1. How your images are handled
When you choose a photo or signature, the file is read by your browser and drawn onto an HTML canvas. Resizing, cropping, background clean-up, compression and the name-and-date stamp all run as JavaScript on your own device. The finished file is handed back to you as a download generated locally.
At no point is the image transmitted. There is no upload endpoint, because there is no server that would receive one. If you disconnect from the internet after the page has loaded, every part of the tool still works.
2. This is enforced, not just promised
Any site can claim it does not upload your files. This one ships a
Content
Security Policy containing connect-src 'none'.
That directive instructs your browser to refuse every outbound network request this page might
attempt — fetch, XMLHttpRequest, WebSockets and analytics beacons alike.
The restriction is applied by the browser, not by us, so it holds even if our code were changed or
compromised. You can confirm it yourself: open your browser's developer tools, look at the response
headers for this page, and read the policy.
If we ever add anything that genuinely needs to talk to a server, that header has to change first — and a changed header is visible to anyone who looks.
3. The Share button is the one exception
On phones, the result screen offers a Share button alongside Download. Tapping it opens your operating system's own share sheet and hands the finished file to whichever app you then pick — WhatsApp, Gmail, Files, and so on.
That is a deliberate act of sending your photo somewhere, so it is worth being precise: the file still never passes through us or through this page's network connection. The handover happens between your browser and your operating system. But once you choose a destination, your image is in that app's hands and subject to its privacy policy, not ours.
Nothing is shared unless you tap the button and then choose a target. If your browser does not support the feature, the button is simply not shown.
4. What we do not collect
- No name, email address, phone number or postal address.
- No images, signatures or documents.
- No account, because there is nothing to sign in to.
- No payment details, because nothing is for sale.
- No advertising identifiers, tracking pixels or cross-site tracking.
5. Analytics
There are none. Not Google Analytics, not a privacy-focused alternative, not a self-hosted counter. We do not know how many people use this site or which pages they open.
This is a real trade-off rather than a boast: it means we cannot see which exam pages matter most or notice when something breaks. If that changes, this section will be updated and the Content Security Policy will have to be relaxed to allow it — both of which are publicly visible.
6. Cookies and browser storage
We set no cookies at all.
We use localStorage for exactly two things, and neither is written unless you
take the action that causes it:
rx-lang— the language you chose, so the site does not reset to English on every visit. Written only if you use the language switch.rx-signatures— signatures you drew on the signature pad and chose to keep, so you do not have to redraw one for every exam. Written only if you press Save for later.
Both live in your browser on that one device. Neither is attached to any network request, neither can be read by another website, and we cannot see either of them. Saved signatures can be deleted individually from the pad, and clearing your browsing data removes everything. On a shared computer, delete saved signatures before you leave — or do not save them at all. Full detail is on the cookie policy page.
7. Server logs
These pages are static files served by Firebase Hosting, a Google service. Like every web server, it records ordinary request logs — typically your IP address, the time, the page requested, and your browser's user agent string. This is a routine part of serving a website and applies to the HTML, CSS and image files themselves. It has nothing to do with your photo, which is never part of any request.
We do not combine these logs with anything else, and we do not attempt to identify anyone from them. The retention period is set by the hosting provider under their own privacy policy.
8. Links to other websites
Each exam page links to the recruitment authority that publishes the rule — SSC, UPSC, IBPS and so on — so you can check the specification against the source. Following one takes you to a site we do not control and whose privacy practices are its own. We receive nothing when you click, and we have no commercial relationship with any of them.
9. Children
The tool is aimed at candidates applying for examinations and is not directed at young children. Since we collect no personal information from anyone, we hold none belonging to a child either.
10. Your rights
Data-protection law gives you rights to access, correct and erase personal data held about you. We are in the unusual position of having essentially nothing to hand over: no account, no stored files, no profile. If you believe we hold something about you, write to us and we will look and tell you honestly what we find.
11. Changes
If this policy changes materially, the date at the top of the page changes with it. There is no mailing list to notify, so the date is the honest signal to watch.
12. Contact
Questions about any of this go to hello@pixfit.in, or see the contact page.