The short version
The PDF is read in your browser with PDF.js. It is never uploaded.
OCR runs in a Web Worker with Tesseract.js. The image is never uploaded.
The PDF stays local. Only the extracted text is sent for summarization.
The text you paste is sent for processing and is not written to a database.
What stays on your device
PDF to Markdown and Image to Text are fully client-side. The file you choose is read into browser memory; it is not sent over the network. You can load the page, disconnect from the internet, and both tools will still work. The OCR language model is downloaded once from this site and cached by your browser.
The PDF Summarizer also parses the PDF locally. The file itself never leaves your device. After extraction, the text is sent to our server so the summary can be generated.
The Image Alt Text tool previews images locally. In the default configuration, the image is not uploaded. If a vision model is configured for the site, the page will tell you and the image will be sent for analysis. Context you type is sent either way.
What is sent to a server
When you use a text-based tool, the text in the input box is sent to our server to produce the result. This applies to the Email Rewriter, Tone Changer, Text to Checklist, Meeting Action Items, Transcript to Action Items, Resume Bullet Rewriter, PDF Summarizer (extracted text only), and the context field of the Alt Text tool.
The text is processed in memory for that request. We do not write your drafts, documents, notes, or outputs to a database. If an external AI provider is configured, the text is sent to that provider solely to generate the response. That provider's terms and data-processing policy also apply, so do not paste secrets or regulated information.
Do not paste secrets, credentials, regulated health information, or anything you would not send to a third-party processor.
What we store
- Daily usage counter. To enforce the free AI limit, we store a one-way hash of your IP address, the UTC date, the tool name, and a count. The raw IP address is not stored in this table. Rows older than 14 days are deleted.
- Accounts. If you create an account, we store your email address, a salted password hash (never the password itself), your plan, the account creation date, and a hash of your session token. Sessions expire after 30 days. Email us to delete your account.
- Pro waitlist. If you join the waitlist, we store the email address you submit and the date. You can ask us to delete it at any time.
- Standard server logs. Our hosting provider may keep short-lived access logs (IP address, user agent, timestamp, requested URL) for security and abuse prevention. These are not used for advertising.
Cookies and analytics
AIbyNow does not set advertising or cross-site tracking cookies. We do not run Google Analytics by default. If Cloudflare Web Analytics is enabled, it is cookieless and aggregates page views without identifying individual visitors.
If you create an account, we set a first-party session cookie (`aibynow_session`, HttpOnly, SameSite=Lax, Secure on HTTPS) and a short-lived CSRF cookie for forms. They are required for sign-in and are not used for advertising.
Your browser may store the OCR language model and static assets in its HTTP cache. That is normal browser caching, not a tracking cookie.
Advertising
AIbyNow does not currently display third-party advertising. If ads are added to support the free tiers, this policy will be updated before they go live. Ad partners may then use cookies or similar technologies, and we will provide any consent controls required by law. We will not sell your tool inputs or account data to advertisers.
Service providers
We use a hosting provider to serve the site and may use an AI model provider to generate text results. If Pro billing opens, Stripe will process payment details; AIbyNow does not receive or store full card numbers. These providers process data on our instructions and under their own security terms.
Your choices
- Use the local tools without sending a file anywhere.
- Avoid pasting confidential text into AI-powered tools.
- Email us to delete your account or a waitlist address.
- Block JavaScript and the local tools will not run, but the guides remain readable.
If you are in the EEA or UK, you may have rights to access, correct, delete, or port personal data, and to object to processing. Contact us to exercise them. If you are in California, we do not sell personal information.
Contact
Privacy questions: hello@aibynow.com. We aim to reply within two business days.