Privacy Policy

1. Summary

• Most tools process your input entirely in your browser. That input is not sent to our servers.
• A few network tools only work by contacting an external service. When you run one of them, the value you entered (for example a domain name or an IP address) is sent to that service. They are listed in Tools that use a network service.
• We use Google Analytics to understand how the site is used. In the EEA, the UK and Switzerland, analytics and advertising storage stay off until you accept them in the cookie banner.
• We may use Google AdSense to display ads. Google and its partners may then use cookies to serve and measure ads.
• Preferences such as theme, language and favourite tools are kept in your browser’s local storage, not on our servers.

2. Tools that run in your browser

Hashing, encoding, encryption, formatting, conversion, text, image, design, calculator and generator tools run as JavaScript on your device. The text, files and keys you enter are processed in your browser’s memory and are not uploaded to AlgoKit. Reloading or closing the page discards them, unless a tool explicitly saves a setting locally (for example the time zones you add to the world clock).

Files you select, for example to hash a file or compress an image, are read locally through the browser’s File API and are not uploaded.

3. Tools that use a network service

Some tools need information that only exists on the network. They send a request only when you run them, and only with the input needed for that lookup. As with any web request, the receiving service also sees your IP address and browser user-agent. The services are:

• DNS lookup – the domain name and record type are sent to Cloudflare’s DNS-over-HTTPS resolver (cloudflare-dns.com). See the Cloudflare privacy policy.
• IP lookup / geolocation – the IP address you enter (or, if you leave the field empty, the public IP address of your own connection) is sent to an IP geolocation API (ipwho.is or ipapi.co).
• WHOIS / domain lookup – the domain name is sent to rdap.org, which forwards the query to the RDAP service of the responsible domain registry.
• SSL / certificate checks – the domain name is sent to public Certificate Transparency search services (crt.sh and Cert Spotter by SSLMate) to list the certificates issued for it.
• Password breach check – your password is never sent. The tool computes the SHA-1 hash of the password in your browser and sends only the first 5 characters of that hash to the Have I Been Pwned “Pwned Passwords” range API (api.pwnedpasswords.com). The returned list is compared in your browser (k-anonymity).
• Currency converter – the selected currencies are sent to frankfurter.dev, which returns reference exchange rates published by the European Central Bank.
• SEO and website checks (for example HTTP header, redirect, canonical, link or meta-tag checks of a live URL) – the URL you enter is sent to AlgoKit’s own endpoint under algokit.dev/api/, which runs on Cloudflare Pages Functions. Our server requests that URL, extracts the headers, redirect chain or HTML needed for the check and returns the result to your browser. We do not store the fetched content or the URLs you check. Cloudflare may log standard request metadata (such as IP address, time and requested path) for security and operations.

Please do not enter secrets, private keys or internal hostnames into these network tools.

4. Hosting, server logs and fonts

AlgoKit.dev is a static website hosted on Cloudflare Pages. When your browser requests a page, Cloudflare processes technical data such as your IP address, the requested URL, the referrer, the user-agent and the time of the request in order to deliver the page, protect it against abuse and keep it running. We do not combine this data with other information to identify you.

Web fonts are loaded from Google Fonts (fonts.googleapis.com and fonts.gstatic.com), so Google receives your IP address and user-agent when the fonts are downloaded. A service worker may cache pages and files in your browser so the site loads faster and partly works offline; this cache stays on your device and can be cleared in your browser settings.

5. Analytics

We use Google Analytics 4, provided by Google, to see which pages and tools are used, how visitors find the site and what needs improving. Google Analytics uses cookies (such as _ga) and collects information such as pages viewed, approximate location derived from your IP address, device and browser type, and the referring site. We do not send the contents of tool inputs to Google Analytics, and we do not use it to identify you.

We use Google Consent Mode v2. For visitors in the European Economic Area, the United Kingdom and Switzerland, analytics and advertising storage are set to “denied” by default: Google tags do not use analytics or advertising cookies until you click Accept in the cookie banner, although they may send cookieless signals (for example, that a page was viewed) without cookie identifiers. In other regions these are enabled by default and you can switch them off by clicking Decline. Your choice is saved in your browser’s local storage under the key algokit_cookie_consent, and you can change it at any time with the “Cookie settings” link in the footer.

You can also block Google Analytics with the Google Analytics opt-out browser add-on. Learn more in How Google uses information from sites or apps that use our services.

6. Advertising

We may use Google AdSense to display ads on AlgoKit.dev. Ads help pay for running the site and keep the tools free.

• Third-party vendors, including Google, use cookies to serve ads based on your prior visits to this website or other websites.
• Google’s use of advertising cookies enables it and its partners to serve ads to you based on your visit to this site and/or other sites on the Internet.
• You may opt out of personalised advertising by visiting Google Ads Settings. You can also opt out of some third-party vendors’ use of cookies for personalised advertising at www.aboutads.info or, in Europe, at www.youronlinechoices.eu.
• If you click Decline in the cookie banner – or if you are in the EEA, the UK or Switzerland and have not accepted – ad requests are sent with advertising storage and personalisation denied, so Google may show only non-personalised or limited ads.

For details, see How Google uses information from sites or apps that use our services and how Google uses cookies in advertising.

7. Cookies and local storage

AlgoKit itself does not set tracking cookies. To remember your settings, the site stores a few small values in your browser’s local storage. They stay on your device:

• your colour theme (light or dark);
• your preferred language;
• your favourite tools;
• your cookie-banner choice (algokit_cookie_consent);
• settings of individual tools, such as the time zones you add to the world clock.

Cookies set by Google Analytics and Google AdSense are described above. You can delete cookies and local storage at any time in your browser settings.

8. Legal bases (EEA and UK)

Where the GDPR or UK GDPR applies, we rely on your consent for analytics and advertising cookies (you can withdraw it at any time via “Cookie settings”), on our legitimate interest in running a secure, working website for hosting logs and for the network requests you trigger yourself, and on our legitimate interest in replying when you email us.

9. Data retention

• Tool input processed in your browser is not stored by us at all.
• URLs checked through our /api/ endpoint are processed only for the duration of the request.
• Google Analytics event data is kept for no longer than 14 months and then deleted automatically.
• Emails you send us are kept only as long as needed to handle your request and any follow-up.
• Cloudflare, Google and the other services listed above keep the data they process according to their own policies.

10. Your rights

Depending on where you live, you may have the right to access, correct, delete or receive a copy of personal data about you, to object to or restrict its processing, and to withdraw consent. California residents have the right to know, delete and correct personal information and to opt out of its “sale” or “sharing” for cross-context behavioural advertising; you can do this by clicking Decline in “Cookie settings” or using the opt-out links in the Advertising section. We do not sell personal information for money.

Because there are no accounts and we do not store tool input, we usually hold no personal data that can be linked to you, apart from emails you send us. Analytics and advertising data is held by Google and can be managed through your Google account and the links above. To exercise your rights with us, email algokit.dev@gmail.com. You may also lodge a complaint with your local data protection authority.

11. Children

AlgoKit.dev is a general-audience site for developers and is not directed at children under 13 (or under 16 in the EEA). We do not knowingly collect personal information from children. If you believe a child has sent us personal information, contact us and we will delete it.

12. Security

All pages and our /api/ endpoint are served only over HTTPS. Because most processing happens in your browser, your input is not exposed to our servers, but good practice still applies: avoid pasting production secrets or private keys into any online tool, including ours.

13. Changes to this policy

We update this page when the site’s data practices change, for example when a tool starts or stops using an external service. The “Last updated” date at the top shows when it was last revised.

14. Contact

Questions about this policy or privacy requests: algokit.dev@gmail.com. You can also use our contact page.