Privacy Policy

• Almost every tool runs entirely in your browser. What you paste, drop or open is processed on your device and is never sent anywhere.
• There are no accounts, no sign-in, no profiles and no advertising. Nothing is sold, and nothing is shared for cross-context behavioural advertising.
• Two analytics services measure usage: Google Analytics 4, which sets cookies, and Cloudflare Web Analytics, which does not.
• Three tool features do talk to a server, and they are the only ones: the location lookups, the YouTube transcript fetch, and ordinary page delivery. Each is described below.
• the site operator keeps no logs and no copies. What retention exists belongs to Cloudflare and Google, under their own policies.

The counters, formatters, converters, encoders, generators and viewers — word and character counting, JSON, XML and SQL formatting, CSV and JSON conversion, regular expressions, markdown preview, date, unit and time-zone maths, cron expressions, QR codes, image compression, and the GLB model viewer and converter — are JavaScript and WebAssembly running inside the page. Your input is read by that code and never transmitted. There is no upload step, no server-side processing and nothing for the site operator to store, because the data never arrives.

The same is true of the browser and device checks — screen size, window size, user agent, operating system and the cookie check. They report what your own browser already knows about itself, on the page, to you.

Typefaces are served from this site rather than fetched from Google Fonts, so simply loading a page does not announce your visit to a font provider.

The site runs on Cloudflare Workers, and Cloudflare's network handles every request. To do that, Cloudflare necessarily processes the usual connection metadata: your IP address, the requested URL, your user agent, and the time. This is Cloudflare's infrastructure logging, under their privacy policy and retention schedule. the site operator runs no separate log store, keeps no copy, and has no analytics database of requests.

Six pages report where a visitor appears to be: IP address, City, State, ZIP code, Country, Location. They work in two stages, and the second one only happens if you ask for it.

By default, from your connection. The page calls this site's own /api/geo endpoint, which reads the metadata Cloudflare already attached to your request — your IP address, and the city, region, postal code, country, time zone and approximate coordinates Cloudflare derives from it — and returns them to your browser. The response is marked Cache-Control: no-store, so nothing between the Worker and your browser keeps a copy, and nothing is written down at our end.

Because Cloudflare's city label names the town your provider routes through rather than the one you are in, the Worker resolves Cloudflare's coordinates into a municipality name instead. That lookup is made server-side, by the Worker, and it carries the coordinates rounded to two decimal places — roughly a 1.1 km square — and nothing else. No IP address, no headers, no user agent, no identifier of any kind is sent, and the answer is cached for a day per square, so it is one request per square rather than one per visitor. The provider is BigDataCloud; if the lookup fails, the page falls back to Cloudflare's label.

Only if you press the button, from your device. Each of those pages offers a "use my precise location" control. Pressing it asks your browser for permission, and if you grant it, your browser sends the GPS coordinates your device reports — which are far more precise than the ones above — directly to BigDataCloud's keyless reverse-geocoding endpoint to be turned into a place name. That request goes from your browser, not from our Worker, so BigDataCloud sees your IP address for that call. Nothing happens until you press the button and grant the prompt; a standing browser permission is not enough on its own, and the coordinates are not stored by this site.

/youtube-transcript is the one tool that sends what you typed to a server. The video URL or ID goes to this site's /api/youtube-transcript endpoint, and the Worker fetches the video's published caption track from YouTube and returns it as text.

The fetch is made by the Worker, so YouTube sees a request from Cloudflare rather than from you: your IP address and browser are not forwarded. Successful transcripts are cached at the edge for a day, and unavailable ones for ten minutes, keyed by the video ID alone — there is no visitor identifier in the key or in the stored response, so the cache cannot be read backwards to say who looked up what.

Two services measure how the site is used, in aggregate. Neither is used for advertising, and neither receives anything you type into a tool.

• Google Analytics 4 (measurement ID G-DBB4CEMM4S) records standard usage events — pages viewed, referrer, approximate location derived from IP, device and browser type. It sets cookies; they are listed individually in the Cookie Policy. The tag is loaded after the page finishes loading, so it does not compete with the content.
• Cloudflare Web Analytics records page views and Core Web Vitals from a small beacon that Cloudflare injects at the edge. It is cookieless: it sets no cookie, writes nothing to your browser's storage, and does not build a fingerprint to track you across sites.

How to refuse both is covered in the Cookie Policy.

• No accounts, passwords, email lists or newsletters.
• No advertising, ad networks, retargeting pixels or affiliate trackers.
• No sale of personal information, and no sharing of it for cross-context behavioural advertising.
• No server-side database. There is nowhere for your content to be stored, because there is no store.
• No visitor profiles, and no attempt to link visits together beyond what the analytics cookies do on their own.
• No payment processing, so no card details ever reach this site.

By the site operator: nothing, because nothing is collected. There is no database, no log archive and no backup containing visitor data, and therefore no retention period to state.

By the processors, under their own schedules: Cloudflare keeps infrastructure logs and Web Analytics data as described in their policy; Google keeps analytics data for the retention window configured on the property, which for Google Analytics 4 is a choice between 2 and 14 months for user-level and event-level data, while aggregated reporting data is kept by Google beyond that. The links below go to the authoritative descriptions.

Cloudflare serves the site from whichever of its data centres is nearest to you, so page delivery generally happens in your own region. Google Analytics data is processed by Google, including in the United States, under the transfer mechanisms described in Google's policy. BigDataCloud is reached over the public internet and processes the lookup on its own infrastructure. the site operator operates no servers of its own, in any country.

• Legitimate interests — serving and securing the site, and measuring aggregate usage well enough to know which tools are worth maintaining.
• Consent — the precise location feature, which is gated behind your browser's own permission prompt and a deliberate press, and which you can withdraw at any time in your browser's site settings.

Analytics currently load on page view rather than after an explicit consent click. If you would rather they did not run at all, the Cookie Policy sets out how to block them, and blocking them does not affect any tool.

Depending on where you live you may have rights to access, correct, delete, port or object to the processing of your personal data — under the GDPR and UK GDPR, under the CCPA as amended by the CPRA, and under comparable laws elsewhere. Here is what those rights actually mean on a site with no accounts.

• Access, correction, deletion and portability — the site operator holds no account, no profile, no content and no log of your visits, so in almost every case there is nothing to retrieve, correct, export or erase. Asking will get you that answer, in writing, rather than a file.
• Rights against the analytics providers — the data that does exist sits with Google and Cloudflare, as the controllers or processors of their own products. Requests about it are best directed to them, and the policy links above are the entry points. Write to the address below and you will be pointed at the right one.
• Objection and opt-out — you can stop the analytics from running at all, from your side, without asking anyone: see the Cookie Policy.
• Do not sell or share my personal information — nothing is sold and nothing is shared for cross-context behavioural advertising, so there is no opt-out to operate. No financial incentives are offered, and nobody is treated differently for exercising a right, because there is no account to treat differently.
• Complaints — if you are in the EU, the UK or another jurisdiction with a data protection authority, you may complain to yours. Doing so first is not required, but it is always available.

The site is not directed at children, asks for no personal information, and has no way to collect it: there is no registration, no profile and no upload. No attempt is made to identify a visitor's age, because doing so would mean collecting more, not less.

Everything is served over HTTPS with HSTS, a strict Content Security Policy, and headers that forbid framing and MIME sniffing. The strongest protection is structural rather than a control: for almost every tool there is no upload and no server-side copy, so a breach of this site could not expose content it never held.

Vulnerability reports are welcome at the address in /.well-known/security.txt.

When this policy changes, the "last updated" date at the top moves and the new version applies from publication. There is no mailing list to notify, because no addresses are held. Material changes to what the site collects will be described here rather than folded silently into the text.

Privacy questions and requests go to jaredsburrows@gmail.com, the address published in /.well-known/security.txt.