Privacy.

Every tool on this site runs in your browser. When you paste text, JavaScript on the page does the work — sorting, counting, splitting, comparing. The text is never sent to our server, never stored, never logged. Verify it yourself: open DevTools, switch to the Network tab, run any tool, and you'll see zero requests carrying your input. This is the one guarantee we never change.

Today we collect only what your browser sends automatically when fetching a page: the URL path, the referrer (if your browser sends one), your User-Agent string (browser + OS), and your IP address from the network request. Our CDN (Cloudflare) additionally records anonymous loading-performance metrics — see §07 for the full list of third-party data processors and what each one sees. We do not collect form contents, tool inputs, mouse movement, keystrokes, or screen recordings. When we add Google Analytics 4 (see §04), an additional pseudonymous client_id will be set via cookie. When we add Google AdSense (see §05), additional ad-serving data may be collected by Google. Lawful basis: Legitimate Interest (GDPR Art 6(1)(f)) for server logs and basic counts; Consent (Art 6(1)(a)) for anything that sets non-essential cookies in EU/UK, handled via the cookie banner.

Server access logs: 30 days, then deleted, rotated daily. Cookies (today: language + banner-dismissed): 1 year, per cookie expiry. Email correspondence: kept in our inbox indefinitely, treated like a personal email, never imported to any CRM. Future GA4 data (when activated): 14 months, Google's maximum below "indefinite". Future AdSense data (when activated): retained per Google's standard terms linked in §07. We never keep tool input — there is nothing to delete because nothing is stored.

Status: not yet active. When we add page-view analytics, it will be Google Analytics 4 with these settings locked: IP anonymization on (Google's default since 2023; we keep it on), Google Signals off (no cross-device profile linking), Ads personalization signals off (telemetry never feeds AdSense), data retention 14 months. Lawful basis: Legitimate Interest outside EU/UK; Consent inside EU/UK via cookie banner. Telemetry never reads what you paste — the L1 guarantee in §01 holds. We measure page visits, not your content.

Status: not yet active. When we add ads, they will be Google AdSense with personalized ads OFF in the AdSense dashboard. Ads are contextual: picked from the page you're reading and your country, not from a profile of you. We will publish ads.txt at /ads.txt for transparency. Lawful basis in EU/UK: Consent (GDPR Art 6(1)(a)) via cookie banner. Outside EU/UK: Legitimate Interest for keeping the site free. Ads never read what you paste — the L1 guarantee in §01 holds.

Today we set two first-party cookies, both functional (not tracking) and neither containing any identifier: jl_lang (1 year) remembers your preferred language; jl_lang_dismissed (1 year) remembers that you closed the language banner. Clear either anytime via your browser settings. When we add GA4 (§04) and AdSense (§05), additional cookies will appear: _ga and _ga_* (Google Analytics; pseudonymous client_id), Google ad-serving cookies (AdSense; ad rotation + fraud prevention), and a consent banner cookie (CMP; records your choice). We'll list each new cookie here the same day it becomes active.

Today, two third parties receive data from your visit. (1) Cloudflare (cloudflare.com) is our CDN — every request reaches our server through it. Cloudflare also automatically injects three lightweight scripts onto every page: a Web Analytics beacon (static.cloudflareinsights.com), a Real User Monitoring endpoint (/cdn-cgi/rum) that reports loading-performance metrics like LCP and CLS, and an email-address obfuscation script (/cdn-cgi/scripts/.../email-decode.min.js) that protects any email shown on the page from scrapers. These collect your IP, User-Agent, page URL, and timing measurements — they do not read the text you paste into the tools. The L1 guarantee in §01 still holds: tool inputs never leave your browser, full stop. See Cloudflare's privacy policy at cloudflare.com/privacypolicy/. (2) Google Fonts (fonts.googleapis.com, fonts.gstatic.com) serves the Inter Tight and IBM Plex Mono fonts. Google sees your IP address and User-Agent when your browser fetches font files; see Google's Fonts privacy FAQ at developers.google.com/fonts/faq. When we add GA4 and AdSense (see §04, §05), the list will grow to include Google LLC as a data processor under both products (Data Processing Terms at business.safety.google/processorterms/) and a cookie banner provider (CMP) for consent records. Each will operate under GDPR Art 28 Data Processing Agreements before data flows.

EU/UK (GDPR): you can ask us to access, rectify, erase, restrict, or port your data; object to processing; withdraw consent at any time (where consent is the basis); and lodge a complaint with your local supervisory authority. California (CCPA/CPRA): you have the right to know what categories of personal info we collect, to delete it, to correct inaccuracies, and to opt out of "sale" or "sharing" — we do not sell or share personal info today, and our planned contextual-only AdSense (no behavioral targeting) does not qualify as "sharing" under CPRA either, so there is nothing to opt out of. To exercise any right, email [email protected]. We respond within 30 days (GDPR) or 45 days (CCPA).

Google's servers (Fonts now; GA4 and AdSense later) are in the United States and other countries. Transfers rely on Google's Standard Contractual Clauses plus adequacy decisions where applicable; see policies.google.com/privacy/frameworks. When we change how this site handles data, the date at the top of this page changes too, and we post a note in the changelog. We don't change material things quietly.

For any privacy question or to exercise the rights in §08, email [email protected]. A real human reads it, and we reply within a few days. If you prefer postal mail, write us at [email protected] first and we'll provide the address for your jurisdiction.