Privacy policy

Your data stays on your device

Every Kortex tool runs in your browser, with or without an account. The values you enter and the files you process are never sent to a server: they never leave your device.

The same goes for the video editor: your videos, images and music are read, edited and encoded locally, then the MP4 file is downloaded straight from your browser. Nothing is kept: closing the tab erases the project. The libraries it needs (including the fallback AAC encoder) are files served by the site, never an outside service.

Automatic subtitles work the same way: speech is transcribed by your browser, and neither your video, nor its sound, nor the resulting text is sent anywhere. Only the speech recognition engine is downloaded, once: the Whisper model from Hugging Face (huggingface.co) and, with WebGPU, the ONNX Runtime engine from jsDelivr (cdn.jsdelivr.net). Like any website you visit, these services therefore receive your device's IP address during that download, but never your files or your text. The engine is checked against its fingerprint before use.

The photo editor edits your images in your browser: neither the images, nor their names, nor the text of your layers is sent, and nothing is kept once the tab is closed. The resume builder creates the PDF on your device, with fonts and programs served by the site. The QR code generator creates static codes, with no redirect link and no scan tracking. The hashing tools compute fingerprints, and test any password lists, on your device.

The QR code reader only uses the camera after you allow it in your browser: the image is analyzed live on your device, never recorded or transmitted, and the camera is turned off as soon as the code is read or you leave the page.

AI assistant (optional)

The assistant runs entirely in your browser: your requests, your files, the results and the conversation are never sent, and the conversation is not saved (it disappears when you close the page). The model only receives the text of your request and the name, type and size of your files, never their content. Nothing is downloaded before you click “Activer l’assistant” (activate the assistant, French interface): the language model then comes, once, from Hugging Face (huggingface.co) and its WebGPU library from jsDelivr (cdn.jsdelivr.net), which, like any website, receive your device's IP address, but never your data. If your browser has its own built-in AI (Chrome), it is used instead and nothing is downloaded by the site. Audience statistics only count the activation of the assistant and the identifier of the tool it runs, never the text of a request.

Kortex account (optional)

Every tool works without an account. If you create one, we keep your first name or nickname, your email address, a fingerprint of your password (PBKDF2; the password itself is never stored), the date the account was created and, for each open session, the browser used and the date of last activity.

For your favorites and statistics, when you are signed in, we record the tool used, the day and a few measurements: number and size of converted files, length of an exported video or a transcribed recording. Your entries, your files, their names and their content are never transmitted: they are processed on your device, with or without an account.

This data is only used to run your account (legal basis: performance of the service you request). It is hosted by Cloudflare (D1 database) and is never sold, shared or used for advertising. Confirmation and password reset emails are sent by our provider Resend, which only receives your email address and the content of that message.

It is kept for as long as your account exists. From your account settings you can, at any time, change your name, download all your data (JSON file), close your sessions and permanently delete your account: everything is then erased immediately. You also have the right to lodge a complaint with the CNIL, the French data protection authority, or with the authority of your country.

Audience statistics

We measure traffic with Umami, a privacy-friendly tool: no cookie is set, no personal data is collected and visitors are not tracked from one site to another. Only aggregated statistics (page views, referrers, device type) are kept.

Local storage

If you choose light or dark mode, your choice is remembered in your browser's local storage (key kortex-theme). It is never transmitted and you can clear it at any time from your browser settings.

The subtitle tool saves your work in progress (subtitle text and timings, file name, never the video or the sound) in your browser's local database (IndexedDB, database kortex-sous-titres, ten projects at most) so that you can pick it up again. Downloaded speech recognition models are kept in your browser cache (cachestransformers-cache and kortex-onnxruntime-…) so that they are not downloaded again. None of this is transmitted; you can clear it from your browser settings (site data).

The resume builder saves your resumes, cover letters, photos and settings in your browser's local database (IndexedDB, database kortex-cv on cv.kortex.site) so that you can find them without an account. Nothing is transmitted; the “Effacer toutes mes données” button (delete all my data) in “Mes CV” erases everything.

The assistant's model is kept in your browser cache (caches webllm/model,webllm/config and webllm/wasm on assistant.kortex.site); the site asks for persistent storage so that it is not cleared. The “Supprimer le modèle de cet appareil” button (remove the model from this device), in the assistant settings, frees up this space.

Cookies and advertising

Without an account, no cookie is set. If you sign in, two strictly necessary cookies are set on kortex.site and its subdomains, for 30 days renewed with use: kortex_session(session token, not accessible to page scripts) and kortex_account (only indicates that a session is open). They are removed when you sign out. No advertising is shown at this time.

Contact

[TO BE COMPLETED: contact email address for any question about your data.]