Last updated
Anything you type into a tool stays in your browser. We never receive it, so we cannot store, read, log or lose it. The only data we collect is an aggregate, per-day count of which tool pages were opened and which searches found nothing — with no identifiers attached.
All 55 tools are implemented in JavaScript that executes on your device. Your JSON, tokens, passwords, images and text are processed locally and are never transmitted. You can verify this by opening your browser’s developer tools, selecting the Network tab, and typing into any tool: nothing is sent as you type, and nothing is sent when you press Copy or Download.
To be precise rather than merely reassuring: one request is made when a tool page first loads, and its entire body is the tool’s name — for example {"slug":"json-formatter"}. It fires on page load, before any input exists, so it cannot contain your data. It is described under “Aggregate tool usage” below, and it is suppressed entirely if your browser sends Do Not Track or Global Privacy Control.
This includes the security tools specifically. A JWT pasted into our decoder is decoded locally; a password from our generator is generated locally.
We store one counter per tool per day: the tool’s slug, the date, and a count. No IP address, session identifier, user agent, referrer or tool input is recorded. It is not possible to derive an individual’s activity from this data — the database literally contains rows of the form { slug: "jwt-decoder", day: "2026-08-03", count: 412 }.
Your IP address is used transiently, in memory, to rate limit abusive requests. It is never written to a database or a log we retain.
When a site search returns no results we record the query text and a per-day count. This tells us which tools people expect and we have not built. Searches that return results are counted the same way. Again, no identifiers are attached.
If you subscribe, we store your email address, the page you subscribed from, and timestamps for subscription and confirmation. We use double opt-in, so the address is unconfirmed until you click the link we send. We do not sell, rent or share the list. Every email includes a working one-click unsubscribe.
We use Google Analytics 4 to measure page traffic, and it sets analytics cookies — typically _ga and _gid. It records the page URL, referrer, approximate location and device type, with IP anonymisation enabled. We do not enable Google Signals, advertising features or remarketing within Analytics.
Google Analytics is suppressed entirely when your browser sends a Do Not Track or Global Privacy Control signal: no cookie is set and no request is made. Any content blocker will also stop it, and nothing on the site depends on it working.
We also show ads through Google AdSense, which sets its own cookies and may read an existing Google advertising cookie to select and measure ads. Unlike Analytics, ads are not suppressed under Do Not Track — ad revenue is what keeps every tool here free, so we serve them to all visitors and would rather say so directly than imply otherwise. See Advertising below for how to turn off personalisation or block ads entirely.
We run no session recording and no cross-site tracking of our own. We use localStorage for one thing: remembering your light/dark theme preference, which never leaves your device. The site also sets a session cookie for the admin dashboard, which is irrelevant unless you are an administrator.
Ads are served by Google AdSense. Google is an independent controller for the data it collects through them, under its own policy for partner sites. It receives the page URL, your IP address, device and browser information, and may use cookies or similar identifiers to limit how often you see the same ad, measure performance, detect fraud and — where permitted — personalise which ads you see.
You have three practical ways to change this:
If you are in the EEA, the UK or Switzerland, Google presents a consent message before personalised ads are shown, and your choice is recorded there rather than by us.
Ads never see your tool input. They are ordinary page content, in a sandboxed frame, with no access to what you type — the section below spells out why that is structural rather than a promise.
The site is hosted on Vercel and served through Cloudflare, both of which process standard server request logs (including IP address) as part of delivering the site, under their own privacy policies and as our data processors. If a database is configured for the newsletter, it is MongoDB Atlas, also acting as a processor.
Three third-party scripts run on the site. Two are Google’s — Analytics 4 and AdSense — and both load after the page becomes interactive rather than blocking the first render. The third is Cloudflare Web Analytics, which our CDN adds to measure page performance; it is cookieless and does not fingerprint or track you between sites. We embed no session recording, no social widgets, no tag manager and no other ad network.
Importantly, none of this affects the core guarantee above: tool input is processed entirely in your browser and is never transmitted to anyone, including Google. This is a property of how the site is built rather than a policy we could quietly change — the transforms are JavaScript functions running on your device, there is no endpoint to send your text to, and an ad in a cross-origin frame cannot read the page around it. Google sees which page you visited; never what you typed into it. You can confirm all of it in the Network tab.
Under the GDPR, UK GDPR and CCPA you have rights of access, correction, deletion, portability and objection. For tool usage there is nothing to exercise them against, because the data holds no personal identifiers. For a newsletter subscription, email hello@tweakpad.site and we will action any request within 30 days. You can also unsubscribe instantly from any email.
Aggregate counters are retained indefinitely, as they contain no personal data. Newsletter records are kept until you unsubscribe, then deleted within 30 days apart from a suppression record needed to honour the unsubscribe.
The site is not directed at children under 13 and we do not knowingly collect their personal information.
If this policy changes materially we will update the date above. Because we hold no accounts, there is no way for us to notify you directly.
Questions about this policy: hello@tweakpad.site.