Yuan Tools Privacy Policy
Effective date: 5 October 2026
Website: https://yuantechnology.uk/
Operator: 盈泰技術（香港）有限公司 — INNOFLOW TECHNOLOGY (HONG KONG) LIMITED
Privacy contact: contact@innoflowhk.com
1 Scope and responsibility
INNOFLOW TECHNOLOGY (HONG KONG) LIMITED (“we”, “us” or “our”) operates Yuan Tools and is responsible for the personal data we process in operating this service. This policy explains the data handling of our free browser tools, Google sign-in, accounts and deployed API. The free tools can be used without an account. Creating an account is optional, but signing in requires the Google account information described below.
2 Free browser tools and your documents
Our free PDF to Markdown, HTML to Markdown, JSON formatting and image OCR tools process files and pasted content in your browser. These tools do not send document contents to our application server, save conversion history or cache document contents through the app. Work held by the page is cleared when you close or refresh it. Files you download remain on your device until you remove them.
OCR engines and language models may be downloaded and cached on your device. Loading the website and downloading these resources still involve ordinary network requests. Local document processing does not mean that visiting the website is anonymous. Optional exported metadata may include the source filename; review this before sharing an export.
3 Google sign-in and account information
When you sign in with Google, we store your Google unique user identifier, our internal account identifier, name, email address, profile image URL and registration time. Profile images are loaded from Google; we do not store a copy of the image. Google therefore also processes requests associated with sign-in and profile image loading.
We also store account-linked API key hashes, credit balances, session hashes and expiry times, and associated usage and order records where these exist. We use this information to identify and authenticate your account, display your profile, manage access and balances, and associate service records with the correct account.
We do not store your Google password, read your Gmail or persistently store Google sign-in tokens. Signing out revokes the current session. It does not delete your account, revoke every other session or delete purchase records.
4 API processing and usage records
The API backend is deployed, but credit purchases and the complete paid service flow are not yet open to new customers. Where API access is available, it currently supports splitting text or Markdown into chunks. Submitted content is sent to our server-side code running on Cloudflare and exists in server memory during request processing. This differs from the free browser tools.
The application does not persist API source text in its database or deliberately log that text. We have not specified an exact number of seconds for clearing server memory. We retain request idempotency identifiers, content hashes, credits deducted and timestamps, linked to the relevant account or API access record. These records support usage accounting and handling repeated requests. A hash is retained data and should not be assumed to be anonymous simply because it is not the original text.
The current API does not call a third-party AI service or cloud OCR provider to process submitted text.
5 Hosting and request information
We use Cloudflare Workers, static asset hosting and Cloudflare D1. Cloudflare processes normal page and API requests and provides infrastructure, security services and platform traffic metrics. This can involve IP addresses and technical request or network information, even though we have not enabled our own application access-log database, Worker logging, tracing or error Issues.
Our code has not integrated Google Analytics, Sentry, AdSense or third-party marketing tracking scripts. The INNOFLOW promotional placement is an ordinary link, rather than an advertising tracking integration. When you follow a link, the destination website processes your visit under its own privacy policy.
For login rate limiting, the application stores a hash derived from the IP address and time window. The rate-limit window is 10 minutes.
6 Cookies and device storage
Sign-in uses necessary session cookies. Session validity is 30 days; signing out deletes the current server-side session. OAuth temporary verification records are valid for 10 minutes and are consumed and deleted on callback. Expired session and temporary records are cleaned up by subsequent login requests, rather than necessarily being physically deleted at the moment they expire.
Your language preference is stored in browser localStorage. OCR resources may be cached locally. Neither has a configured automatic expiry in this app. You can clear them using your browser’s site-data and cache controls. Blocking session cookies may prevent sign-in from working.
Free browser tools allow 10 successful conversions and up to 30 OCR pages per device per day. Daily counters and a local date are stored in localStorage, without document contents or an account identifier, and reset at local midnight when the tools are used. A sessionStorage flag limits bookmark reminders. These browser limits are not cross-device or tamper-proof. Clearing site data resets them. Pasted screenshots are processed locally in the same way as selected images.
7 Payments
Website checkout is currently disabled and the website does not initiate live charges. A payment integration is in preparation. Before enabling payments, we will update this policy to describe the active payment provider, the data sent to it and the applicable retention arrangements. Existing account, order or usage records are still subject to this policy.
8 Service providers and international processing
Cloudflare provides our hosting, server-side execution, database and network security services. Google participates in sign-in and profile image loading. Their handling of information is also described in the Cloudflare Privacy Policy and Google Privacy Policy. If you email us, your message and contact information are processed through the email services used to deliver and handle that correspondence.
Cloudflare uses a global network. Our D1 database is currently configured in the Asia Pacific region, without a country-specific jurisdiction restriction; global read replication is not enabled. These settings do not guarantee that data remains only in Hong Kong, the United Kingdom or any other single country. Processing can occur outside your country of residence. This policy does not itself establish any legal transfer safeguard.
9 Current retention arrangements
Account information, profile image URLs, balances, order or top-up records and API usage records currently have no configured fixed retention period and no automatic deletion mechanism. This describes the current implementation; it does not remove any obligation to delete personal data when applicable law requires it.
API source text is not persistently stored by the application. Session and temporary-record validity and cleanup are described above. Our D1 recovery window is currently 7 days, so data deleted from the live database may remain in recoverable backups during that window. Recovery procedures need to account for previously deleted data.
Cloudflare infrastructure retention is governed by its services and arrangements; we have not yet verified every platform-level retention period and therefore do not promise a fixed deletion deadline for those records. Browser preferences, OCR caches and your downloaded files remain subject to your browser settings and your own deletion choices.
10 Your choices and privacy requests
You can use the free tools without signing in, sign out of your current session, clear local site data or choose not to submit content to the API. Account information is needed for account-based features; without it, those features cannot be provided.
Depending on applicable law, you may have rights to access or correct personal data and, where applicable, request erasure, restriction or portability. You may also have a right to object to certain processing, including processing based on legitimate interests where that legal basis applies, and withdraw consent where processing relies on consent. These rights are subject to the conditions and exceptions in the applicable law. You may raise a concern with the relevant data protection authority, including the Hong Kong Privacy Commissioner for Personal Data where appropriate.
Please direct privacy questions and requests to contact@innoflowhk.com. Include the account email and describe your request; do not send passwords, API keys or identity documents unless a necessary and suitable verification method has been agreed. There is currently no self-service account deletion feature or established deletion workflow. Sending an email or signing out does not automatically delete records. These implementation limitations do not limit your statutory rights.
11 Security and changes
The current application stores hashes of API keys and login sessions rather than those secrets in their original form. Hashing is a security measure, not a guarantee of anonymity or absolute security. No online service can guarantee that all risks are eliminated.
This policy describes the current service. We will update this policy before introducing new payment processing, API functionality, tracking or retention arrangements. Please contact us at the address above if you have questions about this notice.