Privacy
The short version: tools marked “Runs in your browser” never send your input anywhere, and we do not have accounts, so there is nothing to attach data to.
Your tool input
Every tool in the current catalog is client-side. Your input is processed by JavaScript running on your own machine and is never uploaded, logged or stored. You can verify this: open your browser's developer tools, watch the network tab, and use any tool. There is no request carrying your data, because there is no endpoint to receive it.
If a future tool genuinely needs a server — some things cannot be done in a browser, such as a DNS lookup — its page will say so plainly instead of showing the “Runs in your browser” badge, and it will explain what is sent and what is kept.
What is stored in your browser
Three things, in local storage, readable only by your browser:
- Which tools you have used recently, so the command palette can offer them.
- Which tools you have starred.
- Display preferences: your theme, and safe per-tool options such as indentation.
Tool input is never among them. Two tools — the password generator and the JWT decoder — are excluded from the recently-used list entirely, because the fact of using them is itself worth not recording on a shared machine. Clearing your browser's site data removes all of it.
What we count
One number per tool: how many times each page was viewed and each action used. That is a counter in a database row, with no request body, no IP address, no user agent, no session, no cookie and no identifier of any kind — there is no way to reconstruct who did what, including for us. It exists so that development effort goes to the tools people actually use.
Requests that set Do Not Track or Global Privacy Control are not counted at all.
Cookies
The site sets no tracking cookies. Django sets a session and CSRF cookie only inside the admin area, which visitors never touch.
Third parties
The only third-party request a page makes is to Google Fonts for the two typefaces, and the site renders correctly with the system font stack if that is blocked. Optional extras — an advertising network, or a privacy-respecting analytics provider — are off by default and this page will name them explicitly if they are ever switched on.
Shareable links
Some tools can encode their input into a URL so a colleague sees the same thing. This is deliberately limited to tools whose input is a short, non-secret value such as a CIDR block or a cron expression. Tools that handle tokens, passwords or request bodies never put input in a URL — share links from those carry the tool address only.