Privacy Policy

Last updated: October 2026

The short version

Your DICOM files — and the patient data inside them — never leave your device. All parsing, rendering and metadata display happen locally in your browser. Our servers never receive the files, any pixel data, any patient identifier, or anything else from them. This design is deliberate: medical images carry protected health information, and the only tool you can fully trust with it is one that never transmits it.

What we do NOT collect

• Your DICOM files — they are read by JavaScript running in your browser tab and are never uploaded.
• Image content and metadata — pixel data, patient names, IDs, study descriptions and anything else in the file stay in your browser's memory and are discarded when you close the tab.
• Accounts and cookies — the site has no signup, and it sets no cookies.

What is stored on your device

Two small localStorage entries, both anonymous:

• License record — if you activate a paid license, a signed token proving the activation (never the raw key) is kept so you stay unlocked between visits.
• Anonymous visitor ID — a random UUID (key vid) minted once by your browser and sent with the anonymous usage counters below so we can estimate unique visitors. It contains no personal data, is never linked to your files (which never leave the browser), and you can delete it anytime by clearing site data — you will simply be counted as new afterwards.

What is sent over the network

• Page & library loads. The site is static files served by our hosting provider (Vercel); the open-source libraries (the DICOM parser and the PDF generator) are vendored and served from the same host — no third-party CDN is contacted. Like any web request, the host may log your IP address and user agent per its own privacy policy.
• Anonymous usage statistics. We use Vercel Web Analytics, which counts page views and referrers without cookies and without collecting any file or personal data.
• Anonymous usage counters. Our server keeps running counts of tool events: files were parsed (count and byte size only), client-side error codes (e.g. "compressed pixel data not supported"), and an estimated unique-visitor count computed from the anonymous random ID above (stored only as its irreversible hash). These are bare numbers, codes and hashes — they never include file names, patient identifiers, tags, pixel data, or any file content.
• Feedback you choose to send. The Feedback link opens a form delivered by Web3Forms: only the text you type and, if you fill it in, your reply email address are sent. Never paste patient information or file content into the feedback form — we cannot use it and do not want it.
• License activation (paid users only). When you paste a license key, the key is sent to our server once so we can validate it with our payment processor, Gumroad. We keep only a signed activation token — never the key itself. Your payment details are handled entirely by Gumroad on its own platform and never reach us.

Third-party processors

• Vercel — hosting, and cookieless Web Analytics.
• Upstash — stores the anonymous daily usage counters described above.
• Gumroad — payment processing and license-key delivery for paid licenses.
• Web3Forms — delivers the feedback form.

We do not sell, rent, or trade personal data with anyone, and this site carries no advertising or cross-site tracking networks.

Google API services

We operate an internal, owner-only utility under the DCMView brand that calls the Google Ads API (Keyword Planner) in read-only mode. Here is exactly what that means:

• Access — aggregate keyword search-volume statistics from our own Google Ads accounts only. No Google data belonging to end users is ever requested or accessed.
• Use — internal keyword research for this site's own marketing, and nothing else.
• Storage — the retrieved statistics are kept as private research notes on our own systems.
• Sharing — nothing obtained through Google APIs is ever sold, shared, or transferred to any third party.
• Retention & deletion — research notes are kept only while relevant and are deleted completely when no longer needed.

Our use of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements.

Data retention

Your files and their contents are never sent to us, so there is nothing for us to retain or delete. Anonymous usage counters (numbers only, as described above) are kept as daily aggregates and lifetime totals. License records are kept as an irreversible hash of the buyer identifier plus daily activation counts — no key material and no payment data.

Changes to this policy

If we ever change how data is handled, we will update this page. Any feature that would require sending file content to a server (we have none planned) would be opt-in and clearly marked before it affects you.

Contact

Questions about privacy? Email hello@dcmview.com.