Privacy & Terms
Written from what the code actually does rather than from a template. Where the answer is “it depends on the tool”, that is said plainly instead of averaged into something reassuring.
These 10 run entirely in your browser. What you type, paste or record is processed on your own machine and no request carrying it is made at all — you can confirm this in your browser’s network tab:
The password checker is the one partial exception, and only by design: if you opt into the breach check it sends the first five characters of your password’s SHA-1 hash to Have I Been Pwned. That is k-anonymity — the password itself and the full hash never leave your machine.
Every other tool sends your input to this project’s backend, a container running on a Hugging Face Space. In almost all cases the file is decoded, processed in memory and discarded when the response is returned — it is never written to disk.
The exception is Multimodal RAG. That tool has to store what you upload, because its whole purpose is to index a document so you can ask questions about it afterwards. Text chunks and embeddings are written to a vector database on the server. That storage is not encrypted, is not access-controlled per user, and sits on a free Hugging Face Space whose disk is wiped whenever the Space restarts or rebuilds. Treat it as a scratchpad: do not upload anything confidential.
Some tools call a hosted language or vision model. When they do, the relevant part of your input is sent to that provider and is subject to their terms, not this site’s. The providers used are Mistral, Google Gemini, Groq and Cohere.
Where a tool can avoid sending your raw input it does. The SIEM Alert Triage tool, for example, groups and deduplicates your log in the browser first and sends only the summarised groups onward — never the raw log.
Separately, when something breaks unexpectedly a diagnostic report is sent to Sentry, a third-party error-monitoring service, so the fault can be found and fixed. That report contains the error and where it happened in the code, the page you were on, and your browser — never anything you typed, pasted or uploaded, no request contents, no IP address, and no recording of your screen. It is sent only when an error actually occurs, not on a normal visit.
On a small sample of visits (about one in ten), Sentry also records anonymous page-speed measurements — how long the page took to load and become interactive, and which page — numbers only, with the same limits: nothing you typed or uploaded, no request contents, no IP address, and still no recording of your screen.
Basic usage analytics are stored: the event type, the page path, a random session id, the referrer, how long you stayed, a two-letter country code derived from the request, and your browser's time zone (for example Asia/Kolkata), which is used as a rough region when the country cannot be determined. Your IP address is not stored with analytics.
Alongside each event a small amount of structured detail is stored, and it is deliberately limited to counts, sizes, durations and fixed choices — for example which tool you used, how long a run took, whether it succeeded, and if it failed, a category such as “rate limited” or “timed out” with the HTTP status. Each run is given a random id so a click can be matched to its outcome.
Within a tool, the name of a control you use is recorded — for example that you opened the region selector, switched the model provider, or moved a slider — so we can see which features are actually used. The control's name only, never anything you typed into it, and never for the password tool.
None of it contains what you typed or uploaded. Document text, prompt text and search terms are never written to the analytics store. Where the length of something is useful, the length is recorded and the text is not.
Analytics are kept for 14 months, then deleted automatically. That is long enough to compare one year against the next, and short enough that nothing is being hoarded. The deletion runs as a scheduled database job, not by hand.
The backend separately logs security events — a blocked origin, a rate-limit hit, an oversized request, a file that matched a malware-scanning rule, an archive that would expand to an unsafe size, or uploaded document text that resembled instructions aimed at the AI. Those entries do include the requesting IP address, because that is the point of them. They are operational logs on the Space and are not combined with the analytics above.
When something breaks unexpectedly, a diagnostic record is also stored in this site’s own database so the fault can be found and fixed: the error and where it happened in the code, the page you were on, and your browser. It never contains what you typed, pasted or uploaded, no request contents, and no IP address; the page address has any query part removed first, and the password tool is excluded entirely. This is the same information sent to Sentry above — kept here too so it survives even when the third-party service is not used.
In Testwright (the QA tools), if you choose to “Share” a test run, a read-only report of that run is stored so anyone with the link can open it: the test name, whether it passed or failed, the failure reason, the step list with timings, and a link to the GitHub run. The test’s code is stored only if you tick the “include the test code” box on the Share action; it is off by default. Nothing else from your browsing is included. The link is unguessable and anyone who has it can read the report; shared reports are deleted automatically after 90 days.
In Testwright, when a test run finishes, a content-light record of it is logged so the Run dashboard can show your history across devices, not just the current browser: the test name, whether it passed or failed, the per-test counts, whether it was flaky, the run timing, the failure reason, and a link to the GitHub run. The test’s code is never included, and no screenshot, video or trace is stored. These records are not readable by anything on this site and exist only to power your own dashboard.
When you upload a file, a short record of it is kept for 30 days so that abuse can be investigated: the filename, its type and size, and a SHA-256 fingerprint of its contents. The file itself is not kept — it is discarded once the tool has answered, and the fingerprint cannot be turned back into it. The fingerprint exists so that if a malicious file is identified later, it can be recognised without any copy having been stored. These records are deleted automatically after 30 days and are not readable by anything on this site. They also hold a scrambled, one-way form of the requesting IP address — not the address itself — used only to stop the same source flooding the log. It cannot be turned back into an address. If bot protection is enabled, that check is performed by Cloudflare Turnstile, which sees your IP and browser characteristics in order to tell a person from a script; it does not use tracking cookies and is not used to identify you across sites. It runs invisibly — there is nothing to click and no puzzle to solve. Cloudflare’s handling of that data is described in their Turnstile Privacy Addendum, which Cloudflare requires be referenced here as a condition of running it invisibly.
Filenames are the one part of this worth spelling out: report.pdf reveals nothing, but a filename can carry a person’s name. It is kept because a name without the document is a far smaller exposure than the document itself, and only under the 30-day limit above. The Password Strength checker is excluded from this entirely — nothing you type there leaves your browser, and no record of it is made anywhere.
Everything here is free to use, with no account and no payment. There is no uptime guarantee: this runs on free hosting, the backend sleeps when idle, and it can be unavailable or slow.
The security and forensics tools are demonstrations of real techniques, not certified instruments. Several say so on their own page, and where a tool cannot reliably answer something it says that instead of guessing. Do not rely on any of them as the sole basis for a security, legal, medical or financial decision.
Only scan domains and analyse files you are authorised to. Please do not upload other people’s personal data.
Anything unclear or anything here that looks wrong — the source is public on GitHub, or get in touch via the contact form.