Cookie Policy

The one cookie we set

It is called NEXT_LOCALE, it holds en, vi or zh-Hans, it lasts a year, and its SameSite is Lax. It exists so the site stays in the language you picked.

If you never open the language menu, we never set it. Before you choose, the site reads the Accept-Language header your browser already sends and picks the closest match for that request only.

Cookies set by the bot check

Cloudflare Turnstile is the check that runs before you create a share link, generate a song, publish an exam, or use an AI feature. It loads from challenges.cloudflare.com and sets its own cookies on that domain to tell a real browser apart from a script. It only loads on pages where one of those actions is possible, not across the whole site.

We treat it as strictly necessary. Without it the free AI and storage endpoints get drained by bots within a day.

Analytics sets nothing

Our analytics is a copy of umami we run ourselves. It is cookieless and stores no identifier in your browser. What it does record is listed in the privacy policy.

What we store that is not a cookie

Everything else the site remembers uses your browser's local storage. None of it is ever sent to a server.

• Your last Mermaid diagram and its theme, so a refresh does not lose your work
• Exams you are writing, and the tokens that let you reopen their results later
• An exam attempt in progress, until you submit it
• Your Mock API Builder configuration
• Whether you picked light, dark, or system appearance

How to clear any of it

Your browser's "clear site data" for webtoolz.dev removes all of it, including saved exam drafts and your last diagram. There is no copy on our side, so clearing is permanent. Blocking cookies for this site works too, though you will have to pick your language again on every visit.

If we add advertising

There are no ad scripts on this site today. If that changes, the advertising provider and its partners will set their own cookies. This page will list them before the first ad loads, and visitors in the EEA, the UK and Switzerland will be asked for consent first.