Privacy & cookies
Last updated 2026. Written to be read, not to be skipped.
There are two separate things going on here, and it matters that they are not confused: the files you process, and your visit to the site. The first is never kept. The second is measured.
Your files are not stored. At all.
- Uploads are held in memory for the few seconds the tool takes, then dropped.
- Nothing is written to disk — no temporary directory, no queue, no cache.
- Filenames are never recorded, in logs or anywhere else.
- Document content is never logged, and never sent anywhere else.
- Results are returned directly in the response. There is no download link to leak, because there is no stored file to link to.
- The server keeps only the numbers that describe usage: which tool ran, how long it took, how many files, their total size, and the page count.
If a document is sensitive enough that even this makes you uneasy, the injection scanner is also available as a command line tool you can run entirely on your own machine.
Your visit is measured
This site is run by one person and paid for out of pocket, so knowing what people actually use is what keeps it worth maintaining. The following is collected on each visit:
| What | Why |
|---|---|
| IP address | Distinguishing real visitors from bots, and abuse handling |
| Approximate location (country, region, city) | Knowing where the audience is |
| Network provider | Separating consumer traffic from datacentre scrapers |
| Browser, operating system, device type | Deciding what to test against |
| Pages viewed, and buttons and links clicked | Seeing which tools are worth building on |
| Referring site | Knowing how people found the site |
| Which tool was run, and whether it succeeded | Finding failures that nobody reports |
| Time spent on the page | Telling a real read from a bounce |
Location is resolved by sending the IP address only to ip-api.com, once per unique address. Nothing else about you, and nothing about your files, is sent to them or to anyone else.
Cookies
Three, all first-party, all strictly for the above. No advertising cookies, no third-party trackers, no Google Analytics, no Facebook pixel, no cross-site profile.
bw_vid— a random identifier so repeat visits are not counted as new people. Expires after a year.bw_sid— groups one sitting into a session. Expires after 30 minutes of inactivity.bw_sid_t— the timestamp that makes the above expiry work.
These identifiers are random. They are not linked to a name, an email or an account, because there is no account to link them to.
What is never done
- Your files are not read, kept, analysed for advertising, or used to train anything.
- Nothing is sold or shared with data brokers.
- There are no third-party scripts on this site. Every asset is served from this server.
- No email address is asked for, so none can be leaked.
Your rights
An IP address counts as personal data under the UK and EU GDPR and under India's DPDP Act. You can ask for what is held about you to be sent to you or deleted — mail hello@brainyworks.in with the approximate date and time of your visit. Because no account exists, the IP address is the only way to find the records, so it has to be included in the request.
To opt out entirely, block cookies for this domain in your browser, or use the CLI version of the scanner. The tools work either way — nothing here is gated on tracking.
Retention
Analytics rows are kept while they are useful and are not passed to anyone. Uploaded files have no retention period because they are never retained in the first place.