Skip to main content
All tools

Privacy Policy

OpsDrawer is a set of free tools that mostly do their work right in your browser. This page explains, in plain words, what that means for your information.

Last updated

In this policy, “OpsDrawer”, “we” and “us” mean the people who run opsdrawer.com. If anything here is unclear, or you want to use any of your rights below, send us a message — or use the Contact us button at the bottom right of most pages.

The short version

  • You don’t need an account. Most tools work on your files entirely in your browser — the files never reach us.
  • A few tools need our server or another service to do their job. They say so beside the input, and this page lists them.
  • We don’t store the files, documents, links or text you give the tools.
  • We count visits with DataFast, a privacy-friendly analytics service — if you’re in the UK, the EU or the EEA, only once you’ve said yes. We don’t run advertising and never sell your information.
  • If you write to us, with the contact form or the Contact us button, we keep your message for up to 12 months.

Tools that work on your device

These tools read, change and save your files inside your browser tab. Your files aren’t uploaded to OpsDrawer or anyone else, and nothing is stored once you close the tab:

  • Image Converter and Audio Converter
  • PDF Editor, PDF Watermarker, PDF Watermark Remover and PDF to Word Converter
  • Background Remover
  • Add Play Button to Image (unless you fetch a YouTube thumbnail — see below)
  • Doc to HTML Converter and Image Extractor, when you choose a file from your device (and the Doc to HTML Converter when you paste content into it)

Some of these download extra program files the first time you use them (for example the Background Remover’s AI model or the text recognition files). Those come from OpsDrawer itself, not from another service.

Tools that use our server

These tools need our server to fetch something your browser can’t reach by itself:

  • Google Docs links (Doc to HTML Converter, Image Extractor, Thumbnail Generator). Our server downloads the document from Google and passes it straight to your browser. It doesn’t keep the document or the link.
  • YouTube Video Downloader. Our server looks the video up on YouTube and passes the video’s data through to your browser as it arrives, without saving it. To stop download links being reused by others, each one only works for a short time and from the same network address that asked for it.
  • Thumbnail Generator. The text you give it — typed or pasted, read from a Word file in your browser, or fetched by our server from a Google Doc or web page — and the image prompts written from it are sent through our server to Replicate, the AI service that runs the models (some are made by other companies, such as Anthropic). The images come back the same way. OpsDrawer stores neither the text nor the images; Replicate says it deletes requests and results after about an hour. If you use your own Replicate key, it’s sent with each request and never stored or logged by us — unless you tick “Remember on this device”, which keeps it in your browser only.

When our server fetches something for you, Google, YouTube, Replicate or the website concerned see our server’s address, not yours.

Services your browser contacts directly

Some tools have your browser talk to another service itself. That service sees your network (IP) address and what your browser asks it for, under its own privacy policy:

  • YouTube — the YouTube Thumbnail Downloader and Add Play Button to Image load a video’s thumbnail from YouTube’s image server, and the YouTube Video Downloader shows it. The YouTube Embed Generator’s preview plays the video from YouTube’s privacy-enhanced domain (youtube-nocookie.com) unless you switch that off.
  • Wistia — the Wistia Video Downloader reads a video’s details from Wistia, and its download links fetch the files straight from Wistia. Our server never sees them.

Analytics

We use DataFast to count visits and see which pages and tools people use, so we know what to improve. Its script tells DataFast about each page view — such as the page’s address, the page that linked to it, and your browser and device type — and DataFast sees your network address, from which it can work out a rough location. It also counts two things done on a page, both Halloween’s: when you squash one of its spiders, it’s told that one was squashed and which (the one by the logo, one at the side, Drew’s, one that came after, or one crawling about), and when you squash one of its pumpkins, only that one was — each along with the same details about the page and your browser as a page view — nothing more. It sets cookies to recognise a returning visitor (listed below). We don’t use it, or anything else, for advertising, and the tools don’t send it what you put into them.

If you visit from the UK, the European Union or the rest of the European Economic Area — or we can’t tell where you are — we ask first: a banner at the bottom of the page offers Accept and Reject, and DataFast isn’t loaded at all unless you accept. Visitors from elsewhere are counted without a banner. To tell which applies, our server reads the country Cloudflare works out from your network address; it’s used for that decision only and not stored.

You can change your answer at any time with Cookie settings at the bottom of any page (shown wherever we ask). Rejecting after accepting deletes DataFast’s cookies from your browser and reloads the page without it. Wherever you are, you can also block or delete cookies in your browser’s settings.

Cookies and storage on your device

OpsDrawer itself sets at most two cookies, both needed for what you asked for:

  • od_session — only when someone signs in with a staff or admin password, to keep them signed in. It says only whether you’re staff or an admin and when it runs out (12 hours by default); there’s no name or other identity in it. It can’t be read by the page’s scripts, is sent only over a secure connection, and is deleted when you sign out.
  • od_consent — only if we ask about analytics: it remembers your answer (just “analytics” or “none”) so we don’t ask on every page. It lasts 6 months, then we ask again.

If you accept analytics, or aren’t asked, DataFast’s script sets these cookies for opsdrawer.com. They hold random identifiers, a date and a count — not your name or anything you typed:

  • datafast_visitor_id — a random ID that recognises your browser when you come back; kept for 1 year.
  • datafast_visitor_first_seen_at — when that browser first visited; kept for 1 year.
  • datafast_visitor_session_count — how many visits it has made; kept for 1 year.
  • datafast_session_id — a random ID for the current visit; kept for 30 minutes.

It also keeps the last page it counted in your browser’s session storage (datafast_pageview_state, gone when you close the tab), so a quick reload isn’t counted twice, and checks local storage for a datafast_ignore setting, which it never writes.

Cloudflare may set its own short-lived security cookies, such as __cf_bm, when its protection against bots is switched on. They help tell people from automated traffic and aren’t used to track you.

The site also remembers a few choices in your browser’s local storage, which never leaves your device unless you send it:

  • whether you picked the light or dark theme, and which sections of the front page you closed;
  • some tools’ settings, so they open the way you left them — these can include text you typed into a setting, such as a PDF watermark’s words or a file-name prefix, but never your files, documents or links;
  • your own Replicate key, only if you ticked “Remember on this device” in the Thumbnail Generator.

You can clear all of this at any time in your browser’s settings (site data for opsdrawer.com). The tools still work; they just forget your choices.

When you contact us

The contact form, and the same form behind the Contact us button at the bottom right of most pages, asks for your email address, your message and, if you like, your name. We store exactly that, with the time you sent it, in OpsDrawer’s database — not your network address, the page you sent it from or any other detail of your browser. Until you send it, what you type in the Contact us button’s form stays only in the open page; it isn’t saved in your browser. Only OpsDrawer’s admins can read messages. We use them to read and answer you, never for marketing, and we don’t share them. Each message is deleted 12 months after it arrives, or sooner when we’ve dealt with it. Your network address is used for a short while, only in the server’s memory, to stop the form being flooded.

Logs, limits and security

To keep the site working and stop abuse:

  • Our server, and the services in front of it, may record standard technical logs of requests — your network address, the page asked for, the time and your browser type — to find faults and deal with attacks. Error logs can include the website address (the domain only) of a web page the Thumbnail Generator couldn’t fetch.
  • When a sign-in fails, we store the network address it came from and the time, to slow down password guessing. They’re cleared when a sign-in from that address succeeds, and nothing older than a day is kept once the next failed sign-in is recorded.
  • Tools that do work on our server limit how often each network address can use them. Those counts are kept in the server’s memory only and disappear when it restarts. The Thumbnail Generator’s daily image allowance is counted under a scrambled, one-way code made from your network address (never the address itself), kept for 14 days.

Where OpsDrawer runs

OpsDrawer runs on our own server, where the information described on this page is kept. Every request to the site first passes through Cloudflare, a network that protects and speeds up websites, which processes your network address and the details of your request to deliver the page and block attacks, under its own privacy policy.

Who we share information with

We don’t sell your information or share it for advertising. It only reaches the services named on this page — Cloudflare, DataFast, Replicate, Google, YouTube and Wistia — and only as described above, when you use the feature concerned. We would disclose information if the law required us to.

Your rights

Depending on where you live (for example under the GDPR in the EU and UK), you can ask us for a copy of the information we hold about you, to correct it, to delete it, or to stop using it. Because OpsDrawer has no user accounts, the only things we could hold that are about you are a contact message, and for a short while the logs and counts above. Send us a message (or use the Contact us button) from the same email address and tell us what you’d like; we’ll answer within a month. You can also complain to your local data protection authority.

Children

OpsDrawer is made for people at work and isn’t aimed at children. Please don’t send us a message if you’re under 16. If you think a child has sent us information, tell us and we’ll delete it.

Changes to this policy

When OpsDrawer changes how it handles information, we update this page and the date at the top. If a change is significant, we’ll say so here before it takes effect.

Contact

Questions about this policy or your information? Use the contact form or the Contact us button.

Contact usPrivacy Policy · OpsDrawer