Privacy

What stays on your device

• Every file you open and every word you type or paste. The tools read and change them inside your browser; they are not uploaded, and there is no server here that could receive them.
• The results. A merged PDF, a smaller photo or a converted file is made in your browser and saved straight from it.

What your browser keeps

A few things are kept in your browser, on this device only, so the site opens the way you left it:

• each tool’s settings (an indent, a unit, a format, a quality) and the wallpaper;
• the tools pinned to the dock, and the ones you used last;
• the cities you added to the Time Zone Converter;
• the timers you set and the stopwatch with its laps, so a reload brings them back;
• column mappings you save by name in the CSV Viewer & Editor: the column names, their kinds and checks, never the rows;
• the notes you write in the Notepad, in the browser’s IndexedDB. Locked with a password, they are kept encrypted with a key made from it on your device; a note you delete is taken out at once.

None of it is sent anywhere, and clearing this site’s data in your browser removes all of it. Anyone who uses this browser on this device can open what it keeps, except notes under a lock. The colours picked in the Color Picker and the passwords copied in the Password Generator are kept only while the page is open.

What is counted

The site counts its visits with Umami, on its own server rather than at an analytics company. A visit records the page you arrived on, the tools you open (by name, never what you put in them), the site that linked you here, your country, and general details of your browser and device. It sets no cookie and does not keep your IP address. If your browser sends Do Not Track or Global Privacy Control, nothing is counted.

Who sees a request

The pages are delivered through Cloudflare. Like any network that carries web pages, it sees each request (your IP address, the address you asked for and your browser’s name) in order to deliver it, and handles that under its own privacy policy. The server behind it writes no log of requests; the count above is the only record of a visit it keeps. The site sets no cookies and shows no advertising, and its fonts and scripts come from its own address, not from other companies’ servers.

How to check

Open your browser’s developer tools, choose the Network tab and use any tool: what you open, type or paste makes no request. The one a tool sends is the count as it opens (to /stats/api/send), which names the tool and nothing in it. The site’s Content Security Policy also forbids the page to connect anywhere but its own address, so a script that tried could not.

Questions

Write to hello@utilbrew.com about anything on this page.