Skip to content
ShiftAny
Open Files

Privacy and cookie policy

Last updated: 10 October 2026 · Common to the entire ShiftAny ecosystem

ShiftAny is built on the principle of data protection by design and by default (Article 25 GDPR): your files never leave your device. This policy, common to getshiftany.com (coming soon) and all of its modules, explains the little technical data that is processed, for what purpose and how to exercise your rights.

1. Data controller

  • Controller: ShiftAny
  • Nature: Independent, freely accessible software project, with no economic activity and no mandatory commercial monetisation.
  • Location: Spain (European Union)
  • Contact (also to exercise your rights): support@getshiftany.com
  • Main site: https://getshiftany.com (coming soon)

ShiftAny is a personal, non-profit project. This policy applies to the main site getshiftany.com (coming soon) and to all of its modules (Files, Audio (coming soon), Images (coming soon), Video (coming soon) and any added in the future), and is governed by Regulation (EU) 2016/679, the General Data Protection Regulation (GDPR), Spanish Organic Law 3/2018 on the Protection of Personal Data and the Guarantee of Digital Rights (LOPDGDD) and Spanish Law 34/2002 on Information Society Services (LSSI-CE).

2. Your files: never collected, transferred or stored

All ShiftAny tools run entirely in your browser, using Web Workers and code that is downloaded with the page. When you choose a file or record with the microphone:

  • It is not uploaded to any server: processing takes place in the memory of your own device.
  • Neither the owner nor any third party has access to its content, name or metadata.
  • No copy is kept: when you close or reload the tab, the data disappears from the browser's memory.
  • The resulting file is generated on your device, and only you decide whether to download it or save it to your Google Drive (section 3).
  • Microphone access, where a tool offers it, is only enabled if you authorise it in your browser, and the recording stays on your device.

You can check this yourself in the "Network" tab of your browser's developer tools: when a file is processed, no request containing its content is sent.

3. Optional Google Drive connection

Some modules let you open files from your Google Drive and save the results to it. This is optional: it is only enabled if you click the Google Drive button and grant permission in Google's window, and the tool works the same without it.

  • No servers of our own. Your browser talks directly to Google: files travel from your Drive to your browser's memory, are processed on your device and, if you ask, the result is uploaded from your browser to the folder you choose. No file, token or account data ever passes through ShiftAny servers, and the owner cannot access them.
  • Minimal permission. Only the "drive.file" permission is requested, which grants access solely to the files and folders you pick in Google's file picker and to the files the tool itself saves. The rest of your Drive cannot be seen or changed. Your name, email address and other profile data are not requested.
  • This tab only. The access token issued by Google is kept only in the tab's memory, not in cookies or browser storage, and disappears when you close it. It expires after one hour and you can revoke it earlier with "Disconnect" or at any time from your Google Account settings.
  • Limited use. Data obtained from Google APIs is used only to open and save the files you indicate, and its use complies with the Google API Services User Data Policy, including the Limited Use requirements. It is not transferred to third parties, not used for advertising or to train artificial intelligence models, and no human reads it.

Google processes your account data as an independent controller, under its own privacy policy. Legal basis for using the connection: your consent when granting the permission (Art. 6(1)(a) GDPR), which you may withdraw at any time.

4. Technical data that is processed

There is no user registration and no database of our own. The only personal data that may be processed is:

  • Hosting technical logs (Cloudflare Pages). As with any website, when a page loads your browser sends an HTTP request that includes your IP address, the date and time, the requested URL and the user agent. The hosting provider logs it minimally and temporarily for the purposes of security, prevention of abuse and attacks, and operation of the service. Legal basis: the owner's legitimate interest in keeping the sites secure and available (Art. 6(1)(f) GDPR).
  • Aggregated analytics (Cloudflare Web Analytics). Used to find out, anonymously and in aggregate, how many visits each page receives and how it performs. It does not use cookies, does not store anything on your device, does not use fingerprinting, and does not build individual profiles or track your activity across sites. Legal basis: legitimate interest in improving the service (Art. 6(1)(f) GDPR).
  • Fonts (Google Fonts). Pages load their typeface from Google's servers, which receive your IP address in order to serve the font file. Legal basis: legitimate interest in a consistent presentation of the sites (Art. 6(1)(f) GDPR).
  • Email. If you write to us, we will process your address and the content of your message solely to reply to you. Legal basis: your consent when contacting us and, where applicable, the handling of your request (Art. 6(1)(a) and 6(1)(b) GDPR).
  • Newsletter. If you subscribe to receive news (for example, the launch notice for a module in development), your email address is registered with Buttondown, the service that manages the list, and is used solely to send you those emails. Subscription requires confirmation via the link you will receive, and you can unsubscribe at any time from any email. Legal basis: your consent (Art. 6(1)(a) GDPR).

No automated decisions are made and no profiles are built with any of this data, and it is never sold or shared for advertising purposes.

5. Recipients and international transfers

Cloudflare, Inc. provides hosting, the content delivery network and analytics as a data processor, and Google provides font delivery. Both providers are based in the United States and are certified under the EU-U.S. Data Privacy Framework, which the European Commission recognises as an adequate safeguard; in addition, their contracts incorporate the standard contractual clauses approved by the Commission. Apart from these cases and legal obligations, no data is disclosed to third parties. If you subscribe to the newsletter, your email is processed by Buttondown (Buttondown, LLC, United States) as a data processor, with the safeguards for international transfers set out in its data processing terms.

6. Retention period

  • Processed files and recordings: not retained, because they never leave your device.
  • Technical logs: the minimum time the provider needs for security purposes, in accordance with its own retention policies.
  • Analytics: only aggregated, anonymous metrics that cannot identify you.
  • Newsletter: for as long as you remain subscribed; once you unsubscribe, your address stops receiving emails and you may request its erasure.
  • Emails: while your request is being handled and, thereafter, for the limitation periods of any potential legal liability.

7. Cookie and local storage policy

ShiftAny does not set its own cookies or any third-party cookies for advertising, analytics or tracking purposes. Cloudflare's analytics work without cookies.

Some modules may save interface preferences that you choose (for example, the width of a panel) in your browser's local storage, so that they are remembered on your next visit. This information contains no personal data, never leaves your device and can be deleted at any time from your browser settings.

Cloudflare's infrastructure may, in certain circumstances, use strictly necessary security cookies (for example, to distinguish legitimate traffic from automated traffic).

Both these technical cookies and the interface preferences are necessary to provide the service you request and are exempt from the consent requirement under Article 22(2) of the LSSI-CE. For this reason, the sites do not display a cookie consent banner: there is nothing that requires your prior authorisation. Should any non-exempt cookie be introduced in the future, your consent will be requested before it is set and this policy will be updated.

8. Your rights

You may at any time exercise your rights of access, rectification, erasure, objection, restriction of processing and data portability, as well as withdraw any consent given, by writing to support@getshiftany.com. Please state the right you wish to exercise; if necessary to verify your identity, we may ask you for additional information. We will respond within a maximum of one month.

Please note that, as no files or account data are collected, in most cases there will be no personal data about you to consult or erase.

If you consider that the processing does not comply with the regulations, you may lodge a complaint with the Spanish Data Protection Agency (AEPD, www.aepd.es).

9. Minors

The sites do not collect registration data from any user. Children under 14 must not send us personal data by email without the consent of their parents or guardians (Art. 7 LOPDGDD).

10. Changes to this policy

This policy may be updated to reflect technical or regulatory changes, or the addition of new modules. The date of the last update is shown at the top of the page.