Privacy

Last updated 24 October 2026

What we never collect

Files you drop into a tool, text you paste, and numbers you type into calculators never leave your device. Tools run in your browser. Nothing from the tools is ever uploaded. There are two things you can choose to send: a screenshot attached to a report on the contact page, and anything you write on the questions board.

A few tools exist to ask an outside service a question, and they send only that question, only when you press the button, and say so next to the box: the DNS, email-record and network lookups send the domain or address you type to a public DNS resolver (Cloudflare, cloudflare-dns.com, or Google, dns.google, whichever the tool names); WHOIS / RDAP lookups send the domain or address to the registry that holds it; the password strength checker sends only the first five characters of the password's SHA-1 hash to Have I Been Pwned (api.pwnedpasswords.com), never the password; and What Is My IP asks our own server which address it sees, which is not stored. Those services' own privacy policies cover what they receive.

Fifteen network and site checks run on our own server instead of in your browser, because a browser cannot send the packets they need or read another site's files and headers: Ping Test, Traceroute, Port Checker, SSL Checker, HTTP Headers Checker, SMTP Test, Is It Down, HTTP/2 and HTTP/3 Checker, TLS Version Checker, Mixed Content Checker, Open Graph Checker, Robots.txt Checker, Security.txt Checker, Sitemap Checker and MTA-STS and TLS-RPT Checker (which also looks up the domain's DNS records through the public DNS resolver it names, as the email-record lookups above do). The host name, address or web address you type is sent to our server in India, which checks it from there and sends you the result. For each check we log the tool, the host name (never the full web address or its query string), the outcome and a hashed, daily-rotated version of your IP address, for abuse prevention, kept for 30 days. The page says so next to the box. The host you check sees a connection from our server, not from you.

The URL Shortener is the one tool that keeps what you give it, because a short link has to be looked up on our server every time somebody opens it. When you shorten a link we store the long web address, its short code (random, or the custom ending you chose), the date it was created and the expiry you chose, how many times the short link was opened and when it was last opened, and a hashed, daily-rotated version of your IP address, used only to enforce the limits of 20 links an hour and 100 a day. We do not store your IP address itself, your browser's user agent, a cookie, or anything that names you. The long address and the hash are deleted when the link expires, or 12 months after it was last opened (12 months after it was created, if it was never opened), by a job that runs every day; the short code alone is kept after that, so that it is never given to somebody else. When the optional Google Safe Browsing check is switched on, the long address is sent to Google (safebrowsing.googleapis.com) to be compared with its list of harmful sites, once when the link is made and again from time to time while it is being used. If you report a link from its preview page, your report, and the email address if you leave one, is kept with our other reports for 12 months. Do not shorten a link that contains private information: anyone who has the short link, or adds + to it, can see the full address.

No Omnikit tool needs an account, and none asks you to sign in. One separate product does: Omnikit Billing for shop owners, at billing.theomnikit.com, is a billing app for restaurants. It is the only part of Omnikit that uses accounts and stores the owner's restaurant data (the menu, the bills and the day's totals), because a shop's records have to be kept between days and devices. It runs on its own address with its own sign-in, and its own privacy page there says what it stores, for how long, and how to delete the account and all of its data. Nothing from it is shared with the tools on this site.

What we collect

• Usage counts. When a tool runs, copies or downloads, the browser sends the tool name and the type of action. No content, no file names, no sizes beyond a rough bucket.
• Error reports. If a tool fails, the browser sends the error message and the tool name so we can fix it. Never the file or the input.
• Feedback and contact. What you type into the feedback box or the report form on the contact page is stored so we can read it, with the name, email address or phone number you give and any screenshot you attach, which is redrawn in your browser first so it carries no location or camera details. We do not store your IP address with it.
• Questions board posts. The name you post under and the message you write are public: they appear on the site and search engines can index them. An email address is optional, is never published or shown to any visitor, and is used for one thing only: telling you that someone replied. To stop the board being flooded, posting is rate limited against a hashed, daily-rotated version of your IP address, the same hash described below. The address itself is never stored.
• Server logs. Standard request logs with a hashed, daily-rotated version of the IP address, kept for 30 days, then deleted (error and security logs included).

Analytics and cookies

We use cookieless analytics, built here rather than bought in: no third-party analytics script runs on this site, and for analytics the page talks to nobody but us. The site sets no cookies for analytics. Your theme choice and tool settings are kept in your own browser storage and are never sent to us. Ads are off at present. When they are switched on they are served by Google AdSense, which loads Google's own scripts only below a tool's result, after a section's tools, at the end of the home page and at the end of an article, never inside a tool and never before it is ready; visitors in the EEA and UK are asked for consent before any ad script loads, and Google may then set its own cookies, which its policies govern. If you decline, ads are non-personalised. A link to a partner's product or service is always marked “Sponsored”, and it never changes what a tool calculates (see How this site is paid for).

What an analytics event contains

When you open a page or use a tool, the browser sends a short record of what happened. It holds the page you were on, the page on this site you came to it from, the tool and its category, what occurred (a page view, a file added to the page, a run, a download, a copy, a button press, a failure, a press on a partner link with which partner it was, and, only while ads are switched on, that an ad space on the page asked for an ad, with which of the four spaces it was and nothing about the ad itself; for a file added, only that one was, never its name, size or type), for a button press the button's fixed English name as written in our code (such as "Create PDF" or "Remove image", never a file name; a name that could hold one is recorded only as "button"), your browser's language as a two- or three-letter code (such as "es", without the region; with every event since 19 October 2026, before that with page views only), whether your browser machine-translated the page and into which language (a yes and a language code, never any of the text), how long the job took, a rough size bucket for the file, the host that referred you if there was one, any campaign tags in the address, how the page was opened (a link or a typed address, a reload, or the Back or Forward button; one word from a fixed list), whether the screen is phone, tablet or desktop size, your theme, your browser family and version (worked out by our server from the browser's user agent, which is then discarded), how quickly the page loaded and responded (Core Web Vitals, and since 19 October 2026 the total time the page took to load, a number of milliseconds your browser measures itself), if the page crashes, the kind of error from a fixed list of names (such as "TypeError"; never the error message, the line or the file, and at most three per page), and the country the request came from as a two-letter code (Cloudflare, which carries our traffic, adds it to every request; the address it was worked out from is not kept).

It never holds your file, your file name, the contents of anything you typed, your email address, your name, or your IP address. The one exception, and it has a reason: if you search our own search box and it finds nothing, that query is recorded so we can learn which words the search does not know. Email addresses, phone numbers, web links and long runs of digits are removed from it inside your browser before it is sent, and a search that found results is never recorded at all. A search that finds nothing, and a tool you suggest in the box shown then, are also kept as text in a list of wanted tools, never with who sent it, to decide what to build next. The assistant follows the same rule: what you ask it is answered inside your browser, and only a question it could not answer is recorded, cleaned the same way. When the search or the assistant cannot match your words on your device, the words alone, cleaned the same way, are sent to our own server, where a small language model finds the tools closest in meaning. That happens on our server and nowhere else: no outside AI service sees them, and the text is used for that one answer and then dropped, never stored or logged. Your files are never part of it.

How we count people without identifying them

To know how many people visited rather than how many pages were opened, our server combines your IP address and browser version with a secret that changes at midnight, turns the three into a fingerprint that cannot be reversed, keeps only that, and discards your IP. Because the secret is replaced daily, the same fingerprint cannot be produced again tomorrow, by us or by anyone who later reads our records. This lets us count visitors within a day. On its own it deliberately cannot tell us that you, in particular, came back next week. The visitor number described below can, and it is kept only where your choice allows it.

City and region, and your choice

With page views we also record the city and the region (a state or province) that Cloudflare, which carries our traffic, works out from the connection, such as "Pune, Maharashtra". Never the postcode, never an exact location, and never your IP address.

Who is asked. Visitors in the EEA, the UK and Switzerland (worked out from the country Cloudflare gives us) are asked first, in a small box at the bottom of the page. Their city and region, the new or returning labels and the visitor number described below, are recorded only if they press Accept. If they press Decline, or do not answer, their visits are counted exactly as before: the page, the tool, the country, the device type and the other details above, with no city, no region, no visit labels and no visitor number. Declining changes nothing about using the site. Visitors anywhere else are not asked: city and region are recorded with their page views, and they can still decline with the button below, after which nothing beyond the anonymous counts is recorded for them either.

What it is for. Only to monitor and improve the site's traffic: which pages and tools are used and where visitors come from. That tells us which languages to offer pages in (the site is available in English, Spanish, Arabic, French, German, Russian, Portuguese, Polish, Bengali, Hindi, Gujarati, Malayalam, Tamil, Urdu, Turkish, Indonesian and Vietnamese; switch with the language links at the top of a page or in the footer) and which free tools to build next for the places most visitors come from, such as salary and tax calculators for their country, so those visitors get more free tools for their own needs. It is never sold, never shared, and never used for advertising, for profiling or to identify anyone. Ads, when they are switched on, are served by Google AdSense and follow the choice you make in this site's consent box: Accept allows personalised ads, Decline means non-personalised ads, and in the EEA, the UK and Switzerland no ad script loads until you choose. Where Google shows its own certified consent message, that message applies as well. Ads do not use this data. If we ever wanted to use it for anything else, we would ask you again first.

How long, and what it is linked to. City, region, the visit labels and the visitor number are kept with no set end date, in the individual event records only, not in the daily totals. The records hold no name, no IP address and no account.

Changing your choice. Use Change my choice here, or "Privacy choices" in the footer of any page, at any time. Your choice is kept in your browser's own storage (localStorage, not a cookie) and travels with each analytics record as a yes or a no; clearing this site's data clears it, and visitors in the EEA, the UK and Switzerland are then asked again. A new choice applies from then on.

New and returning visitors, without an identifier

To know how many visitors are new and how many come back, your browser keeps a small note for this site in its own storage (localStorage, not a cookie). It holds exactly three things: the date of your first visit, the date of your most recent visit, and how many different days you have visited. The note stays on your device and is never sent to us.

With each page view, your browser sends only three rough labels worked out from that note: whether today is your first day here or you have been before; how long since your previous visit, as one of "the same day", "1 day", "2 to 7 days", "8 to 30 days" or "more than 30 days"; and how many days you have visited, as one of "1", "2 to 3", "4 to 10" or "11 or more". No date and no identifier is part of these labels: they are deliberately coarse, are not an identifier, and are not used to link your visits to each other. If your browser blocks storage, nothing is sent for this and the visit is counted as "unknown". In the EEA, the UK and Switzerland the note is kept, and the labels sent, only after you accepted; if you decline, the note is deleted. Anywhere else the same happens if you decline.

You can delete the note at any time by clearing this site's data in your browser. To stop all analytics from your browser, open any page of this site once with ?notme=1 at the end of the address: the browser then sends no analytics events at all and the note is deleted. Crawlers and automated browsers never get a note.

Numbered visitors

To understand how the site is used and what to build next, such as which pages people come back to and which tools they use on their second visit, your browser may keep a random visitor number for this site in its own storage (localStorage, not a cookie). It is a random code made by your browser the first time it is allowed: it is not worked out from your IP address, your device, your browser or anything else about you, and no fingerprinting is used. It is sent with each analytics record, and our server gives it a plain sequence number ("Visitor 12"), which is all our own screens show.

With it we can see, for that number only: which pages it viewed and in what order, which pages it came back to, on how many days and in which months it visited, which tools it ran, whether a visit was its first or a later one (a visit is one browser tab), which pages and tools it used in each visit and how many visits came back to the same tool, and the country, and the city and region where those are recorded as described above. Without a visitor number, nothing says whether a visit is a first or a returning one: it is shown to us as "not recorded", never guessed. No name, email address, IP address or exact location is ever joined to it, and it is used for nothing else: not for advertising, not for profiling, not sold and not shared.

It is kept only where your choice allows it, by the same rule as the visit labels: in the EEA, the UK and Switzerland only after you press Accept; anywhere else unless you press Decline. If you decline, or open any page with ?notme=1, no number is created and any existing one is deleted from your browser. Crawlers, automated browsers and page-speed testers never get one. Clearing this site's data in your browser deletes it; if you come back, you are a new number. The records already sent under the old number are kept like the other analytics records, with no set end date, and hold nothing that names you.

A random identifier does group the pages you view in one browser tab, so we can tell that one visit saw four pages rather than four visits seeing one each. It is created when the tab opens and destroyed when you close it.

How long any of it is kept

Individual event records are kept with no set end date: nothing deletes them automatically. They hold no name, no IP address and no account. Alongside them we keep daily totals per page and tool, broken down by device type, browser family, country and referring site, and counts of how many people visited each day, split into new and returning and by the two other labels described above; the totals contain no visitor information of any kind and no city or region. Searches that found nothing are not in the totals; they are kept with the individual records.

The microphone

Five tools listen through your microphone: Sound Level Meter, Room Echo Test (RT60), Speaker and Mic Test, Frequency Response Sweep, and Measure Distance with Sound. Each of them says so before it asks, and the browser only asks once you press the button. The sound is measured inside the page as it arrives: nothing is recorded to a file, kept after the measurement, or sent to us or anyone else, and the microphone is released the moment you stop or leave the page. What is saved is the setting you chose, such as an air temperature, in your own browser.

The camera

The QR code scanner can use your camera, and it is the only tool that can: the browser asks when you press the button to scan, the picture is read inside the page and never recorded or sent anywhere, and the camera is released as soon as a code is read or you leave. You can always choose a photo or screenshot instead. Your location is switched off for this site at the server, so nothing here can request it.

The questions board

Anyone can post a question or a reply, with no account. The name you type and the message you write are public: they sit on the site for anyone to read and search engines can index them. Write nothing there you would not want a stranger to read. An email address is optional; if you give one it is never published, never shown to another visitor, and used for one thing only, which is telling you that someone replied.

Nothing appears straight away. Every post and every reply is held until we approve it. A post we reject, and anything we treat as spam, is deleted, and any email address attached to it goes with it. If you want a post of yours taken down, ask through the contact page.

Your files

None of the above involves the files you use in the tools, because they never reach us: every tool runs inside your browser, and there is no upload. The only image that can reach us is a screenshot you attach to a report yourself.

Lawful purpose and retention

We process the data above to run and improve the site (legitimate interest) and, for feedback and contact, to reply to you (consent). For visitors in the EEA, the UK and Switzerland, city, region, the new or returning labels and the visitor number are processed only with consent, given and changed as described above. Usage counts are aggregated per day and kept indefinitely without personal data, and the individual analytics records are kept with no set end date. Feedback and messages are kept for 12 months. An approved board post stays up until you ask for it to be removed or we take it down; a rejected post is deleted straight away, together with any email address attached to it.

Your rights

You can ask what we hold about you, ask for it to be deleted, or object to processing. Because we do not identify visitors, most requests apply only to messages you sent us. A post on the questions board counts as one: say which post is yours and it will be removed, along with any email address attached to it. Write to us through the contact page.

Children

The site is not directed at children under 13 and we do not knowingly collect their data.