Privacy

Nothing you paste leaves your browser

Every tool on this site is JavaScript running in your tab. It reads what is already in memory there, transforms it, and writes the result back onto the page. There is no upload step because there is nothing to upload to. The site is static files behind CloudFront, and a static file cannot receive anything.

Images are read by a canvas in your own browser, and the OCR engine downloads to your machine rather than taking your screenshot to an API. Bookmark and Share send nothing either; your own device does both. JWTs matter most: a token pasted into a hosted decoder is a live credential handed to a stranger.

You don't have to take our word for any of this. Open your browser's network panel, use any tool on the site, and watch what goes out.

What does reach a server

Loading a page is still a network request, and a few features make their own. The complete list:

• The newsletter formThe signup box below each tool is Cognito Forms, and their script draws it into this page rather than a frame of its own. Their code runs here with the reach any script on this page has, and it loads only if you scroll far enough to see the box. We get an email address if you type one in and submit it, and nothing otherwise.
• Libraries and the typefaceA few tools need something too large to ship with the page: Prettier, Terser, Less.js, Tesseract, Pyodide, Monaco. These arrive from jsDelivr on first use, except Less.js, which comes from Cloudflare cdnjs. Page text is set in a font from Google Fonts. Each host sees that a browser asked for a file, and none can see what you paste in.
• The promo cardThe card under each tool reads a small ads.json from this site's own CloudFront distribution. One file, byte-identical for everyone, with no idea who asked for it.
• Web server logsCloudFront logs requests the way every web server does: IP address, user agent, path, timestamp. Kept briefly for security and debugging, never read for individual behaviour.

Analytics, and only if you say so

This site runs Google Analytics, the one thing here that waits to be allowed. A bar on your first visit asks. Until you answer, no script is fetched and nothing is sent; say no and none of it ever loads. The footer link marked Analytics changes your mind either way, whenever you like.

What it collects is ordinary: which pages you opened, which tool you used, where you arrived from, your browser, and a rough location from your IP address. It never sees what you typed into a tool, because that is not sent anywhere at all. Two hosts serve it, googletagmanager.com and google-analytics.com, the only requests here that wait for permission.

Cookies, and what your browser keeps

Two cookies, set by this site and only once you agree: _ga and _ga_QL55XG2BYQ. They tell Google Analytics that two visits came from one browser, last two years, and are deleted when you turn analytics off. A _ga from zinconlinesolutions.com may already be on your browser; that one is the main site's, and is managed there.

Local storage holds five things, all of them yours: your theme, the colour picker's recent swatches, the tools you have starred, the handful you used most recently, and your answer about analytics. None of it is sent anywhere, and clearing your site data removes the lot.