Skip to content
Control Plane Labs

Privacy Policy

Last updated July 27, 2026

Summary — what actually happens

  • Every tool computes results in your browser. The only exceptions are called out on the individual tool page and enumerated below.
  • We use anonymized analytics (Google Analytics 4 with IP anonymization enabled) to understand which tools and articles are used, aggregated.
  • We serve display advertising via Google AdSense (and, after graduation, Journey by Mediavine or Raptive). Ad personalization requires your consent via the cookie banner.
  • We do not sell your data. We do not use dark patterns to obtain consent. Rejecting all non-essential cookies has no effect on your ability to use any tool on this site.

Effective date

This policy is effective as of the “Last updated” date at the top of this page. Material changes are announced in the Friday recap newsletter and via a banner on this page for at least 30 days.

What “processing in your browser” means

Most tools on this site are pure client-side JavaScript. That means:

  • When you paste JSON into /tools/json-formatter/, that JSON never leaves your browser.
  • When you decode a JWT at /tools/jwt-decode/, the token is decoded locally. If you enter a signing key to verify the signature, the key never leaves your browser and is not stored anywhere.
  • When you generate a hash at /tools/hash/, the input text or file is hashed locally by the Web Crypto API.

The tool pages that call a server-side function are:

  • /tools/ct-lookup/ — sends the hostname you enter to our Vercel Edge Function, which forwards it to the CertIndex API and returns aggregated Certificate Transparency records. We do not store your queries beyond a short-lived cache used for rate limiting.
  • /tools/password/ (breach check) — uses the HIBP k-anonymity API. Your password is hashed in your browser; only the first five characters of the SHA-1 hash are sent to HIBP. Your raw password never leaves your browser.
  • /tools/tls-inspect/ (hostname mode) — opens a TLS connection to the hostname you enter and returns the certificate chain. The hostname you enter is used only for this request and is not retained.

Data we collect

  • Analytics. Google Analytics 4, with IP anonymization enabled. GA4 records page URL, referrer, screen size, browser, language, and standard event data. Google’s own privacy documentation for GA4 is at Google Analytics privacy.
  • Rate-limiting metadata. For server-side tool endpoints we keep a rate-limit counter keyed by IP and user-agent in Upstash Redis, which enforces the published limit of 30 requests per IP per hour. Counters expire automatically after one hour and are never joined to any other data.
  • Newsletter subscribers. If you subscribe to the Thursday recap, your email address is sent to Beehiiv, which is our email service provider. See the Beehiiv privacy policy.
  • Email you send us. There is no contact form on this site, so nothing you send passes through a third-party form processor. Email to ben@ennis-studio.com is received and retained in Google Workspace — see the Google privacy policy.

Cookies

  • Essential. Local storage entry cpl-consent recording your consent choice. No cookie set.
  • Analytics. Google Analytics 4 cookies (_ga, _ga_*) set only after you accept the consent banner.
  • Advertising. Once AdSense (or Journey/Raptive) is active, ad-personalization cookies are set only after you accept the consent banner. If you reject non-essential cookies, ads will still show but will be contextual rather than personalized.

Third-party services

  • Google Analytics 4 — privacy
  • Google AdSense — privacy
  • Beehiiv (newsletter) — privacy
  • Upstash (rate-limit counters for /api/*) — privacy
  • Vercel (hosting) — privacy
  • CertIndex (CT-log data for ct-lookup) — privacy
  • Have I Been Pwned (breach check for password) — privacy

Webfonts are self-hosted from this domain. Loading a page sends no request to any font CDN, so your IP address is never disclosed to a font provider.

Your rights (GDPR, CCPA)

If you are in the EU, EEA, UK, or California, you have the right to request access to, correction of, or deletion of any personal data we hold about you. Because we do not maintain user accounts and our analytics are anonymized, the only personal data we hold in most cases is your newsletter subscription (if you have one). To exercise your rights, email ben@ennis-studio.com.

Children

This site is intended for a technical adult audience and is not directed at children under 16. We do not knowingly collect personal information from children.

Contact

Privacy questions: ben@ennis-studio.com Owner: Ennis Studio, Grand Rapids, Michigan, USA.