Privacy

Last updated: 24 October 2026

The short version

• Every tool runs in your browser. Text you type or paste, and files you open, are never sent to this site's server or anyone else.
• There are no cookies, no analytics, no adverts, no tracking and no third-party scripts or fonts.
• The server keeps a minimal record of which pages are requested, with no IP addresses, for 90 days.
• The site only stores something in your browser if you ask it to, and you can delete it at any time.

Who is responsible

mtools is run by Richard Lucker, an individual, who is the data controller for the little information described here. The contact page says how to get in touch.

What the tools do with your data

Nothing leaves your device. The tools are programs that your browser downloads with the page and runs locally. The site's security policy forbids pages from opening network connections, so a tool could not send your data even by mistake, and automated tests check on every change that no tool makes a request.

You can check this yourself: open your browser's developer tools, choose the Network tab, and use a tool. After the page has loaded, no requests appear.

Copy link (in the colour and gradient tools) puts the colour or gradient after the # in the address. Browsers never send that part of an address to a server, and only you decide whether to share the link.

What the server records

Like any website, the server sees each request your browser makes for a page or file. It keeps a log of these requests containing only:

• the date and time;
• the page or file requested, without anything after a ? in the address;
• whether the request succeeded, how large the response was and how long it took.

The log does not contain your IP address, your browser or device details, the page you came from, or anything you type. The server is set up to remove these before anything is written.

Why: to keep the site working (finding broken links and errors) and to understand which tools are used. Because the log cannot identify you, it is unlikely to count as personal data; to the extent it does, the lawful basis is legitimate interests in running the site securely and reliably.

How long: log files are deleted automatically after 90 days. Only monthly totals of page views per page are kept beyond that.

Cookies and storage in your browser

This site sets no cookies. It uses your browser's local storage, which stays on your device and is never sent to the server, in two cases only:

• Your theme, if you choose one other than System, so the site looks the way you chose on your next visit.
• A tool's input and settings, only if you tick that tool's "Remember …" box, which is off by default. Secrets are never stored: the JWT Decoder has no such box, the Hash Generator never keeps an HMAC key, the JSON Formatter and the Data Format Converter keep only their settings, never your data, and the Date and Time Converter keeps only the timezones you add and its display settings, never what you type.

Both are stored because you asked for them, so the law does not require a consent banner. To delete everything, use Forget all saved inputs at the bottom of any page, untick a tool's box, or clear this site's data in your browser's settings.

If you email

If you email mtools, your email address and message are used only to reply to you, and are deleted when they are no longer needed for that. Please do not send real passwords, tokens or other secrets.

If you report something on GitHub

The "Report it on GitHub" and "Feedback" links open the mtools feedback page on GitHub, a separate service run by GitHub, Inc., whose own privacy statement applies there. Reports on that page are public. The links send GitHub only the tool's name and the page's address, never anything you typed into a tool; what you write in a report is up to you.

Who else is involved

No one receives data from this site. The server is rented from a hosting company, which provides the machine and network but not the site's software or logs. Email is handled by an email provider in the usual way, and reports you choose to make on GitHub are held by GitHub.

Your rights

Under UK data protection law you can ask what personal data is held about you, and ask for it to be corrected or deleted. In practice the site holds none, beyond any email you send. To ask, use the address on the contact page. If you are unhappy with the answer, you can complain to the Information Commissioner's Office at ico.org.uk.

Changes

If this notice changes, the date at the top changes too, and the change is listed in the changelog.