Security starts by collecting less.
KOB Tech Tools is built around a simple principle: whenever a task can be completed on your device, your files and data should not need to be sent to us at all.
What the “Local” badge means.
When a KOB Tech Tool is marked Local, the tool is designed to perform its primary processing directly in your browser or on your device.
You select a file or enter data.
The browser receives the file or text you intentionally provide to the tool.
Your device performs the work.
JavaScript, Web APIs, Web Workers, or WebAssembly can process the data locally.
The result is returned to you.
Your browser prepares the result for copying, saving, or downloading.
KOB Tech does not need the content.
Local processing removes the need to upload the underlying tool content to our systems.
It is an architectural decision intended to reduce the amount of sensitive data KOB Tech, LLC ever receives in the first place.
Keep tool content separate from account systems.
KOB Tech Tools is designed so different parts of the service have different jobs and do not automatically receive access to the content you process.
Designed to reduce unnecessary exposure.
Data minimization
Collect only the information reasonably needed to operate accounts, purchases, subscriptions, support, security, and the website itself.
Least necessary access
Tool content should not be accessible to systems that do not need it, including analytics, billing, email, and account systems.
Clear processing boundaries
Each tool should identify whether processing is local or requires temporary server infrastructure.
Secure transport
Where information must travel between your browser and a service provider, encrypted web connections should be used.
Controlled account access
Authentication and database access should be restricted using appropriate application controls, including Supabase Row Level Security where applicable.
Minimal telemetry
Operational analytics should measure how the service performs without requiring the contents of the data processed by local tools.
Temporary processing should stay temporary.
Some future tools may require server-side processing because the task cannot reasonably be completed in a browser or requires specialized infrastructure.
If that happens, the tool should clearly identify the processing mode before the user submits content.
Encrypted transfer between the user and processing service.
Only the minimum content required for the requested operation.
No intentional long-term storage of uploaded tool content.
Deletion of inputs and generated outputs after processing completes.
Automated cleanup safeguards for failed or interrupted jobs.
Tool-specific disclosures when additional processing details matter.
What each service is responsible for.
Authentication and access
Supabase supports account authentication, profiles, product entitlements, subscription state, and application data needed for access control.
Local tool content is not intended to be stored there.
Payment information
Stripe handles payment and billing information for paid products and subscriptions so KOB Tech does not need to directly store full payment card details.
Email delivery
Brevo may deliver login, OTP, account, billing, and other transactional messages. Tool content should not be included in those messages unless the user intentionally sends it through a support workflow.
Authentication and analytics
Google may support sign-in and site analytics. Analytics are intended to measure site usage and performance, not the contents processed by local tools.
Found a security issue?
If you believe you have discovered a vulnerability or security weakness in KOB Tech Tools, please contact KOB Tech, LLC so we can review it.
Please provide enough detail to reproduce the issue while avoiding unnecessary access to other users’ data, destructive testing, service disruption, or public disclosure before we have had a reasonable opportunity to investigate.
- A description of the issue
- Steps to reproduce it
- The affected page, tool, or endpoint
- Potential impact
- Any relevant screenshots or technical details
Powerful tools. Private by design.
The safest sensitive data is often the data a service never receives.