Toolman 100% local

Privacy policy

Last updated: 2026-10-10

Check it yourself

  1. Open a tool and let the page finish loading.
  2. Turn off Wi-Fi or switch on airplane mode.
  3. Use the tool. It keeps working, because nothing it does needs a server.

Prefer proof on screen? Open your browser's developer tools, go to the Network tab, and use a tool: no request carries your input.

Short version

Everything you type, paste or open in a tool on this site is processed by JavaScript running inside your own browser. None of it is sent anywhere, because there is no server-side processing and no backend to send it to. You can verify this: load any tool, disconnect from the network, and it will keep working.

What happens to what you put into a tool

Text, images, documents and files you load into a tool stay in your browser's memory for as long as the page is open, and are discarded when you close or reload it. Nothing is written to disk, transmitted, queued or logged. This is a property of how the site is built rather than a promise about how we behave: the code that handles your input is the JavaScript on the page you are looking at, and you can read it with View Source.

The practical consequence is that pasting a production API response, a JWT, a config file or a private key into a tool here carries the same exposure as opening it in a text editor on your own machine. That is the entire reason the site is built this way.

Data stored on your device

Some tools save small preferences in your browser's localStorage — the light or dark theme setting is the main one. This never leaves your device, is readable only by this site, and can be cleared at any time through your browser's site-data settings. We set no cookies of our own.

Analytics

Cloudflare Web Analytics is enabled on this site. It is served by Cloudflare and injected at the edge rather than being part of the page source. It counts page views and referrers in aggregate, sets no cookies, uses no fingerprinting, and does not track visitors across other websites. There is no advertising network, no tag manager, no session recording and no third-party embed anywhere on the site.

Hosting

The site is static files served from Cloudflare's network. As with any web host, Cloudflare processes request metadata such as your IP address, user agent and the URL requested, in order to deliver the page and to protect the service from abuse. That processing is governed by Cloudflare's own privacy documentation, and we do not receive or store those logs.

The wish wall

The wish wall is the one part of the site that sends anything you type to a server, and it is marked as public where you write. A wish you hang there is stored in a Cloudflare D1 database and shown to every visitor. Please keep personal details out of it.

To stop spam and to count one heart per person, the wall stores a salted, one-way hash of your IP address alongside the hearts you give. The address itself is not stored, and the rate-limit records are deleted after a day. Which wishes you have hearted is also remembered in your browser's localStorage. Wishes that are abusive, off-topic or contain personal data may be removed.

What we do not do

Children

The site collects no personal information from anyone, of any age. Nothing here is directed at children specifically, and nothing about using it requires disclosing anything about yourself.

Changes to this policy

If this policy changes, the date at the top will change with it. The site's source is public, so any change to what the pages actually do is visible in its commit history as well.

Contact

Questions about this policy, or reports of anything on the site behaving differently from what is described here, can be raised as an issue on the project's GitHub repository.