Security & Data Privacy

Security by architecture: this studio has no upload endpoint, no accounts and no document database — there is literally nothing stored on our servers to breach. Your files are processed only inside your own browser tab.

Policy Version: 1.0 • Last reviewed: October 24, 2026 • Applies to https://jobsfinder.xyz

1. Zero-Upload Architecture

Every tool in this studio — image compression, passport sheets, signature scanning, PDF merging, the age and date calculators, and the Image to PDF Converter — runs entirely in your browser using Web Workers, HTML5 Canvas and the bundled jsPDF library. Your photos, signatures and certificates are read into your device memory, processed there, and handed straight back to you. Because documents are never transmitted, they can never be intercepted, stored, or leaked from our side.

2. Transport Security (HTTPS & HSTS)

jobsfinder.xyz is served exclusively over HTTPS. Our Content-Security-Policy includes upgrade-insecure-requests, so even a manually typed http:// address is upgraded to a secure connection before anything loads. On Apache-compatible hosting we additionally send a Strict-Transport-Security (HSTS) header so browsers refuse to fall back to unencrypted connections on future visits. Always confirm the padlock icon in your address bar before processing sensitive documents on any website.

3. Strict Content-Security-Policy & Response Headers

A whitelist Content-Security-Policy blocks any script from unknown origins: all application code, styles, fonts and libraries are served from our own domain under /assets/, and the only external endpoints permitted are Google AdSense advertising servers. Additional response headers harden every page: X-Content-Type-Options: nosniff (blocks MIME confusion attacks), X-Frame-Options: SAMEORIGIN plus frame-ancestors (prevents clickjacking), Referrer-Policy: strict-origin-when-cross-origin (never leaks full page URLs to third parties), and a Permissions-Policy that disables camera, microphone, geolocation and payment APIs this site never needs.

4. No Accounts, No Passwords, Nothing to Leak

There is no sign-up, no login, and no password database. The contact form composes your message in your own email client — it never passes through our servers. The only data persisted in your browser are two harmless preference keys: your theme choice and your advertising-consent decision. You can erase both at any time by clearing site data.

5. Automatic Metadata (EXIF/GPS) Stripping

Smartphone photos embed EXIF metadata that can include GPS coordinates and device identifiers. Because every image is re-encoded on a canvas before export, that metadata is automatically removed from all processed outputs — an important safeguard when submitting identity documents to job portals and exam forms.

6. Advertising, Consent & Tracking Controls

Google Consent Mode v2 is the single source of truth for all advertising signals. Your first visit shows a consent banner; rejecting it blocks ad-personalization signals at the source, and you can change your decision at any time from the footer. We do not sell personal information and do not operate cross-site trackers of our own. Full details are in the Privacy Policy.

7. Report a Vulnerability

Found a security issue? Email support@jobsfinder.xyz with the subject line Security. We practice responsible disclosure: report summaries are acknowledged within 24–48 hours and fixes ship as new versioned releases. Please do not test against production ad endpoints — all local tool logic can be verified entirely in your own browser.