Privacy
Your selected files
File tools and Studio process the files you open on your device rather than uploading them to a Nerulio server. Images you explicitly attach to community posts are uploaded separately. Files are read in browser memory and results are generated on your device. Editing projects, files and results are never stored on a Nerulio server. Unsaved in-memory changes can be lost when the tab closes. Studio recovery and local storage are described below.
Accounts
Using Nerulio’s file tools needs no account, and its tools have no daily limits: tool pages send nothing about your work to the Nerulio service. When you open the account page or the community, the Nerulio service on Cloudflare sets an HttpOnly cookie (nerulio_anon) with a random identifier so that it can recognise the same browser; it holds no information about you. You can sign in with Google, GitHub or Discord (whichever this site offers). The provider shares only: its account identifier (Google’s subject id, the GitHub numeric user id, the Discord user id), the name or handle shown there, and your e-mail address only when the provider reports it as verified (GitHub: your primary verified address; Discord: only a verified address). Nerulio stores these to recognise your account, plus a hashed session token (cookie nerulio_session, 30 days). The provider’s access token is used once during sign-in and is not stored, and no profile pictures are fetched. Your provider name and e-mail are never shown publicly; community posts show the nickname you choose. Accounts are never joined by e-mail address — you link or unlink providers yourself on the account page. To limit automated abuse, a keyed hash of your network address that changes every day may be counted; it cannot be turned back into your address. Cloudflare Turnstile may be shown to suspicious traffic and is governed by Cloudflare’s privacy policy.
Requests beyond your device
Opening the site sends ordinary web requests to the hosting provider, which can process IP addresses, request URLs and browser information for delivery and security. Pinned PDF and media engines are served by this site on demand. HEIC, annotation fonts, ONNX Runtime and public AI weights may download from jsDelivr and Hugging Face, including their delivery domains. Providers receive connection information; saying that no data ever leaves your device would be inaccurate. Files opened for editing stay on your device; this does not apply to images you explicitly upload to a community post.
Device storage
Your manually chosen language is stored under fileforge.language.v1 in localStorage. Automatic mode removes that preference. Favorite tool IDs and the three most recent tool IDs are stored under fileforge.tools.v1; this does not include filenames or file contents. Browser caches and model libraries may retain downloaded libraries or models; browser site-data controls can clear them. Studio projects, image blobs and recovery snapshots are stored locally in IndexedDB (nerulio-studio). Save a .nerulio file as a backup; clearing site data can erase local projects. Other editors do not have this Studio recovery workflow. When you drop files on the home page or continue from one tool to another, the files are parked in this browser’s IndexedDB (nerulio-handoff) so the next page can open them; they are deleted as soon as that page takes them, or ignored after two minutes, and are never uploaded. Media output may be written to origin-private temporary storage on this device. Discarding results removes it; interrupted jobs can remain until browser site data is cleared, or until cleanup of files older than seven days on the next media use.
Analytics and advertising
Analytics is off by default. A configured adapter can receive allowlisted tool events, language, device class and a coarse traffic-source category; filenames and file contents are excluded. The advertising status of this build is stated below. When the operator enables Google AdSense, Google and its partners can make network requests and use cookies or similar storage for advertising, measurement and fraud prevention, subject to applicable consent settings. Advertising does not require uploading the file you edit. The operator must configure Google Privacy & Messaging or a Google-certified CMP where required; this site does not imitate a certified consent system.
Questions and public reports
Use the Contact page for the public GitHub Issues channel. Do not post private documents, personal information or confidential screenshots. GitHub handles information you submit there under its own policies.
This site counts visits with Cloudflare Web Analytics. It sets no cookies and uses no local storage; Cloudflare receives the page address, referrer and browser/device information and reports them only in aggregate. Your files are never sent.
Visit statistics: after a page has been visible for about a second, it sends one request to Nerulio’s own server with the page path (without its query), a coarse traffic source (search, social, AI assistant, direct, internal or other), a device class (mobile, tablet or desktop) and the browser language. The server adds the country and the browser family. No cookie is set and no identifier is created; a single "already counted" flag is kept in this tab’s sessionStorage (nerulio.hit) to tell the first page of a visit apart. IP addresses and full browser identification strings are not stored. Requests from crawlers and other automated clients are counted under the name they publish. The counts are kept in Cloudflare Workers Analytics Engine for up to three months and are only shown to the operator in aggregate. Your files are never sent.
Community posts without an account
When you post, comment, vote, report or upload an image on the Nerulio community without signing in, the server derives two keys from your network address (the IPv4 /24 or IPv6 /48 part) with a secret key: today’s ID, shown next to your nickname and changing every day at midnight Korea time, and a network key used only to enforce limits and bans. The IP address itself is never stored or shown. The network key is deleted from posts, comments, images, votes and reports after 90 days; daily counters after a few days. Your edit password is stored only as a salted, slow hash. The nickname you type is remembered in this browser (localStorage) only.
Community images
Images are resized and re-saved in your browser before upload, which removes location and camera data (EXIF); the server removes remaining metadata. Images are stored in Cloudflare R2 and shown only on Nerulio. Images that nobody used in a post are deleted after a day; images of deleted posts are deleted from storage. Images are served through Cloudflare, which may scan them for known child sexual abuse material.
Google AdSense is disabled in this build. No Google advertising script or ad units are loaded.