Privacy & Terms
Written from what the code actually does rather than from a template. Where the answer is “it depends on the tool”, that is said plainly instead of averaged into something reassuring.
These 10run entirely in your browser. What you type, paste or record is processed on your own machine and no request carrying it is made at all — you can confirm this in your browser’s network tab:
The password checker is the one partial exception, and only by design: if you opt into the breach check it sends the first five characters of your password’s SHA-1 hash to Have I Been Pwned. That is k-anonymity — the password itself and the full hash never leave your machine.
Every other tool sends your input to this project’s backend, a container running on a Hugging Face Space. In almost all cases the file is decoded, processed in memory and discarded when the response is returned — it is never written to disk.
The exception is Multimodal RAG. That tool has to store what you upload, because its whole purpose is to index a document so you can ask questions about it afterwards. Text chunks and embeddings are written to a vector database on the server. That storage is not encrypted, is not access-controlled per user, and sits on a free Hugging Face Space whose disk is wiped whenever the Space restarts or rebuilds. Treat it as a scratchpad: do not upload anything confidential.
Some tools call a hosted language or vision model. When they do, the relevant part of your input is sent to that provider and is subject to their terms, not this site’s. The providers used are Mistral, Google Gemini, Groq and Cohere.
Where a tool can avoid sending your raw input it does. The SIEM Alert Triage tool, for example, groups and deduplicates your log in the browser first and sends only the summarised groups onward — never the raw log.
Basic usage analytics are stored: the event type, the page path, a random session id, the referrer, how long you stayed, and a two-letter country code derived from the request. Your IP address is not stored with analytics.
The backend separately logs security events — a blocked origin, a rate-limit hit, an oversized request, a file that matched a malware-scanning rule. Those entries do include the requesting IP address, because that is the point of them. They are operational logs on the Space and are not combined with the analytics above.
Everything here is free to use, with no account and no payment. There is no uptime guarantee: this runs on free hosting, the backend sleeps when idle, and it can be unavailable or slow.
The security and forensics tools are demonstrations of real techniques, not certified instruments. Several say so on their own page, and where a tool cannot reliably answer something it says that instead of guessing. Do not rely on any of them as the sole basis for a security, legal, medical or financial decision.
Only scan domains and analyse files you are authorised to. Please do not upload other people’s personal data.
Anything unclear or anything here that looks wrong — the source is public on GitHub, or get in touch via the contact form.