Privacy

This is a plain-language description of what actually happens, not boilerplate — it should match the code, and you're welcome to check. It's also not a substitute for legal advice if you need that for your own situation.

Last updated: 2026-08-10.

The tools themselves

Nothing. The JSON formatter, JWT decoder, UUID/hash generator, regex tester, and timestamp converter run entirely in your browser's own JavaScript engine and never make a network request with what you type or paste — that's the whole product. Every tool page shows a live "network requests sent: 0" counter while you use it; open your browser's network tab and watch it stay at zero yourself. This applies identically whether or not you have Pro.

Contact form

The contact form sends your email address and message to [email protected] via Resend, the transactional email service we use. Vaultools doesn't store the message anywhere itself — it's just relayed and replied to like any other email. Resend processes it as our email provider; see their privacy policy for how they handle that.

Pro purchases

Checkout is handled entirely by Stripe — your card details go directly to Stripe and never touch a Vaultools server. Stripe passes us the email address you checked out with, which we use once, to send your license key (again via Resend). We don't ask for or store anything else about you: no name, no address, no account.

License keys

After a successful purchase, we generate a license key and store it in our database (Cloudflare KV) alongside the date it was issued — that's the entire record for a one-time purchase. For monthly subscriptions, we also keep a pointer from your subscription ID to that key (so we can revoke it if you cancel) and, temporarily, a pointer from your email to that subscription (used only to cancel an old monthly plan automatically if you later buy the lifetime option, so the two don't stack) — this email pointer is deleted as soon as it's no longer needed for that purpose.

The license key itself is the only credential — there's no account, no password, and no profile tied to it. When you activate it, your browser stores the key and the last verification time in its own localStorage (or, for the CLI, a config file on your machine) — that stays on your device. We re-verify it against our server about once a week, which sends only the key itself, nothing else about you or what you're using it for.

Ads

We run Google AdSense on the homepage, /pro, and /how-it-works — configured for non-personalized, contextual ads only, not behavioral targeting. Some cookie use still happens even in that mode (frequency capping, fraud and invalid-traffic prevention); we don't control that part, it's built into how Google's ad delivery works. If you're visiting from the EEA, UK, or Switzerland, you'll see a consent message — with a direct "Do not consent" option, not just "Manage options" — before any ad request is made. If you have an active Pro license, the ad is removed entirely on those same three pages: no script loads, no request is made, same as if it were never there.

The tool pages (JSON formatter, JWT decoder, and the rest) never carry AdSense or any other third party — the ad-shaped boxes you might see there are static, first-party placeholders with no network request made, ever. Those are the pages where the "nothing you paste leaves your browser" claim is made and verified, and ads don't get an exception to that.

Hosting

The site is hosted on Cloudflare, which sees standard web server access logs (IP address, user agent, request timing) for any request to any site it hosts, as any host would. Vaultools doesn't add any analytics or tracking of its own on top of that.

Questions or deletion requests

Since there's no account, "deleting your data" mostly means deleting a license key — email [email protected] and we'll remove it and any associated pointers from our database. For anything else, use the contact form or the same address.