Privacy & Data Usage

Our commitment

Online Toolbox does not collect personally identifiable information. Most tools run locally in your browser; a few (such as Office → PDF) upload to a server for processing, and temporary files are cleaned up in the background (deleted within 10 minutes at most). This site uses self-hosted Umami for anonymous traffic analytics (no cookies, no personal identification) — see the details below. No account or email required.

What we don\'t do

1. We do not abuse your input: local tools process everything in your browser (JSON, passwords, hash inputs); server-side files are used only for that single conversion and temporary files are cleaned up in the background (deleted within 10 minutes at most)
2. No identity collection: no signup, no email, no name, no phone number
3. No tracking cookies: we only use one httpOnly cookie for language preference; Umami analytics is completely cookie-free (privacy by design, below the GDPR consent threshold)
4. No personally identifiable collection: Umami records only anonymous visit data (page views, referrer, device type — aggregate metrics). No name, email, or phone number is ever collected
5. No third-party fonts: no Google Fonts, we use your system\'s native fonts
6. Always free: core features stay free and will never become paywalled
7. No marketing emails: we don\'t collect emails, so we never send any

What we store (only this)

We only store 3 preference keys in your browser\'s localStorage (to remember your settings):

You can clear our localStorage anytime in your browser settings. All preferences reset to default, and no tool functionality is affected.

Session storage (cleared with the tab)

Besides localStorage, the site uses sessionStorage for **same-tab** hand-off only - closing the tab clears everything; nothing is kept across sessions and nothing is uploaded:

Closing the tab clears it; you can also run sessionStorage.clear() in the console. Note: the hand-off lives on your machine, but **avoid processing sensitive code on shared computers**.

Third-party services

Current infrastructure and third-party services used by this site:

• CDN acceleration:Cloudflare (overseas) / Aliyun CDN (domestic, after filing), only proxies static files (HTML / CSS / JS / images),never touches your input data
• Hosting:Vercel (overseas) / Aliyun ECS (domestic), only provides static site hosting,no backend business logic, no database
• Self-hosted Umami (analytics): open-source (MIT), self-hosted anonymous analytics tool to understand site usage and improve services. Cookie-free, collects only page views, referrer, and device type. No personal identity. Data stored in our own Supabase PostgreSQL, never shared. Repo: https://github.com/umami-software/umami
• Baidu Union (ads): display ad slots served by Baidu (see homepage ad section)

Anonymous visit analytics (ranking + Umami)

This site has two kinds of anonymous analytics: 1. **In-site stats** (homepage popular-tools ranking): records "tool visited" events. **Only date + slug + count are stored**. No IP / UA / Referer / Cookie. Used solely for in-site ranking, never shared. 2. **Umami** (self-hosted, cookie-free): anonymous aggregate metrics of page views, referrer, and device type, to understand site usage. No cookies, no personal identity, respects browser Do Not Track.

Tracking parameters in share links (utm)

To know which tools get shared and how much traffic that brings back, share links generated by this site carry three parameters. They **describe the traffic source, not you**:

• The "Copy share link" button: the current tool URL plus utm_source=share&utm_medium=copy&utm_campaign=<tool-slug>
• "Keep learning / Next tool" links in the output area: utm_source=tool&utm_medium=workflow&utm_campaign=<tool-slug>

Umami reads these parameters into source/medium/campaign reports (the same format ad campaigns use) so we can tell which tools actually spread. You never have to click them, and stripping everything after the ? in the URL changes nothing about how the tools work.

Server-side SQLite database (data/usage.db), auto-cleaned after 90 days.

Umami compliance

This site uses self-hosted Umami (open-source, cookie-free anonymous analytics), committed to:

1. Cookie-free: Umami uses no cookies — below the GDPR consent threshold
2. Anonymity: page views and aggregate metrics only (referrer, device type), no raw IP/UA fingerprint
3. Do Not Track respected: script sets data-do-not-track; DNT-enabled browsers are not tracked
4. Data sovereignty: data stored in our self-hosted Supabase, never shared with Umami/third parties
5. Open-source auditable: Umami is MIT-licensed, collection logic is auditable
6. Anonymous visitor ID: to tell returning visits from new ones, a random ID is generated on your first visit (not derived from device info, not tied to any account) and stored in our own Umami database. It is used only for aggregate metrics such as unique visitors, contains no name/email/phone, and is never used for cross-site identification. Clearing this site's data regenerates it.

Regional compliance

Data flow

You (browser)
  ├─ Input box (JSON / password / file)
  │    ↓
  ├─ JS processing inside browser (Web Crypto / Canvas / WASM)
  │    ↓
  └─ Result shown to you (never leaves the browser)

Your localStorage (7 keys)
  ├─ 3 preference keys (theme / mode / language)
  ├─ recent tools + input snapshots (only on pages you used them)
  └─ usage counters / config version

Your sessionStorage (same tab only)
  └─ tool-to-tool handoff of your last output (max 5 minutes)

Site server (Aliyun ECS)
  ├─ Static files only; never touches your input
  ├─ Server-side tools (Office → PDF): temp files cleaned within 10 minutes
  └─ Anonymous analytics (Umami): no cookies, no IP stored

Change log

Questions

📮 Email: cynixway@vba.net (reply within 72 hours)