Privacy & Data Usage

Our commitment

Online Toolbox collects no personally identifiable information. Most tools run locally in your browser; a few (e.g. Office-to-PDF) upload files to our server for processing — auto-deleted after 5 minutes. We use self-hosted Umami for anonymous, cookie-free visit analytics (no personal identification — see below). No signup, no email required.

What we don\'t do

1. No misuse of your input: local tool inputs (JSON, passwords, hash text) stay in your browser; server-side tool files are used only for that request and auto-deleted after 5 minutes
2. No identity collection: no signup, no email, no name, no phone number
3. No tracking cookies: we only use one httpOnly cookie for language preference; Umami analytics is completely cookie-free (privacy by design, below the GDPR consent threshold)
4. No third-party fonts: no Google Fonts, we use your system\'s native fonts
5. Always free: core features stay free and will never become paywalled
6. No marketing emails: we don\'t collect emails, so we never send any

What we store (only this)

We only store 3 preference keys in your browser\'s localStorage (to remember your settings):

You can clear our localStorage anytime in your browser settings. All preferences reset to default, and no tool functionality is affected.

Third-party services

Current infrastructure and third-party services used by this site:

• CDN acceleration:Cloudflare (overseas) / Aliyun CDN (domestic, after filing), only proxies static files (HTML / CSS / JS / images),never touches your input data
• Hosting:Vercel (overseas) / Aliyun ECS (domestic), only provides static site hosting,no backend business logic, no database
• Self-hosted Umami (analytics): open-source (MIT), self-hosted anonymous analytics tool to understand site usage and improve services. Cookie-free, collects only page views, referrer, and device type. No personal identity. Data stored in our own Supabase PostgreSQL, never shared. Repo: https://github.com/umami-software/umami
• Baidu Union (ads): display ad slots served by Baidu (see homepage ad section)

Umami compliance

This site uses self-hosted Umami (open-source, cookie-free anonymous analytics), committed to:

1. Cookie-free: Umami uses no cookies — below the GDPR consent threshold
2. Anonymity: page views and aggregate metrics only (referrer, device type), no raw IP/UA fingerprint
3. Do Not Track respected: script sets data-do-not-track; DNT-enabled browsers are not tracked
4. Data sovereignty: data stored in our self-hosted Supabase, never shared with Umami/third parties
5. Open-source auditable: Umami is MIT-licensed, collection logic is auditable

Anonymous visit analytics (ranking + Umami)

This site has two kinds of anonymous analytics: 1. **In-site stats** (homepage popular-tools ranking): records "tool visited" events. **Only date + slug + count are stored**. No IP / UA / Referer / Cookie. Used solely for in-site ranking, never shared. 2. **Umami** (self-hosted, cookie-free): anonymous aggregate metrics of page views, referrer, and device type, to understand site usage. No cookies, no personal identity, respects browser Do Not Track.

Server-side SQLite database (data/usage.db), auto-cleaned after 90 days.

Regional compliance

Data flow

You (browser)
  ├─ Input box (JSON / password / file)
  │    ↓
  ├─ JS processing inside browser (Web Crypto / Canvas / WASM)
  │    ↓
  └─ Result shown to you (never leaves the browser)

Your localStorage
  └─ Only 3 preference keys (theme / mode / language)

Site server (Vercel / Aliyun)
  └─ Only proxies static files; never touches your data

Questions

📮 Email: cynixway@vba.net (reply within 72 hours)