$ privacy --explain
Privacy & Security
How tool-kit handles local tool input, encrypted shares, HTML previews, and public Mock API data.
Local tools
Nginx, JSON, and Base64 processing runs entirely in your browser. Your input is not uploaded. Drafts may remain in this browser's local storage; only the tool name is sent for anonymous aggregate usage counts.
Encrypted Share
Plaintext, passwords, and the 256-bit secret key are used only in your browser. Content is encrypted with AES-256-GCM before upload and decrypted after download. The key stays in the URL fragment, which browsers do not send in HTTP requests. Anyone with the full link can decrypt a share unless you also set a password.
What the server stores
The service stores ciphertext, content type, cryptographic parameters, creation and expiration times, and derived edit or renewal verification values. Expired records are removed automatically. The plaintext, password, and secret key are not stored or sent to the server.
HTML previews
Markdown and HTML are rendered in your browser after decryption. HTML runs in a sandboxed, opaque-origin frame with network access, forms, frames, and embedded objects blocked. Inline scripts are allowed for interactive documents, so open shared links only from sources you trust.
Mock API
Mock API content is stored as public plaintext so the endpoint can return it directly. Anyone with the endpoint URL can read it. Never put passwords, tokens, personal data, or other secrets in a Mock API.
Operational metadata
Cloudflare and the service may process normal request metadata, such as an IP address, for delivery, abuse prevention, and rate limiting. This metadata cannot be used to decrypt an encrypted share.