Files you open on StartPrivate are read and processed by code running in your browser tab; the site has no server program or upload address to receive them. Like any website, the host sees the usual details of each page request, a cookieless Cloudflare analytics script counts page views, your language choice is kept in your browser, and the password strength page can send 5 characters of a hash to a breach list only if you tick that option.
Your files
When you choose a photo, video, document or any other file on this site, your browser hands it to the page's code inside the tab. Cleaning, covering, reading, hashing and encrypting all happen there. The results are created in the tab's memory and offered to you as downloads with addresses that start with blob:, which point to your own browser rather than to a server.
The site does not receive the files, their names or the results. It is made of static files (pages, scripts, styles, models) and has no server-side program, upload endpoint or database that could accept them. When you close or reload the tab, everything the page held in memory is dropped. Your original files on disk are never changed; you always get separate new copies.
The same applies to text you type: passwords you generate or test, notes you encrypt and checksums you paste stay on the page and are not saved.
What the host sees when you visit
The site is served by Cloudflare. As with any website, each time your browser asks for a page or a file, the request reaches Cloudflare's servers with your IP address, the address of the requested file, your browser's user-agent string and other standard headers, and sometimes the address of the page that linked you here. Cloudflare handles that request data under its own privacy policy. The site itself runs no code on those servers and receives no copy of your files through them.
Pages are sent with a Referrer-Policy: no-referrer header, so when you follow a link from this site to another one, your browser does not tell the other site which page you came from.
Analytics
Each page includes the Cloudflare Web Analytics script, which your browser fetches from static.cloudflareinsights.com. It reports page views and page-speed measurements, which appear to the site's editors as totals grouped by page, referring site, country, browser, operating system and device type. Cloudflare states that Web Analytics does not use cookies or local storage to collect these metrics and does not fingerprint visitors by IP address or user agent for analytics.
A report goes out as the page opens and another when you leave or hide it. These reports carry timing data about the page, not the contents of anything you opened. If you block the script with a content blocker, every tool still works.
Cookies and browser storage
The site sets no cookies.
- Language choice. When you open a page in another language or pick one from the language menu, your browser keeps that choice in its local storage under this site's address, so tools can keep showing their buttons in that language. It is a two-letter code and nothing else. Clearing site data in your browser removes it.
- Downloaded helpers. The text reader keeps a copy of its English language data in your browser's storage (IndexedDB) after the first use, so it does not need to download it again. Your browser's ordinary cache may also keep the site's files and models. These are copies of files from this site, not anything derived from your files.
- Installed app. If you install the site to your home screen or desktop, the browser can keep copies of the site's own files and the helpers you have used, so the tools open without a connection.
- Files shared from your phone. On Android, when you send photos or videos to the installed app from the share sheet, they are kept for a moment in your browser's storage on the phone (IndexedDB) until the cleaning page opens and takes them; the page then deletes that copy. If no page takes them (because you closed the app first, say), they are deleted the next time you open any page of the site, once they are ten minutes old, and are no longer offered to the tool. They are not sent to a server.
Files downloaded only when you ask
Some tools need large helpers. They come from this site, never from another server, and only when you press the button that needs them:
- Find faces: the TensorFlow.js WebAssembly engine and the YuNet face model, about 1 MB.
- Find text: the Tesseract OCR engine with English language data, and the ZXing barcode reader. The size is shown next to the button.
- Content Credentials viewer: a C2PA reader of about 8.6 MB, downloaded only after the page has checked that your file actually contains credentials.
- Office cleaning, password strength and passphrases: the fflate compression library, the zxcvbn-ts word lists and the EFF word list, loaded when those pages need them.
None of these requests include your files.
The optional breach check
The password strength page has one setting that sends data to another service: Check known data breaches. It is off when the page opens. If you tick it, your browser works out the password's SHA-1 hash locally and sends just the first 5 of its 40 characters to api.pwnedpasswords.com, the Pwned Passwords service run by Have I Been Pwned. The reply lists every breached hash that starts the same way, and your browser does the comparison. The password itself is never sent. Like any web request, that service sees your IP address and ordinary browser headers; the request carries no cookies and no referrer. It is the only page whose security policy permits a connection beyond this site and the analytics service, and that permission covers that single address.
Encrypted note links
A note link made on the encrypt text page keeps the encrypted note after the # in the address. Browsers do not send that part to the server, so this site receives only a request for the page. Anyone who has the whole link, including the app you send it through, can read a note that was made with a link-only key.
If you write to hello@startprivate.com, your message and address are used to answer you and are not added to any mailing list. Please do not attach personal files; a description of the problem is usually enough.
Children
The site has no accounts, no profiles and no forms for submitting personal information. It is not built to gather personal details from anyone, children included; the analytics described above work the same way for every visitor.
Changes
If the way the site handles information changes, this page changes first. The date it was last updated is shown at the bottom.
Sources
Checked 2026-10-11.
- Cloudflare Web Analytics: no client-side state such as cookies or local storage, and no fingerprinting by IP address or user agent.
- Cloudflare Web Analytics dimensions: country, path, referrer, browser, operating system and device type.
- Have I Been Pwned API v3: how the Pwned Passwords range search and response padding work.
Last updated: