A real local-versus-server boundary
Understand Local Processing, Server Processing, and Temporary File Retention Before You Use a Tool
A practical way to decide what data belongs in a browser-local tool, what needs a redacted server-side sample, and why temporary cleanup is not the same as durable storage or a blanket privacy guarantee.
Open toolFind the processing boundary before entering data
Do not infer data handling from a tool name or category. Read the tool page and its guide: some transformations run in the browser, while uploads, conversions, encryption requests, and temporary endpoints can send data to a server. A local result and a server result require different input choices.
Classify the material first. Public or synthetic samples are usually appropriate for learning and testing. For customer records, private documents, credentials, health, payment, legal, or regulated data, use the system and approval process that owns that data instead of assuming a general-purpose tool is suitable.
Browser-local processing still has a handling surface
For tools documented as browser-local, the transformation happens in the current browser and the input is not submitted to MV Tools. Base64 text conversion, JSON formatting, UUID generation, QR construction, and many text utilities are examples of workflows that can be local; check the individual page because implementation matters.
Local does not mean harmless to copy or share. Clipboard history, downloaded files, screenshots, browser extensions, shared devices, pasted URLs, and the destination where you use the output can still expose information. Use a minimal sample and clear local copies when that is appropriate for the device and organization.
Treat server processing and temporary files as a different boundary
Some tools send an upload or submitted text to the server for the requested operation. PDF compression, OCR and document conversion are server-backed workflows; the AES tool also sends its text and password to a server API. Enter only a safe, minimized or redacted source, keep the original under your own controls, and review the returned result before sharing it.
Many upload and conversion services are configured with a 30-minute temporary retention period and scheduled cleanup. That is a service setting, not an exact deletion time, an archive, or a universal rule for every tool. Download the result promptly, do not rely on the tool for storage, and check the specific tool guidance and policy when the data matters.
Use temporary endpoints only with disposable test data
A temporary request-capture endpoint is useful for observing a controlled webhook sample, but it is a server-side service with its own lifecycle. Its endpoint URL accepts incoming requests, and temporary capture is not a place for production secrets or customer events.
Use placeholder identifiers, test credentials, harmless callback URLs, and the smallest body that can prove the contract. Automatic header redaction is limited and does not classify bodies, query parameters, paths, or ordinary header values. If a real secret reaches a temporary service, treat it as exposure and rotate or revoke it in the owning system.
Follow a repeatable data-minimization workflow
First decide whether the task can use a browser-local tool. If it cannot, create a minimal redacted test file or sample text, submit only that sample, then download and inspect the output immediately. Keep source records and final approved files in the storage controlled by their owner, not in a temporary processing workflow.
When testing is complete, remove temporary endpoints where the tool supports it, close downloads and copies according to your own rules, and record only the non-sensitive details needed to reproduce the task. If you cannot safely redact the input, do not submit it: choose an approved internal workflow instead.
Frequently asked questions
Can I assume every MV Tools utility processes data locally?
No. Processing location depends on the individual implementation. Check the tool page and guide before entering data.
Does a 30-minute retention setting mean a file is deleted at exactly 30 minutes?
No. It describes configured temporary retention with periodic cleanup for many services; cleanup timing and behavior are tool-specific. It is not an archival or deletion guarantee.
Is it safe to put a production secret into a temporary testing tool?
No. Use synthetic or redacted data and test credentials. If a production secret was submitted, follow the owning system’s exposure and rotation procedure.