Privacy is a product requirement.
The useful version of a tool is the one that completes the task without quietly creating a second business out of your data.
Keep work on the device when the browser can do it.
Many image, PDF, QR and password operations can run directly in a current browser. For those workflows, the page is designed so the input does not need to be uploaded merely to perform the operation.
Local processing also means the browser tab becomes part of the security boundary. Closing the tab or clearing site data can remove temporary browser-side state that a particular tool created.
Some jobs genuinely need a server.
Large conversions, OCR, selected PDF operations, encrypted sharing and other infrastructure-heavy tasks may require a server. When that boundary exists, the relevant tool should make it clear before the sensitive action occurs.
Infrastructure is not treated as the default merely because it is convenient for the operator.
Encrypted when stored.
Where a service needs to retain a sensitive payload, the design goal is encrypted storage rather than readable content at rest. Retention and lifecycle details can vary by tool, so tool-specific privacy information takes precedence over this general page.
External checks should be explicit.
A feature may occasionally call an external service because the service itself is the feature. A password breach lookup is one example: the Password Toolkit only performs that check when the user explicitly requests it, and the design uses k-anonymity rather than sending the complete password.
Never provide wallet secrets.
Ryo Tools may work with public RYO addresses, payment amounts, references or transaction identifiers where appropriate. It should never require your seed phrase, private spend key, private view key, wallet password or other secret wallet credentials simply to create a payment request or receipt.
Look for tool-specific disclosure.
Individual tools can have different data paths. The Privacy Receipt pattern exists to tell you whether a task stays local, whether anything is uploaded, whether an external service is contacted and what happens after processing.
