The short version
- All 115 tools process your files and input in your browser. Files you upload, text you paste, images you edit - none of it is sent to a server or stored anywhere. Close the tab and it's gone. Todo List is the one tool that remembers anything: it saves your list in this browser's localStorage so it's there next time, and that data still never leaves your device.
- Two tools need our server for one narrow job. Domain Info sends the domain name you look up to our server to run a WHOIS/RDAP lookup, since a browser can't query that directly. P2P File Share passes a small connection blob through our server so two browsers can find each other - the file itself goes browser-to-browser over an encrypted WebRTC connection. No other data is collected in those requests.
- We use PostHog for basic product analytics - not to identify you personally or sell data to anyone.
- We can add third-party code - an advertising pixel, a verification tag - from our admin panel without shipping a new build. That slot is currently in use; see Advertising below for what gets sent, and to whom.
What we collect, and why
Product analytics (PostHog). Page views, which tools get used, and general technical info (browser, rough location from IP address, referrer). When you use a tool we record what kind of file it was (for example "pdf"), a rough size range, the settings you picked and whether it worked - never the file name, its contents or anything you type into a tool. This is used to understand what's actually useful and fix what's broken - not to build an ad profile. PostHog is a third-party analytics provider; see PostHog's own privacy policy for how they handle data on their end.
Feedback prompts. On a couple of the busier tools, a one-off box asks how it went after the tool has finished. So that it only ever appears once, we store a salted, one-way hash of your IP address - not the address itself, and not anything that can be turned back into it. That record holds only the hash, which tool you were on, whether you replied or closed it, and the date, and it deletes itself after a year. Anything you write in the box is sent to us; an email address is optional and the box says so.
Advertising and third-party code. In use. The script in that slot right now is a Meta (Facebook) advertising pixel: when you load a page, standard events (a page view, plus an ad conversion if you arrived from an ad) are sent to Meta and handled under Meta's privacy policy. It never runs on admin pages, and any tracker blocker stops it without breaking a single tool.
Contact email. If you email hello@candidtools.com, that message is received through Amazon SES, the same way any inbox receives mail. We use it to reply to you and nothing else.
Local storage. The Todo List tool keeps your list in your browser's localStorage between visits. That data stays on your device - we never see it, and it's never sent anywhere.
What we don't do
- We don't upload, log, or store the files, text, or images you process with these tools (the Domain Info lookup and P2P File Share's connection blob above are the only cases where anything you provide leaves your browser).
- We don't sell data to third parties.
- We don't require an account or email to use any tool.
Your choices
- A browser extension or ad/tracker blocker will block the analytics script, and any advertising pixel, without breaking any tool - nothing here depends on either to function.
- Clear your browser's site data for candidtools.com to remove any saved Todo List entries.
- Email hello@candidtools.com with questions or requests about your data.
Changes
This page gets updated as the site changes. Meaningful changes (like turning on a new kind of data collection) will update the "last updated" date above.