Privacy

Last updated: 19 October 2026

Most of our tools never send your files anywhere: they do the work in your browser tab. Two features use our server, Send and share links, and both encrypt in your browser first, with a key we never receive. The manifesto explains why. This page lists every connection the site makes, so you can check it.

Opening any page

Cloudflare carries every request to this site, as the network in front of our server. It sees your IP address, your browser and the address of the page, including anything after a ?. It never sees the part of a link after a #.
Our server keeps an access log for fixing problems: the time, the page path (without anything after a ?), and the browser. It records the address of the machine that passed the request on, not your IP address. If a request fails, the error log can hold the IP address that made it. We have not yet set a fixed time after which these logs are deleted. We are setting one, and it will be stated here.
Our page counter (Plausible, which we host ourselves at analytics.sites.studio, so the data goes to no one else) receives one message per page you open: the page path, the path of the page you came from, and your browser details that come with any request. No cookies, no identifiers, nothing after a ? or a #, and nothing from inside a tool. It counts visits, not people.
Fonts and code come from our own server. No font service or code library host sees your visit.
Cookies: pages set none. Switching the language sets two short-lived cookies (a session and a security token) so the switch works.

Using a tool that runs on your device

This is most of them, and the status bar at the bottom of each tool says so: "Runs in your browser · Your files stay on this device". Your browser reads the file you choose and the tool works on it inside the tab. Anything you keep, such as My Files or saved Markdown documents, is stored in your browser on this device. Clearing the site's data in your browser deletes it.

Tools that download what they need

The AI tools download a model the first time you use one. Models are large, so they come from where they are published. These hosts see your IP address and which file was requested, never your input.

AI chat, Write and the regex tester's assistant: models from Hugging Face, and each model's compiled code from GitHub. In Chrome, Write can use Chrome's built-in model, which Chrome downloads from Google.
Transcription: the model from Hugging Face.
Image generation: the Draft and Standard models from our own server, FLUX.2 from Hugging Face.
Music generation: models from Hugging Face.

Send

Send moves files from one of your devices to another, end to end encrypted (X25519 and ML-KEM-768 to agree the keys, then AES-256-GCM).

Finding each other: our server passes a handful of encrypted messages between the two devices so they can connect. The secret that encrypts them is in the link after the # and never reaches us. The messages are deleted two minutes after the last one, ten minutes at most, or as soon as the devices are connected.
The files go straight from one device to the other. When the two networks allow no direct path, the encrypted data passes through our own relay, which can't read it and doesn't store it. The relay's log records which addresses connected, for fixing problems.
What can be seen: our server sees that two devices met, when, their IP addresses and the size of the messages. On a direct connection, the two devices see each other's IP address.
Checking: both screens show a six-digit safety code. If they match, nobody in between swapped the keys, us included.

The Markdown editor can share a document by link.

What is stored: the document, encrypted in your browser with AES-256-GCM, padded to one of a few fixed sizes so its length gives little away. Nothing about who made it: no IP address, no name, no title.
The key is the part of the link after the #, which never reaches us. With a password, the key also needs the password, which never reaches us either.
How long: 1 hour, 1 day, 7 days or 30 days, as you choose; Copy link in the toolbar makes a 7-day link. "Open once" deletes it the first time it is opened. You can revoke a link you made. Expired links are deleted.
What can be seen: our server sees that a link was created and opened, when, its size bucket, and the IP address while the request is open. It doesn't log requests for share links.
A link that holds the whole document after the # stores nothing on our server at all.

Network tools

These tools use the network because measuring it is the job.

Speed test: downloads random data from our server and uploads random data back, which the server throws away. Nothing is stored.
IP address: our server reads your address off the request and sends it back. Nothing is stored.
DNS lookup: your browser asks Cloudflare's or Google's public DNS service directly. Our server is not involved.

Things you point a tool at

When you open a link in the music player, insert an image by URL in the Markdown editor, or let the AI chat read a web page, your browser fetches it from that site directly, and that site sees your IP address. The email viewers block remote images until you allow them, and the AI chat asks before it reads each site.

Links you copy

Copy link puts what you typed or pasted in the part of the link after the #, so opening it sends nothing of it to us. The colour tools are the exception: their links name the colour itself after a ?. Some tools also open links written in a readable form with a ? (for example by an AI assistant that builds a link for you); what follows a ? does reach our server and Cloudflare like any page address. Our server doesn't log it.

Enforced by your browser

Every page tells your browser exactly which servers it may contact, in a Content-Security-Policy header, and the list is the one on this page. A connection to anywhere else is refused by the browser, whether it comes from our code, a library or anything injected into the page. The exceptions are tools whose job is to load what you point them at: the music player (links and radio streams), the Markdown editor and the email viewers (images by URL, and only after you allow them in an email), and the HTML editor's preview (whatever your HTML references).

What we never do

Sell, rent or share data about you.
Run ad networks or tracking cookies on this site. When a guide recommends one of our own products, it says so, and the link loads nothing until you click it.
Ask for an account to use a tool.
Look inside what you share: we can't.

Your rights

You can ask us what data we hold about you, and ask us to correct or delete it. For almost everything on this page the honest answer is that we hold nothing that identifies you. Share links can be revoked from the browser that made them.

Changes to this page

When a feature starts sending anything, it is added here before it goes live, and the date at the top changes.

19 October 2026, later: fonts and code libraries now come from our own server; Copy link puts what you typed after the #; every page enforces this list in a Content-Security-Policy.
19 October 2026: rewritten as a full list of connections. Two changes came with it: the page counter now receives the page path only (before, it received the full address, including the part after #), and our access log no longer keeps anything after a ?.