How to evaluate privacy in an online file tool
Ask concrete questions about file transfers, account metadata, dependencies and outputs before handling sensitive material.
Draft prepared: 2026-10-02. Publisher: GXA Technologies. No named expert review is claimed. AI-assisted draft; human editorial review pending
Replace slogans with a data-flow question
Ask what data enters the tool, what computation occurs, what leaves the device and what is stored. “Private” without those boundaries gives little help when deciding whether a confidential document is appropriate.
A service can process file bytes locally while still recording an operation name, filename and status for account history. Those are different data types, but filenames alone can disclose sensitive context.
Read the active route, not only the homepage
A map-assisted photo tool, text formatter and image cutout editor need different resources. Permissions, external services and model downloads should be evaluated for the specific action you will perform.
GXA explains processing per tool and in its privacy policy. Some signed-in operations save metadata in account history. Do not infer that a claim about selected file bytes also excludes authentication, support, analytics or advertising requests.
Check what the result can disclose
An exported image may reveal location or other metadata. A cropped PDF can still contain underlying content outside its visible crop box. A black overlay is not evidence of secure redaction.
Before sharing, inspect both visible content and the properties relevant to the intended disclosure. Keep the original secure and use a purpose-built redaction workflow when actual removal is required.
Use an appropriate review standard
For workplace or regulated records, follow the organization’s approved tools and retention rules. If the site cannot explain a required boundary, do not submit the material merely to see what happens.
Use a non-sensitive fixture for troubleshooting and describe the problem through Contact Support. Feedback should identify the route and error without revealing a document, access token or another person’s private information.
Report an error in this information
Include the page address and the statement that needs checking. Do not send private files or credentials.