Privacy policy

Every tool except the webhook receiver — the JSON formatter, SQL formatter, string & ID formatter, text transform tool and JSON ↔ CSV converter — processes everything locally in your browser. Nothing you paste into those tools is transmitted to or stored on any server.

The BIN checker is a partial exception: the first 6-8 digits you enter are sent directly from your browser to the third-party binlist.net lookup API. The rest of any card number is discarded before that request is made, and nothing is stored on our servers.

The webhook receiver is the one tool that stores data on our servers: it issues a temporary URL and stores the requests delivered to it — method, path, query string, headers, body and originating IP address — so they can be shown back to you. Authorization and cookie headers are redacted before storage. Sessions accept new requests for 7 days (or up to 100 requests, whichever comes first), and you can clear the history at any time. Undownloaded data is purged automatically 30 days after a session expires.

There are no user accounts. Your webhook session identifier is kept in your browser's local storage so the page can reconnect you to the same inbox; clearing site data removes it.