Privacy
The short version: tools marked “Runs in your browser” never send your input or your files anywhere, and we do not have accounts, so there is nothing to attach data to.
Your tool input
Every tool in the current catalog is client-side. Your input is processed by JavaScript running on your own machine and is never uploaded, logged or stored. You can verify this: open your browser's developer tools, watch the network tab, and use any tool. There is no request carrying your data, because there is no endpoint to receive it.
Your files
The PDF and image tools read the files you choose with your browser's File API and process them in the page — merging, splitting, compressing and converting all happen on your device. The PDF engine the page loads for this is served from this site, not a third party, and it is fetched only when you first add a file. The finished file is handed to you as a download straight from the page; no copy is made anywhere else.
Documents you create
Invoices, letters, agreements and resumes are built in the page, and “Download PDF” uses your browser's own print-to-PDF, so the document never leaves your machine. So that a half-finished document survives a reload, its details are kept as a draft in your browser's local storage. Each generator has a “Clear saved details” link that removes its draft immediately — worth using on a shared computer.
If a future tool genuinely needs a server — some things cannot be done in a browser, such as a DNS lookup — its page will say so plainly instead of showing the “Runs in your browser” badge, and it will explain what is sent and what is kept.
What is stored in your browser
A handful of things, in local storage, readable only by your browser:
- Which tools you have used recently, so the command palette can offer them.
- Which tools you have starred.
- Display preferences: your theme, and safe per-tool options such as indentation.
- Drafts of documents you are writing in the document generators, as described above.
Other tool input is never among them. Two tools — the password generator and the JWT decoder — are excluded from the recently-used list entirely, because the fact of using them is itself worth not recording on a shared machine. Clearing your browser's site data removes all of it.
What we count
One number per tool: how many times each page was viewed and each action used. That is a counter in a database row, with no request body, no IP address, no user agent, no session, no cookie and no identifier of any kind — there is no way to reconstruct who did what, including for us. It exists so that development effort goes to the tools people actually use.
The Support page is counted the same way: how many times it was opened, which link led there, and how many times each payment option was clicked — totals only, never who clicked.
Requests that set Do Not Track or Global Privacy Control are not counted at all.
Cookies
The site sets no tracking cookies. Django sets a session and CSRF cookie only inside the admin area, which visitors never touch.
Third parties
The only third-party request a page makes is to Google Fonts for the two typefaces, and the site renders correctly with the system font stack if that is blocked. Optional extras — an advertising network, or a privacy-respecting analytics provider — are off by default and this page will name them explicitly if they are ever switched on.
Supporting the site
The Support page may offer a PayPal link, a UPI QR code and links to other payment providers (such as Buy Me a Coffee or GitHub Sponsors). None of them loads anything from a payment provider until you choose to use it: each button is an ordinary link that opens the provider in a new tab, and the UPI QR code is drawn in your browser and read by your own UPI app. Any payment happens entirely between you and the provider or your bank — this site never sees your payment details.
Shareable links
Some tools can encode their input into a URL so a colleague sees the same thing. This is deliberately limited to tools whose input is a short, non-secret value such as a CIDR block or a cron expression. Tools that handle tokens, passwords or request bodies never put input in a URL — share links from those carry the tool address only.