Last updated
Anything you type into a tool stays in your browser. We never receive it, so we cannot store, read, log or lose it. The only data we collect is an aggregate, per-day count of which tool pages were opened and which searches found nothing — with no identifiers attached.
All 45 tools are implemented in JavaScript that executes on your device. Your JSON, tokens, passwords, images and text are processed locally and are never transmitted. You can verify this by opening your browser’s developer tools, selecting the Network tab, and typing into any tool: nothing is sent as you type, and nothing is sent when you press Copy or Download.
To be precise rather than merely reassuring: one request is made when a tool page first loads, and its entire body is the tool’s name — for example {"slug":"json-formatter"}. It fires on page load, before any input exists, so it cannot contain your data. It is described under “Aggregate tool usage” below, and it is suppressed entirely if your browser sends Do Not Track or Global Privacy Control.
This includes the security tools specifically. A JWT pasted into our decoder is decoded locally; a password from our generator is generated locally.
We store one counter per tool per day: the tool’s slug, the date, and a count. No IP address, session identifier, user agent, referrer or tool input is recorded. It is not possible to derive an individual’s activity from this data — the database literally contains rows of the form { slug: "jwt-decoder", day: "2026-08-03", count: 412 }.
Your IP address is used transiently, in memory, to rate limit abusive requests. It is never written to a database or a log we retain.
When a site search returns no results we record the query text and a per-day count. This tells us which tools people expect and we have not built. Searches that return results are counted the same way. Again, no identifiers are attached.
If you subscribe, we store your email address, the page you subscribed from, and timestamps for subscription and confirmation. We use double opt-in, so the address is unconfirmed until you click the link we send. We do not sell, rent or share the list. Every email includes a working one-click unsubscribe.
We use Google Analytics 4 to measure page traffic, and it sets analytics cookies — typically _ga and _gid. It records the page URL, referrer, approximate location and device type, with IP anonymisation enabled. We do not enable Google Signals, advertising features or remarketing.
Google Analytics is suppressed entirely when your browser sends a Do Not Track or Global Privacy Control signal: no cookie is set and no request is made. Any content blocker will also stop it, and nothing on the site depends on it working.
Beyond analytics we run no advertising, no session recording and no cross-site tracking. We use localStorage for one thing: remembering your light/dark theme preference, which never leaves your device. The site also sets a session cookie for the admin dashboard, which is irrelevant unless you are an administrator.
The site is hosted on Vercel, which processes standard server request logs (including IP address) as part of delivering the site, under its own privacy policy and as our data processor. If a database is configured for the newsletter, it is MongoDB Atlas, also acting as a processor.
Google Analytics 4 is the only third-party script on the site. It is loaded after the page becomes interactive so it cannot slow the page down, and it is not loaded at all when Do Not Track is set. We embed no ad networks, no session recording, no social widgets and no tag manager.
Importantly, this does not affect the core guarantee above: tool input is processed entirely in your browser and is never transmitted to anyone, including Google. Analytics sees which page you visited, never what you typed into it.
Under the GDPR, UK GDPR and CCPA you have rights of access, correction, deletion, portability and objection. For tool usage there is nothing to exercise them against, because the data holds no personal identifiers. For a newsletter subscription, email hello@tweakpad.site and we will action any request within 30 days. You can also unsubscribe instantly from any email.
Aggregate counters are retained indefinitely, as they contain no personal data. Newsletter records are kept until you unsubscribe, then deleted within 30 days apart from a suppression record needed to honour the unsubscribe.
The site is not directed at children under 13 and we do not knowingly collect their personal information.
If this policy changes materially we will update the date above. Because we hold no accounts, there is no way for us to notify you directly.
Questions about this policy: hello@tweakpad.site.