Privacy Policy

Last updated: August 16, 2026

Scope.This covers three things: the six Talos Tools desktop applications, this store at tools.talos-group.com, and the account you use to re-download what you bought. It doesn't cover other Talos Group properties, which have their own policies.

Almost nothing is collected by the apps, and essentially everything collected belongs to the store. It's worth reading those as two separate stories, so that's how this is written.

Architecture over policy

A privacy policy is a promise. Architecture is a fact. Here's how the apps are actually built:

The apps: what happens to your files

Your photos, notes, passwords and documents are opened, processed and saved entirely on your computer. They are never uploaded, because there's nowhere to upload them to — we run no server that receives user content of any kind.

This is enforced rather than promised. Each app ships with a Content-Security-Policy that blocks outbound requests, carried inside the application's own HTML, and every build runs an automated test that performs a real conversion and asserts no network request was made. If someone slipped a tracker into a dependency tomorrow, the policy would block it and the test would fail.

Two honest qualifications, because “zero” is a strong word:

• The policy is delivered as a meta tag in each page rather than as an HTTP header, because these are local files with no web server in front of them. That is the strongest mechanism available in this architecture, and it is not identical to a server-set header.
• Three of the tools — the HEIC converter, the Image Compressor and the JSON Formatter — do their heavy work in a background worker. The page-level policy governs the page; a worker is a separate context. Those three are covered by the same automated no-network test, which watches the whole application rather than just the page.

You do not have to take any of this on faith, and we'd rather you didn't. Disconnect from the internet entirely, then use the tool. Everything still works.

The one request an app can make

Each app has a Check for updates button. It runs only when you press it. Nothing checks on its own, on launch or otherwise.

When you press it, the app fetches a small file from this site. That request:

• tells our host your IP address, which is unavoidable for any request to any server, and which tool you're using (because each tool has its own file);
• does not send your version number, your operating system, a device identifier, or anything else. The file is the same for everyone. Your version is compared against it on your device.

If you never press the button, an installed app makes no network request at all.

What each app stores on your machine

Five of the six store nothing. No settings file, no history, no recent-files list — close the window and there is nothing left behind. Files you convert or compress are handed straight to your browser or system save dialog and go wherever you put them.

Secure Notepadis the exception, because it has to be. It keeps one file in your operating system's application-data folder. Everything inside it — note titles as well as bodies — is encrypted with AES-256-GCM under a key derived from your passphrase using PBKDF2-SHA256 at 600,000 iterations, with a fresh salt and initialisation vector on every save. Your passphrase is never stored anywhere, in any form. That means if you forget it, the notes are unrecoverable — by you, by us, by anyone. That is the design, not a limitation of it.

Visiting this store

This site sets no cookies, runs no analytics, and embeds no third-party scripts, trackers, fonts or pixels. There is no consent banner because there is nothing to consent to.

It is served by AWS Amplify. Like any web host, their infrastructure processes the requests needed to deliver pages to you, which necessarily involves your IP address. We don't operate analytics on top of that and we don't build profiles from it.

Buying, and your account

To sell you something we need an email address, so you can get back to your downloads, and a record of what you bought.

Payment is processed by Stripe. Your card number never touches our systems — we receive confirmation that a payment succeeded and the last four digits, and that is all. Stripe handles your payment data under its own privacy policy.

We keep purchase records as long as we need them for tax and accounting purposes. We do not sell, rent or share your email with anyone, and we won't send you marketing you didn't ask for.

Service providers

• Stripe — payment processing and tax calculation.
• AWS — hosting for this site and for downloads.

That is the complete list.

Your choices

Ask us what we hold about you and we'll tell you. Ask us to delete it and we will, except where we're required to keep purchase records for tax. Deleting your account ends re-download access and does nothing to the software already installed on your machine.

Children

These are tools for adults and we don't knowingly sell to anyone under 13 or collect anything from them.

Changes

If this policy changes, we revise the date at the top. If a change materially affects what the software does with your data, we'll say so on this site rather than quietly editing the page.

Contact

support@talos-group.com. We read every message.