A privacy policy you can verify

A single privacy answer for this site would be false, because the tools don't share a processing model. One set computes results in the browser from code delivered with the page. The other calls a language model, which can't happen locally, so the text has to travel.

Every tool page states which model applies before you paste anything, and a run allowance is the reliable tell: it exists to meter server cost, so a tool with one sends text, and a tool without one computes locally.

This page takes each model in turn, then two things that apply site-wide regardless of which tool you open: analytics, and the providers the service runs on.

When processing is local, the text you paste is held in the page and transformed by JavaScript on your own machine. No request carries it anywhere. Nothing is transmitted, so nothing is received, retained, logged or disclosed. This is a structural property of the tool, not a policy commitment that could quietly change.

The absence of a length cap and a run limit follows from the same fact: both exist to control server cost, and no server participates.

The useful part is that it's independently checkable, which few privacy claims are. Open your browser's network panel, run a local tool, and watch that no request is issued. A claim you can falsify yourself is worth more than one you can't.

A server tool posts your text to this site's API endpoint, which validates the request shape, applies the rate limit described below, and forwards the text to Groq, which runs the model producing the output. The response returns through the same path and the request ends.

No stage of that chain writes your text to a database, a log or a cache under our control. Responses carry a no-store directive, keeping them out of browser and intermediary caches. Input must fall between 1 and 12,000 characters to be accepted.

Transmitted

The submitted text, the route path, the engine family it belongs to, and any optional instruction field the tool exposes.

Not transmitted

No identifier, credential, email or history, none of which exists in this service.

Retained afterwards

Nothing derived from the text; only the rate-limit counter, described next.

On failure

A generated request identifier and the error message go to the runtime log. The submitted text is not part of that record.

Capping AI runs at 5 per rolling 24 hours means distinguishing repeat requests from new ones. With no account system, the only available signal is the network address a request arrives on.

That address is never stored. It's hashed with SHA-256, and the first 32 hex characters of the digest become the key of an integer counter holding a count of runs only: no text, no address, no route, no output. The key expires after 86,400 seconds (24 hours), and nothing archives or extends it.

The honest qualification: a hash of an address is pseudonymous, not anonymous, since the same address yields the same key for as long as it lives. It's truncated, attached to nothing but an integer, and deletes itself within a day.

Google Analytics 4 loads on every page. It records page views, coarse geographic region and device category, and sets cookies so a returning session isn't counted as new.

The boundary matters more than the scope. Analytics observes page views only. Submitted text is never part of one: under local processing it never leaves your browser, and under server processing it travels in a separate request the analytics library can't see.

Google processes that measurement data under its own terms as the provider. The cookie policy identifies the specific cookies and how to block them, which every tool here tolerates without any loss of function.

Naming each provider and what it actually touches is more useful than a generic statement that vendors are used, because the risk profile of each is different.

Vercel

Hosts the site and executes the API function. As with any host, its infrastructure terminates the connection itself, involving ordinary server-level request records outside this service's control.

Groq

Executes the model behind the server tools, so submitted text reaches Groq during a run. Its Services Agreement states it does not train on customer inputs or outputs without permission, and deletes customer data within 30 days of termination.

Upstash

Holds the rate-limit counter: a truncated hash as key, an integer as value, with an automatic 24 hour expiry.

The strongest statements here describe things that are absent rather than protected. No authentication system, so no credential store and no session history. No mailing list, so no address book. No payment processing, so no card data, billing address or transaction record.

Nothing is sold or shared with advertisers or data brokers. That's not primarily a commitment: there's no corpus of user data here to be the subject of such a transaction. No age information is collected either, since no account or profile exists.

An absence is a stronger guarantee than a policy: a policy can be revised, while an absence has to be deliberately built before it can be violated.

This policy describes observable system behaviour, which is what it can speak to reliably. It can't make commitments on behalf of the providers listed above beyond what they publish themselves; their published terms are the authority on their own handling.

It also describes the service as built today. If a tool moved from local to server processing, this page and that tool's own page would both change, since a policy that no longer matches the code is a defect regardless of how it reads.

Questions about this policy, including requests concerning data held about you, go through the contact page. The substantive answer here is usually unusual: the only record is a truncated hash keyed to an integer, often already expired before a request could be made.

Where a question concerns data held by a provider rather than this service, that provider's own process is the route, and this page names each one so you can identify which applies.