Privacy Policy

Summary — what actually happens

• Every tool computes results in your browser. The only exceptions are called out on the individual tool page and enumerated below.
• Analytics is optional. Google Analytics 4 loads only after you accept analytics cookies. It helps us understand which tools and articles are used.
• Advertising is not currently active. We plan to apply to Google AdSense. Before enabling advertising, we will update this policy and implement the consent controls required for the regions where ads are served.
• We do not sell your data. We do not use dark patterns to obtain consent. Rejecting all non-essential cookies has no effect on your ability to use any tool on this site.

Effective date

This policy is effective as of the “Last updated” date at the top of this page. Review this page for changes to our processing and service providers.

September 24, 2026 update: This revision adds the DNS and Header Inspector data flows, clarifies that advertising is inactive, and aligns the analytics description with the consent controls.

What “processing in your browser” means

Most tools on this site are pure client-side JavaScript. That means:

• When you paste JSON into /tools/json-formatter/, that JSON never leaves your browser.
• When you decode a JWT at /tools/jwt-decode/, the token is decoded locally. If you enter a signing key to verify the signature, the key never leaves your browser and is not stored anywhere.
• When you generate a hash at /tools/hash/, the input text or file is hashed locally by the Web Crypto API.

The tool pages that call a server-side function are:

• /tools/ct-lookup/ — sends the hostname you enter to our Vercel Edge Function, which forwards it to the CertIndex API and returns indexed Certificate Transparency records. Successful results may be cached briefly; rate-limit counters are stored separately.
• /tools/password/ (breach check) — uses the HIBP k-anonymity API. Your password is hashed in your browser; only the first five characters of the SHA-1 hash are sent to HIBP. Your raw password never leaves your browser.
• /tools/tls-inspect/ (hostname mode) — opens a TLS connection to the hostname you enter and returns the certificate chain. Results may be cached for up to five minutes by our hosting layer.
• /tools/dns/ — sends the domain and record type to our /api/dns proxy, which queries Cloudflare DNS over HTTPS. Cloudflare receives the requested name and the server’s network address, not your browser’s IP address from this proxied request. Results may be cached for up to five minutes.
• /tools/header-inspect/ — sends the URL to our /api/header-inspect proxy, which requests that public URL and follows permitted redirects. The destination receives the URL (including its query string) and our server’s network address. Do not enter URLs containing secrets or private access tokens.

Data we collect

• Analytics. Google Analytics 4 is loaded only after opt-in. GA4 records page URL, referrer, screen size, browser, language, and standard event data. Google’s own privacy documentation for GA4 is at Google Analytics privacy.
• Rate-limiting metadata. For server-side tool endpoints we keep a rate-limit counter keyed by endpoint, IP address, and a truncated user-agent in Upstash Redis. The default limit is 30 requests per hour per endpoint for that key. Counters expire automatically after one hour and are never joined to any other data.
• Newsletter subscribers. If you subscribe to the Thursday recap, your email address is sent to Beehiiv, which is our email service provider. See the Beehiiv privacy policy.
• Email you send us. There is no contact form on this site, so nothing you send passes through a third-party form processor. Email to ben@ennis-studio.com is received and retained in Google Workspace — see the Google privacy policy.
• Hosting and service logs. Vercel and the upstream services process network and request metadata to provide their services. Requests can include your IP address and the URL sent to our server. Their own policies govern their logs; the one-hour counter expiry is not a promise that every provider deletes all request metadata after one hour.

Cookies

• Essential. Local storage entry cpl-consent recording your consent choice. No cookie set.
• Analytics. Google Analytics 4 cookies (_ga, _ga_*) set only after you accept the consent banner.
• Advertising. No advertising cookies are intentionally set while advertising is inactive. Our current analytics banner is not an advertising-consent platform.

Use Cookie settings in the footer to change your choice. Rejecting analytics prevents Google Analytics from loading on subsequent pages. If you previously accepted, rejection removes this site’s first-party GA cookies and reloads the page without the analytics script.

Third-party services

• Google Analytics 4 — privacy
• Google AdSense (planned, inactive) — privacy
• Beehiiv (newsletter) — privacy
• Upstash (rate-limit counters for /api/*) — privacy
• Vercel (hosting) — privacy
• CertIndex (CT-log data for ct-lookup) — privacy
• Have I Been Pwned (breach check for password) — privacy
• Cloudflare (DNS resolver for dns) — privacy

Webfonts are self-hosted from this domain. Loading a page sends no request to any font CDN, so your IP address is never disclosed to a font provider.

Your rights (GDPR, CCPA)

If you are in the EU, EEA, UK, or California, you have the right to request access to, correction of, or deletion of any personal data we hold about you. We do not maintain user accounts. Depending on your use and choices, personal data can include your subscription email, correspondence, request metadata, rate-limit keys, and analytics identifiers. To exercise your rights, email ben@ennis-studio.com.

Children

This site is intended for a technical adult audience and is not directed at children under 16. We do not knowingly collect personal information from children.

Contact

Privacy questions: ben@ennis-studio.com Owner: Ennis Studio, Grand Rapids, Michigan, USA.