Privacy Policy

Utility inputs and generated outputs are private by default and are not automatically uploaded to the server.

Browser-first processing

JSON, JWT, Base64, URL, CSS, SVG, colour, diff, regex, minifier and similar tools normally run inside your browser. Their input and output are not intentionally transmitted to or stored in the server database.

Private Device Vault

When you choose Save on this device, the result is stored in your browser using IndexedDB, with a local-storage fallback. It stays on that browser profile and is not synced to the server. The Device Vault is limited to 4 MB per result, 24 MB in total and 40 saved items. Clearing browser data may remove it.

Account and workspace data

An account may store your name, email, password hash, favourites, recently opened tool slugs, API-key records, API usage metadata and snippets you explicitly choose to save. Cloud snippets are limited to 128 KB each. Tool input and output bodies are not included in recent-history records.

API privacy and limits

API requests are limited to 256 KB. The API processes the request and logs operational metadata such as the key, endpoint, status and time; request and response bodies are not retained as saved results.

Server-required operations

Authentication, bcrypt generation, email delivery, feedback submission, optional social sign-in and API execution require server processing. Bcrypt input is size-limited and is not saved as a generated-result record.

Visitor analytics

The public visitor counter uses a one-way keyed hash derived from technical request data to reduce duplicate counts and filter common bots. It stores visit times, page counts and the last path, rather than displaying a raw IP address.

Email communication

Account, password-reset, feedback and administrator notifications may be sent through Google SMTP, cPanel SMTP or the mail driver configured by the administrator. Delivery status and error text may be retained in administrator mail logs.

Security

Passwords use PHP password hashing. API keys are stored as one-way SHA-256 hashes. SMTP and OAuth secrets are encrypted with the application key. HTTPS should always be enabled in production.

Your control

You can clear the Device Vault from its page, remove saved snippets and request account deletion. Avoid pasting production passwords, private keys or other secrets into any online utility unless necessary.