Privacy Policy

TinyPixel is operated by Hexashield Ltd., a company federally incorporated in Canada (“Hexashield”, “we”, “us”). You can reach us through our contact form.

This Policy explains what happens to your information when you visit https://tinypixel.app or use the tools on it. By using the Service, you agree to this Policy. If you don’t agree, please don’t use it.

Our tools run entirely in your browser. When you convert, compress, resize, crop, rotate, flip, or otherwise process a file, the file is handled on your device by the browser itself. It is not uploaded to our servers. We don’t see it, don’t store it, don’t log its name, size, or content, and don’t use it to train any machine-learning model.

Once you load a tool page, it works offline. You can disconnect from the internet and the tool will still run.

On the free tools, we collect almost nothing directly. The only time you actively send us information is through the contact form, which asks for:

• Your name (optional)
• Your email address
• The message you write

Contact-form submissions are delivered straight to our mailbox. We don’t store them in a database. We keep the resulting email for as long as we need to respond and to maintain a record of the conversation, then delete it.

Our hosting provider automatically processes basic request data (such as your IP address and browser type) at the network edge in order to serve traffic, block abuse, and protect the Service. That’s standard hosting telemetry, not personal information we collect for our own use.

To be explicit, we do not collect or store:

• The content of any file you process with our tools
• The names, sizes, or types of those files
• Hashes, thumbnails, or anything derived from those files
• Account data (we don’t have accounts)
• Cross-site browsing history or device fingerprints

Some pages load scripts from third-party providers. When that happens, those providers receive data directly from your browser and handle it under their own privacy policies, not ours. The providers we use are:

Cloudflare

Hosting, content delivery, cookieless web analytics (aggregate page views, no per-user tracking), Turnstile (a privacy-friendly alternative to CAPTCHA, used on the contact form), and email delivery for the contact form. Privacy policy →

Google Tag Manager

Loads and orchestrates the Google services below (Analytics, AdSense). Tag Manager itself doesn’t set tracking cookies, but it’s the entry point that the cookie banner controls. Privacy policy →

Google Analytics 4

Helps us understand aggregate site usage. Sets cookies. Only loads after you accept analytics cookies in the banner. Privacy policy →

Google AdSense

Serves advertising on some pages. Sets cookies. Only loads after you accept advertising cookies in the banner. Privacy policy →

Cookiebot (Cybot A/S)

Powers the cookie consent banner you see on first visit. Records your consent choice (accept / decline / per-category selection) so we don’t ask again. Operates on a first-party Cookiebot cookie that stores your decision. Privacy policy →

On your first visit you’ll see a cookie banner powered by Cookiebot. Until you make a choice, we keep all tracking cookies disabled by default — this is implemented through Google’s “Consent Mode v2”, which means Google’s own tags (Analytics, AdSense) load in a consent-aware mode and won’t set cookies or send personally-identifying data until you accept.

Because we don’t hold accounts or stored personal data beyond contact-form emails, most rights requests come down to: ask us to delete an email you sent us, or ask what we have on file. You can do either by submitting a request through our contact form.

We’re based in Canada, but the third-party services above are operated globally and may process information in the United States or other countries. Where required, those providers rely on standard contractual clauses or equivalent transfer mechanisms.

Traffic to and from the Service is encrypted with HTTPS. We use DDoS protection at the network edge and bot-protection on the contact form to limit automated abuse. No internet-based service can be guaranteed 100% secure, but we work to keep the surface area of the Service small. The less data we hold, the less there is to protect.

The Service is not directed at children under 16, and we don’t knowingly collect personal information from anyone under 16. If you believe a child has sent us information through the contact form, please let us know via our contact formand we’ll delete it.

If we update this Policy we’ll post the new version here with a revised “Last updated” date. For significant changes we’ll surface a notice on the site before they take effect. Continued use of the Service after a change is posted means you accept the updated Policy.

Questions about this Policy? Reach out through our contact form.