Privacy Policy

Last updated: 18 October 2026

This policy explains, in plain English, what information WeShoal (weshoal.com) handles, why, how long we keep it, and your rights under UK data protection law (the UK GDPR and the Data Protection Act 2018). The short version: our free tools run in your browser and never upload your files, we don't ask for your email or an account, and we don't use advertising or tracking cookies.

1. Who we are

WeShoal is run by MeWeBe Limited, a company registered in the UK. We are the "controller" of the personal data described here. You can contact us about anything in this policy at [email protected].

2. Free tools that run on your device: no data collected

Most of our tools run entirely inside your web browser. This includes the screen recorder (except the optional share link, see section 4), the PDF tools (merge, split, organise, JPG to PDF), the bank statement to CSV/Excel converter, the background remover, the passport photo maker, the image converter and compressor, the EXIF stripper, the QR code studio, the Markdown to email formatter, the JSON formatter, the regex tester, code-to-image, the package/MCP scanner and all calculators.

When you use these tools, your files and the text or numbers you type never leave your device. We don't receive, see or store them.

Some of these tools (such as the background remover) download open-source AI model files to your browser from public content delivery networks (jsDelivr and Hugging Face). Only the model files are downloaded; none of your files or data are sent to them. As with any website, those networks will see your IP address when your browser requests the files.

3. Cloud AI tools

Our AI image generator, AI image upscaler, vocal remover/stem splitter and audio/video transcription tools run on cloud servers, not on your device. They are clearly labelled "Cloud AI". When you use one:

• The file or text prompt you provide is uploaded only so it can be processed. We send it to our AI processor, Replicate, which runs the model.
• Temporary copies of your uploaded input are deleted automatically within about 1 day.
• Results (for example the generated image, upscaled image, separated audio or transcript) are delivered through temporary links that expire after about 1 hour. Download anything you want to keep.
• We do not use your files or results to train AI models, and we don't look at them except where needed to investigate abuse or a technical problem you report to us.

4. Screen recorder share links

If you choose to click "Create share link" after a recording, your video is uploaded and stored on Cloudflare R2 so other people can watch it. Share links:

• are stored for up to 7 days and then deleted automatically;
• can be viewed by anyone who has the link, so only share it with people you trust;
• can be up to 1 GB in size;
• have a "report" link on the watch page so anyone can tell us about illegal or abusive content, which we may remove.

If you never click "Create share link", your recording stays on your device.

5. AI credit wallet (no account, no email held by us)

You don't need an account to buy AI credit. When you first use the wallet, your browser creates a random, anonymous wallet ID and a recovery code, which are saved in your browser's local storage. On our side we store, against that anonymous ID:

• your credit balance;
• a ledger of top-ups and AI runs (amounts, dates, which tool, and refunds for failed runs).

Payments are handled by Stripe through a Stripe payment page. You can pay by card, Apple Pay, Google Pay or Link. Stripe asks for your email address only to send you a payment receipt. Stripe holds your payment details and that email address; we do not store your email address and never send you marketing. We receive a confirmation from Stripe that a payment for your wallet ID was made, so we can add the credit.

6. IP addresses and abuse prevention

To keep the free AI trials fair (one free go per tool per person per day, within an overall daily budget) and to stop abuse of share links, we use your IP address briefly for rate limiting. We store it alongside free-trial records and share-link records so we can enforce these limits and investigate abuse. Our hosting provider, Cloudflare, also processes IP addresses to deliver the site and protect it from attacks.

7. Cookies, local storage and analytics

• No cookies are used for tracking or advertising, and we show no ads.
• We use your browser's local storage (which stays on your device) to remember your theme choice, your pinned tools and, if you use AI credit, your wallet ID and recovery code.
• We do not currently use any analytics. If we turn on Cloudflare Web Analytics in future, it is cookieless and does not track you across sites.

8. Why we use your data (lawful bases)

• Contract: to provide paid AI credit and the AI runs you ask for, keep your wallet balance and handle refunds.
• Legitimate interests: to prevent abuse of free trials and share links, keep the service secure, and run the cloud AI tools and share links you choose to use. We have balanced these interests against your rights and keep the data to a minimum.
• Legal obligation: to keep payment and accounting records as required by UK law.

9. Who processes data for us

• Cloudflare: website hosting, Pages Functions (our small server code), D1 database (anonymous wallet balances and ledger, trial and share records) and R2 storage (share-link videos and temporary AI inputs).
• Stripe: payments and payment receipts.
• Replicate: running the cloud AI tools only.
• jsDelivr and Hugging Face: content delivery networks that serve open-source AI model files to your browser. No user files are sent to them.

We don't sell your data or share it with anyone else, unless we are required to by law.

10. How long we keep data

• Files you use with local tools: never received, so never kept.
• Cloud AI inputs: deleted automatically within about 1 day. Results: delivery links expire after about 1 hour.
• Share-link videos: up to 7 days, then deleted automatically (sooner if removed for abuse).
• IP addresses in free-trial and share records: only as long as needed for rate limiting and abuse prevention.
• Wallet records (anonymous ID, balance, ledger): kept while you have credit, and for as long as required for accounting and tax purposes.

11. International transfers

Some of our processors (including Cloudflare, Stripe and Replicate) are based in, or process data in, the United States. Where personal data is transferred outside the UK, it is protected by recognised safeguards such as the UK International Data Transfer Addendum to the EU Standard Contractual Clauses, or the UK-US data bridge where the provider is certified.

12. Your rights

Under UK data protection law you have the right to:

• ask for a copy of the personal data we hold about you (access);
• ask us to correct or delete it (rectification and erasure);
• object to or ask us to restrict how we use it;
• receive data you provided in a portable format, where this applies.

Because we don't hold names or email addresses, we may need your wallet ID, the share link, or the approximate time you used a tool to find your data. Email [email protected] and we'll reply within one month.

If you're unhappy with how we've handled your data, you can complain to the UK Information Commissioner's Office (ICO) at ico.org.uk. We'd appreciate the chance to put things right first.

13. Children

WeShoal is not directed at children under 13, and we don't knowingly collect personal data from them. Buying AI credit requires a payment method, so it is intended for adults or with a parent's permission.

14. Changes to this policy

If we change how we handle data, we will update this page and the "Last updated" date above.

15. Contact

MeWeBe Limited, operator of WeShoal. Email: [email protected].