Privacy Policy

The short version

Most of the tools here run entirely in your browser. Your JSON, your diagrams, and your video and image files are processed on your own machine and are never uploaded. A few features do need a server, and this page says which ones, what they send, and how long we keep it.

There are no accounts, no logins, and nothing to pay for.

What never leaves your browser

These tools do their work locally. If you do not click Share and do not click an AI button, nothing you typed or opened is transmitted anywhere.

• JSON Studio, JSON Diff, the schema validator, and the JSON, YAML and CSV converters
• Mermaid Studio, while you are editing
• Every media tool. These run ffmpeg compiled to WebAssembly, so even a 500 MB video is converted inside the tab
• The token counter and the MCP config generator
• Exam Studio while you are building an exam, until you publish it

What you send us on purpose

Four things reach a server, and each one is something you have to click. Nothing here happens in the background.

• Share links. Sharing uploads the contents of your editor to our storage and gives you a link. Anyone with the link can read it, so do not share credentials or anything private.
• Fix with AI. Sends the JSON you pasted to an AI provider to be repaired, and sends back the result.
• AI Music Studio. Sends the description you type, and any lyrics you supply, to the model providers that write the lyrics and generate the audio.
• Published exams. Publishing an exam stores it so other people can open it. See the next section.

Opening a shared Mermaid diagram as an image also renders it on our server, because the image has to exist before a link preview can show it.

Exam Studio collects other people's data

This is the one tool that holds information about people who are not you, so it is worth being precise. If you publish an exam with result collection turned on, each submission stores the name the taker typed, an optional class, their answers, their score, how long they took, and a truncated hash of their IP address. The hash is there to spot duplicate submissions. It is not reversible into an IP address, but it is still tied to one person, so we treat it as personal data rather than calling it anonymous.

If you turn on the leaderboard, names and scores are visible to everyone holding the link. You are the one collecting that data. We store it on your behalf, and it is your responsibility to have permission to collect it.

Analytics

We run our own copy of umami on a server we rent in Germany. It sets no cookies and stores no identifier in your browser, so it cannot follow you between sites or recognise you on a later visit.

For each page view it records the path, where you arrived from, your browser, operating system, device type, screen size, language, and a country, region and city worked out from your IP address. The IP address itself is not stored.

Cookies and browser storage

We set one cookie, NEXT_LOCALE, and only after you pick a language from the menu. Everything else the site remembers, such as your exam drafts and your last diagram, is kept in your browser and never sent to us. The cookie policy lists all of it, including the cookies our bot check sets.

Who else handles the data

We use a small number of outside companies to run the site. We do not sell your data, and none of these are advertising or data brokers.

• A hosting and edge provider, which serves every request
• An object storage provider, which holds share links and generated audio
• A server we rent in Germany, which runs our analytics and our background job queue
• AI providers, for JSON repair and for writing lyrics and generating music

Two others are worth naming, because your browser connects to them directly and you can see it in your developer tools. Cloudflare Turnstile runs the bot check on pages where you can share, generate or publish, and it sets its own cookies. jsDelivr, a public code CDN, serves the ffmpeg, PDF, diagram and background-removal libraries that the browser-side tools are built from, so it sees your IP address when you open one of those tools.

How long we keep things

• Share links and generated tracks. Deleted automatically once they stop being opened. Every time a link is read the clock restarts, so a link in active use stays alive and an unused one ages out.
• Exam submissions. 90 days.
• Leaderboard entries. 7 days after the last submission to that exam.
• Rate-limit counters. Between one minute and ten minutes. These exist to stop one address hammering an endpoint.

Your choices

There are no accounts here, so there is nothing for us to look you up by. If you want a share link, a generated track, or a set of exam submissions deleted before it expires, email privacy@webtoolz.dev with the exact URL and we will remove it. The link is the only way we can find the right record.

Anything the tools keep on your own machine you can clear yourself with your browser's "clear site data" option. That is permanent, because there is no copy on our side.

Children

This site is not aimed at children under 13 and we do not knowingly collect data from them. Exam Studio may well be used by teachers with young students. In that case the teacher is the one collecting the data and is responsible for having permission to do so.

Changes

If this policy changes in a way that affects what we collect or how long we keep it, the date at the top of the page changes with it.

Contact

Questions about any of this, or a request to delete something, go to privacy@webtoolz.dev.