How we handle your data.

The short version

• Files you upload to a tool are processed in an isolated job and deleted within 24 hours, usually the moment you download the result. Nobody reads them and they are never used to train anything.
• We use Google Analytics 4 to count visits. It sets cookies. We do not sell data or build advertising profiles.
• There are no accounts. The only personal data we hold about you is what you send us by email.
• Everything runs on Amazon Web Services in the United States.
• You can ask us what we hold about you and ask us to delete it. Write to hello@content.win.

1. Who we are

content.win ("we", "us") operates the website at content.win and the services described in this policy. For anything to do with personal data, the contact is hello@content.win. We act as the data controller for the data described here.

2. What we collect, and why

2.1 Server logs. When your browser requests a page or a file, our hosting provider records the request in a standard access log: your IP address, the date and time, the URL requested, the referring page, and your browser's user-agent string. We use these logs to keep the site available, to detect abuse, and to debug errors. Legal basis: our legitimate interest in running a secure service. Retention: no longer than 30 days.

2.2 Analytics. We use Google Analytics 4, a service of Google LLC, to understand how many people visit, which pages they read, roughly where they are, and how they arrived. Google Analytics sets first-party cookies named _ga and _ga_* that hold a random identifier for your browser. IP addresses are not stored by Google Analytics 4; Google uses them only to derive a coarse location and then discards them. We have not enabled Google Signals, advertising features, or cross-device tracking. Legal basis: consent where the law requires it, otherwise our legitimate interest in understanding how the site is used. Retention: event-level data is kept in Google Analytics for no more than 14 months. You can opt out with the Google Analytics opt-out browser add-on, by blocking cookies for content.win, or by using a content blocker. Google's own handling of this data is described in Google's privacy policy.

2.3 Fonts. Pages load the Sora and Source Serif typefaces from Google Fonts. Your browser fetches the font files from Google's servers, which means Google receives your IP address and user-agent string for that request. Google states that it does not use Google Fonts requests for tracking or profiling.

2.4 Files you upload to the free tools. When you use a tool, the file you choose is uploaded directly from your browser to a private storage bucket over an encrypted connection, processed by an isolated job that runs only for that file, and the result is stored in the same bucket for you to download. We record the job's metadata: a random job identifier, the tool used, the settings you chose, the file's size and type, timestamps, and the IP address that started the job. We do not record the file's name beyond the job and we do not inspect its contents. Legal basis: performing the service you asked for. Retention: uploaded files and results are deleted automatically within 24 hours, and in most cases as soon as the download completes. Job metadata is kept for 30 days for abuse prevention and debugging, then deleted.

2.5 Email. If you write to us, we keep the conversation so we can answer and follow up. Legal basis: your request, and our legitimate interest in answering it. Retention: until you ask, or three years after the last message. We do not add you to a newsletter.

2.6 Accounts. There are no user accounts at the moment. If we introduce them, we will update this policy before they launch and describe exactly what an account stores.

3. What we do not do

• We do not sell personal data, and we have not sold it in the past twelve months.
• We do not share personal data with advertisers or data brokers.
• We do not use uploaded files to train machine-learning models, to build datasets, or for any purpose other than performing the operation you requested.
• No human reviews your files. The only exception is an investigation into abuse or a legal complaint, in which case access is limited to the people investigating and logged.
• We do not use fingerprinting or cross-site tracking.

4. Where data is processed

The site is hosted on Amazon Web Services (AWS) using Amplify Hosting, Amazon S3, and Amazon CloudFront. Free tools run on AWS Lambda with files held in Amazon S3. Our primary AWS region is US East (Ohio), so your data is processed in the United States. CloudFront serves cached copies of public pages from edge locations around the world; it does not cache your uploaded files. If you are in the United Kingdom, the European Economic Area, or Switzerland, this is an international transfer; it is covered by the AWS Data Processing Addendum, which incorporates the European Commission's Standard Contractual Clauses, and by Google's equivalent terms for Google Analytics.

5. Processors we use

• Amazon Web Services, Inc. Hosting, storage, compute, content delivery. AWS privacy notice.
• Google LLC. Google Analytics 4 and Google Fonts. Google privacy policy.
• Our email provider. Stores the messages you send to hello@content.win.

Each processor acts on our instructions under a written agreement. We will update this list if it changes.

6. How we protect data

• All traffic to content.win uses HTTPS with TLS 1.2 or later. Plain HTTP requests are redirected.
• Uploads go straight from your browser to storage using a short-lived, single-use signed URL. Our web servers never handle the file bytes.
• Files are encrypted at rest with AES-256 server-side encryption and are stored in a private bucket with no public access.
• Each processing job runs in its own isolated environment that is destroyed when the job ends. Jobs cannot see each other's files.
• Deletion is automatic and enforced by storage lifecycle rules, not by a manual process.
• Access to infrastructure is limited to the people who operate it, uses individual credentials with multi-factor authentication, and follows least privilege.

No system is perfectly secure. If we learn of a breach that affects your personal data, we will tell you and the relevant authority without undue delay, as the law requires.

7. Cookies

content.win sets no cookies of its own. Google Analytics sets the cookies listed in section 2.2. The site also uses your browser's local storage only if a page needs to remember a setting you chose, and that data never leaves your device. You can clear or block cookies in your browser settings; the site works without them.

8. Your rights

Depending on where you live, you may have the right to ask us to confirm whether we hold personal data about you; to receive a copy of it; to correct it; to delete it; to restrict or object to how we use it; to receive it in a portable format; and to withdraw consent where consent is the basis for processing. You also have the right to complain to your data protection authority. In the European Economic Area that is the authority in your country; in the United Kingdom it is the Information Commissioner's Office.

If you are a California resident, the California Consumer Privacy Act gives you the right to know what we collect, to delete it, to correct it, to opt out of sale or sharing (we do neither), and not to be discriminated against for exercising these rights. We do not respond to browser "Do Not Track" signals because there is no agreed standard for them, but we honor Global Privacy Control signals as an opt-out of sale or sharing, which is already our default.

To exercise any right, email hello@content.win. We will confirm your identity by replying to the address the data is associated with, and we answer within 30 days.

9. Children

content.win is not directed at children. We do not knowingly collect personal data from anyone under 16, or under 13 in the United States. If you believe a child has sent us personal data, email us and we will delete it.

10. Retention summary

• Uploaded files and tool results: deleted within 24 hours.
• Tool job metadata: 30 days.
• Server access logs: up to 30 days.
• Google Analytics event data: up to 14 months.
• Email correspondence: until you ask, or three years after the last message.

11. Changes to this policy

When we change this policy we update the effective date at the top. If a change materially reduces your rights or expands what we collect, we will say so on this page before it takes effect, and where we have your email address we will tell you directly.

12. Contact

Questions, requests, or complaints: hello@content.win. A person reads every message.