Security
In short
On LUNYCE, your files are not uploaded. They are processed by your browser, on your device. So there is nothing to intercept during an upload, no document stored on a server, and no account to hack.
What happens when you use a tool
- The page and the tool engine are loaded from lunyce.com, like any web page.
- Your file is read in your browser's memory. It goes nowhere.
- The result is created on your device, then you download it.
- When you close the page, everything disappears. One exception: with "Continue with…", the file is kept for a few moments in your browser to open it in the next tool, then deleted.
The difference with sites that upload your files
Most online PDF services process documents on their servers: the file is uploaded, kept while it is processed, then deleted after a delay. With LUNYCE, that step does not exist: your payslips, ID documents, contracts and bank statements stay with you.
Technical protections
- Encrypted connection: the site is only available over HTTPS (HSTS enabled).
- Strict security policy (CSP): the browser only lets the page communicate with lunyce.com, Cloudflare’s audience measurement and Google’s advertising services. The tools read your files in memory and have no reason to send them: no request contains them.
- No third-party code in the tools: all processing libraries (PDF.js, pdf-lib, Tesseract, qpdf…) are hosted on lunyce.com. Only Google ads, which keep the site free, come from another site.
- Protection against malicious embedding: the site cannot be displayed inside another site's page (protection against "clickjacking").
- No accounts: there is no database of accounts or documents to steal. Google’s advertising cookies are only set with your consent.
- Transparency: on the HEIC pages, the security policy is slightly relaxed, because the iPhone photo decoder has to compile code when it loads. Traffic is still limited to lunyce.com.
Check it yourself
Open your browser’s developer tools (F12 key), “Network” tab, then process a file: no request sends your document. You will see the site’s files, the audience measurement and, when ads are shown, Google’s ad requests, which never contain your files.
Good habits for sensitive documents
- Add a watermark to a copy of an ID document before sending it.
- Redact information that is none of the recipient's business (account number, address, salary).
- Erase a PDF's metadata and the location of your photos.
- Protect a PDF with a password (AES 256-bit encryption) before emailing it.
Report a vulnerability
Found a security issue? Write to contact@lunyce.com. The contact details are also published in the standard security.txt file.