zirzibit
← Back to zirzibit

LEGAL

Privacy Policy

Last updated: October 7, 2026

1. Scope

This page describes the privacy practices shared across every tool under the zirzibit umbrella (EXIF Scanner, URL Cleaner++, Image Share, Visit Certificate, and others added later). If a tool has additional, tool-specific data handling details (for example, uploading an image file), those details are stated separately on that tool's own page or interface.

2. Data Controller

zirzibit is responsible for applying this policy. You can reach us with questions at privacy@zirzibit.com.

3. General Principles

  • No zirzibit tool requires you to create an account to use it.
  • zirzibit tools do not use any analytics tool that builds a behavioral profile. The homepage and some tools (EXIF Scanner, URL Cleaner++, Visit Certificate) use a Google Ads tag for conversion measurement and cookieless Cloudflare Web Analytics for visit counts and page speed.
  • A tool never sends data to a server unless strictly necessary to do its job; many tools run entirely in your browser.
  • URL Cleaner++ cleans links in your browser, and the link is not sent to our server while doing so. The one exception is when you choose to open a short link such as bit.ly with the "Open short link and clean" button: only that short link is then sent to our server to find where it redirects, our server does not store or log it, and it connects only to known link-shortener sites. When URL Cleaner++ is opened for the first time from the Android Share menu, the shared link can reach our server inside the page address; our server does not store or log it.
  • A file uploaded to EXIF Scanner is deleted from public access 24 hours after upload (or earlier if it is deleted), then kept for up to 24 more hours in an admin-only area for review, and then permanently deleted.
  • If you use "Hide faces and license plates" in EXIF Scanner, the positions of the boxes you draw are sent to our server and applied to a copy of the file you uploaded for analysis. The redacted copy is deleted once it has been sent to you; the uploaded file follows the same retention as every upload, described above.
  • Image Share reads the location, camera and date in a photo you choose in your browser to warn you before upload. HEIC photos, and photos made smaller with "Make large photos smaller", are saved again in your browser; the link shows that new copy, which carries no EXIF, location or camera data. In that case the original file, with its metadata (location included), is also sent to our server and kept next to the upload: it is never shown through the link, only the site administrator can view it, and it is deleted together with the upload (after the time you chose runs out or you delete it, at the end of the 24-hour review window every deleted file has). Handing a file to or from EXIF Scanner happens between two tabs in your browser; our servers never send files to each other.
  • Visit Certificate keeps your province selection only in your browser's local storage (localStorage); it is not sent to our server until you create a certificate, and "Seçimleri temizle" (clear selections) on the page deletes it. The travel summary, badges and share card are computed in your browser.
  • If the person uploading to Image Share chooses an open limit for a link (view once, 5 or 25 opens), only that limit and a counter of how many times the link has been opened are stored with the file. No IP address, device information or other record of who opened the link is kept. The counter is deleted with the file. The browser of the person opening the link receives a signed ticket, valid for at most 15 minutes (2 hours for video), that is added to the file address so the page can load the file for that one open; it is not stored in a cookie or anywhere else. When the link is opened, the file address on that page carries a signed ticket valid for 15 minutes (2 hours for video); anyone given that exact address within that time can load the file without using an open (a password-protected link still asks for the password).
  • If you install Image Share or EXIF Scanner as an app on Android, photos and videos you share to it from your gallery are placed in your browser's temporary cache and are read from there and removed when the page opens. The files are not sent to the server until you start the upload or analysis.

4. Hosting Infrastructure

  • Cloudflare: used for content delivery, DNS, and security protection across every zirzibit tool; requests pass through Cloudflare.
  • Hetzner Online GmbH: hosts the servers the applications run on (Germany/EU).
  • Google Ads: visits to pages that carry the tag, and conversions inside tools (for example a completed analysis in EXIF Scanner), are reported to Google to measure ad conversions. Your files and their contents are never part of this reporting. Image Share runs no Google tag in the browser: if you arrived from a Google ad, only the ad click ID (gclid, or gbraid or wbraid on iOS) and its time are recorded on our server, without being linked to the image or video you upload, uploaded to Google Ads to measure conversions, and deleted after 90 days. Image Share also keeps daily counters that are not linked to anyone (number of uploads, the kind of site a visitor came from); no IP address or full address is stored. If you protect an Image Share file with a password, only a one-way scrypt hash of it is stored with the file, never the password itself, and it is deleted with the file.
  • Cloudflare Web Analytics: counts visits and measures page speed. The address of the page visited, the referring site, browser and device type, country and page load time are processed as aggregate statistics. It uses no cookies or browser storage and does not track you across sites.

Beyond these providers, your data is not shared with any other third party unless the tool you're using explicitly states otherwise.

5. Cookies

On pages that carry the Google Ads tag, Google Ads sets cookies for conversion measurement. Apart from that, no tracking or advertising cookies are used for visitors; Cloudflare Web Analytics uses no cookies. If a tool has an admin panel, it may use a mandatory session cookie for authentication purposes only, while logged in; this is stated separately on that tool's own page.

When you enter the right password for a password-protected Image Share file, a strictly necessary cookie is set in your browser. It only keeps that file open, carries nothing about who you are, is never sent to other sites (SameSite=Strict, HttpOnly) and expires after at most an hour or when the file expires. Because it is required for the service you asked for, it needs no consent; it is not set unless you open a protected file.

6. Your Rights

Under Turkish Law No. 6698 (KVKK) Art. 11 and, where applicable, the GDPR, you have the right to learn whether your data is processed, request information if it is, learn whether it's used consistently with its purpose, and request its correction or deletion. You can send requests to privacy@zirzibit.com.

7. Children's Privacy

zirzibit tools are not directed at children, and we do not knowingly collect data from users under 13.

8. Changes

This policy may be updated from time to time. Material changes will update the "last updated" date on this page.

9. Contact

For questions: privacy@zirzibit.com

This text is provided for general information and does not constitute legal advice.