Data Processing
A clear explanation of how WhiskFile processes your documents at every stage — from upload to deletion.
Processing overview
When you use WhiskFile, your document goes through a controlled lifecycle. Depending on the tool, processing happens either in your browser (client-side) or on our servers (server-side). Either way, your original file is never modified — we always create a new output file.
Client-side processing
Over half of WhiskFile's tools run entirely in your web browser using WebAssembly. For these tools, your file never leaves your device. Processing is performed locally, and only the result is available for download — directly from your browser's memory.
Tools that run client-side include: merge, split, rotate, reorder pages, delete pages, extract pages, compress (basic), and many image tools.
Server-side processing
Tools that require OCR, AI analysis, or advanced conversion send your file to our secure servers for processing. Here's what happens:
Upload
Your file is encrypted in transit (TLS 1.2+) and stored temporarily in Cloudflare R2.
Validation
We verify the file type, size, and scan for malware (ClamAV) before processing.
Processing
An isolated worker picks up the job. Each worker processes one file at a time in its own temporary directory.
Output
The processed file is stored temporarily and a secure, expiring download link is generated.
Cleanup
Both the original upload and processed output are permanently deleted within 1 hour.
AI-powered processing
AI tools (summarize, translate, PII detection, contract analysis, invoice extraction) send document text to Google Gemini. We minimize data sent — only extracted text, not raw file bytes. The AI provider does not retain your data after processing.
What we store
| Data type | Stored? | Details |
|---|---|---|
| File content | No | Deleted within 1 hour. No long-term storage or backups. |
| Job metadata | Temporarily | Tool name, file size, page count, status. Retained 30–90 days. |
| Account data | Yes | Email and plan info. Deleted on account closure. |
| Payment data | By processor | Card details stored only by Stripe/Cashfree in PCI-DSS vaults. |
| Document text | No | OCR/AI text is transient — discarded after processing completes. |
Deletion guarantee
We use automated cron jobs to verify file deletion. Every file stored in R2 has an expiry timestamp. A background process runs every 15 minutes to catch and delete any files that were not removed on schedule. No human intervention is needed.
Your rights
You can request deletion of your account and all associated data at any time. Data export is available upon request. For data-related inquiries, contact privacy@whiskfile.com.