The short version
The safest file is one that never leaves your computer, so most Wrklyst tools are built to work entirely in your browser. Where a tool does need our server, this page says which one, what it receives, and how long anything is kept. We never look at or analyse the contents of your files.
Most tools never send us your file
Merge and compress PDF, PDF to Word and Excel, Word to PDF, protect and unlock, signing, watermarks, the PDF editor, the image tools, and the writing and developer tools all run in your browser. You can check: open your browser's developer tools, watch the Network tab, and use the tool — no request carries your file.
A few tools process on our server
Some PDF tools, such as Split PDF, upload your file over HTTPS to do the job. The upload is deleted as soon as it is processed, and the result is held only temporarily so you can download it. The QR code generator sends the text you encode so it can draw the code, and doesn't store it.
File Transfer is end-to-end encrypted
Files are encrypted in your browser with AES-256 before upload. The key travels in the link's # fragment, which browsers never send to a server, so the stored files are unreadable to us. Transfers are deleted after 72 hours.
Share links expire
When you share an edited PDF by link, that file is uploaded so the link has something to open. It is deleted after 24 hours, or sooner if you revoke the link while signed in. Nothing is uploaded unless you press Share.
What we do store
- Accounts. Sign-in is handled by Supabase Auth. Passwords are stored only as salted hashes, never in readable form. Ghost accounts hold no email address at all; their recovery code is shown once and kept only as a hash.
- API monitors. A saved monitor's request — URL, headers and body — is encrypted at rest with AES-256-GCM. This is not end-to-end encryption: our checker has to decrypt the request to send it. Monitors expire 30 days after their last management action, and check history is kept for 7 days.
- WishFlow. Your team roster is stored so messages can go out on the right day. Birthdays are kept as day and month only, never the year, and channel webhook URLs are encrypted at rest.
Infrastructure
Every connection uses HTTPS, and browsers are told to refuse plain HTTP (HSTS). The site is hosted on Vercel, accounts and data live in Supabase, and file transfers are stored in Cloudflare R2. Sign-in, sign-up and uploads are rate-limited, and the ghost-account sign-up and recovery forms use Cloudflare Turnstile to keep bots out.
Those providers maintain their own independent security audits, such as SOC 2. Wrklyst itself is run by one person and has not been through an independent audit or certification, so we don't claim one. How we handle personal data, and your rights under laws such as the GDPR, are set out in our Privacy Policy.
Reporting a vulnerability
Email [email protected] with the steps to reproduce the problem. Please don't access, change or keep other people's data while testing, and give us a reasonable chance to fix the issue before publishing it.