed Insights records real-world loading and interaction timings, such as how long a tool page takes to become usable, tied to the route rather than to a person.

Neither uses a cookie to identify you, and neither reads or writes anything on your device for measurement. Visit counts are derived from a short-lived anonymized value computed from the request, which is not designed to follow you between sites or to persist as a durable identifier. Vercel processes this data on our behalf as a service provider.

What we get out of it is aggregate: which tools people actually use, which pages are slow, and which browsers break. There is no way for us to connect a page view to a file, a business search, or a named individual.

Both are ordinary scripts, so common content blockers and privacy-focused browsers stop them. Blocking them has no effect on the tools, which is a reasonable test of whether analytics is load-bearing here.

Zyff is hosted on Vercel, so every request passes through their infrastructure. Standard request data such as your IP address, user agent, the URL requested, the timestamp and the response status is processed there in order to route traffic, keep the site available, and detect abuse or attacks. This is normal operational processing that any hosted website performs.

Zyff's own application code keeps no record of who uploaded what. When a request fails unexpectedly, the code writes an error entry so the failure can be diagnosed; that entry contains the error, not the contents of your file. We do not use log data for marketing, profiling or ad targeting.

Log retention is limited to what our hosting provider keeps for operational and security purposes. All traffic is served over HTTPS, the Google Places key is held only in server environment variables, and every API endpoint validates input server-side rather than trusting what the page sent. No system is completely secure, but the design deliberately minimizes what exists to lose: there is no store of user files to breach.

The Google Reviews builder is the one tool that involves a third-party API by design. When you search for a business, the text you type and the place you select are sent from our server to the Google Places API. Our API key stays server-side and is never placed in the page, so the request comes from Zyff rather than from your browser.

Google returns the business name, address, rating, review count, a Google Maps link, business photos and up to five reviews, including each reviewer's display name, avatar URL and review text. That content originates from Google and belongs to the people who wrote it. We render it and let you restyle it, but we do not alter the words.

Business photos are requested through /api/tools/google-reviews/photo. Google's media endpoint requires the API key as a query parameter, so pointing an image tag at it directly would publish the key. Instead our route performs the keyed lookup server-side and redirects your browser to the keyless CDN URL Google returns. Your browser then loads the image from Google, exactly as it would any other Google-hosted image.

To avoid paying for identical lookups on every keystroke, resolved business details are held in the server's memory for up to an hour and search suggestions for five minutes. This is a cache of public business data keyed by the search term, not a record of who searched for what, and it is lost when the server process ends.

Google's own terms and privacy policy govern what Google does with these requests. If you publish the resulting widget, the embed loads a script from zyff.io and requests live review data when your page renders, which means visitors to your site send requests to Zyff's servers and to Google's image CDN. Describe that in your own site's privacy notice.

Zyff writes one value to your browser's localStorage: a key named zyff-theme holding either light or dark. It is set only when you use the theme toggle, and a small inline script reads it before the page paints so your chosen theme is applied without a flash of the wrong colors.

This is local state, not tracking. It is not a cookie, it is never sent to our server, it contains no identifier, and no other website can read it. Clearing site data for zyff.io removes it, and the site then falls back to whatever light or dark preference your operating system reports.

Zyff sets no cookies. There is no consent banner because nothing on the site stores or reads information on your device for advertising or measurement, and the one localStorage value described above is a preference you set yourself.

Web fonts are self-hosted. The three typefaces Zyff uses are downloaded at build time and served from zyff.io, so loading a page makes no request to Google's font servers. There are no third-party CDNs, chat widgets, embedded videos or social buttons on the site.

That leaves a short and complete list of companies that can receive data as a result of your visit:

For visitors in the EEA, the UK and Switzerland, the GDPR and UK GDPR require us to identify a legal basis for each purpose. Ours are straightforward:

Retention follows from the design. Uploaded files are not retained at all. Email you send us is kept only as long as needed to handle your request and any follow-up. Analytics data is aggregated and held by our provider for their standard measurement window. Operational logs are kept by our hosting provider for a limited period for security and troubleshooting.

Zyff is hosted on Vercel, whose infrastructure processes requests in the United States and other countries. Google may process Places API requests in the United States and other countries. Where a transfer safeguard is required for data leaving the EEA or the UK, we rely on the mechanisms our providers make available, such as standard contractual clauses and applicable transfer frameworks.

If you are in the EEA, the UK or Switzerland, you have the right to access your personal data, to have it corrected or erased, to restrict or object to processing, to data portability, to withdraw consent where consent is the basis, and to lodge a complaint with your supervisory authority (in the UK, the Information Commissioner's Office).

If you are a California resident, the CCPA as amended by the CPRA gives you the right to know the categories and specific pieces of personal information collected, to delete it, to correct it, to opt out of its sale or sharing for cross-context behavioral advertising, to limit the use of sensitive personal information, and not to be discriminated against for exercising any of these rights. You may use an authorized agent. Zyff does not sell or share personal information, does not collect sensitive personal information, and offers no financial incentives for data, so those particular opt-outs have nothing to act on. If that ever changes, this page will change with it and a mechanism will be added.

There is an honest limitation worth stating plainly: because Zyff has no accounts and does not store uploads, we usually hold no record that is tied to you and therefore nothing to produce, correct or delete. What can realistically be acted on is any email correspondence you have sent us, and request-level data held by our providers where it can actually be traced to you.

In the twelve months before the date at the top of this page, the categories involved have been internet and network activity (pages viewed, referring source, approximate country, device and browser type), device and connection identifiers such as IP address and user agent processed by our hosting and analytics providers, and the contents of any email you chose to send us. Nothing else.

To exercise a right, email info@esplanda.com and describe what you want. We aim to respond within 30 days, and within the 45 days the CCPA allows, extendable by a further 45 days where the request is complex. We may ask for information needed to confirm the request relates to you, and we will not use that information for anything else.

Zyff is a general-audience utility site and is not directed to children. We do not knowingly collect personal information from children under 13, or from anyone under 16 in the EEA and the UK. There are no accounts to create, no profiles to build and no advertising to target, so the site offers nothing that would collect data from a child in the first place.

If you are a parent or guardian and you believe a child has sent us personal information, most likely by emailing us, write to info@esplanda.com and we will delete it.

When this policy changes, the updated version is posted on this page and the effective date at the top is revised. Material changes will be summarized here rather than slipped in quietly. Because Zyff has no accounts, there is no mailing list to notify you through, so the effective date is the record of when the terms of this policy last moved.

Privacy questions, data requests, security reports and anything else go to the same inbox: info@esplanda.com. Include enough detail that we can act on it without a round trip.