Privacy
Tool text is processed in the browser. It is stored only when a Pro account chooses Save.
Tool inputs
JSON, CSV, YAML, Base64, URL text, HTML, UUIDs, timestamps, regular expressions, JWTs, hashes, colors, cron expressions, and diffs are processed in your browser. They are not request bodies, and they are not written to application logs.
Choosing Save on a Pro account sends that tool state to the server. It is encrypted before it is written. Clearing a tool does not upload anything.
The regex tester refuses some expensive patterns and stops execution after 400 milliseconds. That protection also happens locally.
Messages, errors, and legal requests
The contact form stores your name, email, topic, and message. Error reports store a route and a sanitized message. Token-like strings are removed before storage.
A legal request stores the requester identity, authority, reference number, and the scope you describe. That information is kept so the request can be reviewed.
Retention and deletion
Unsaved tool text is not retained. A Pro project stays until you delete it or delete the account. The account export includes project contents only while Pro is active. A private link expires after 7 days and stops working if Pro lapses. Anyone who has the link can read that one saved project until then.
The purge job deletes error reports after 90 days, contact messages after 365 days, expired sessions as it runs, and audit records after 2 years. Legal requests are kept for 7 years because they are part of the response record.
Cookies and local storage
A theme and pinned tools can stay in localStorage on your device. If you sign in, those pins and the theme are also stored on your account. The session cookie is HttpOnly. A short-lived cookie is set after you pass the request check. There is no third-party analytics cookie.
Donations
Bitcoin donations go to the address published on the donate page. The address is public. DevKitNow does not record a donation wallet, amount, or transaction.
Pro is a separate Bitcoin invoice for 30 days. The server derives a unique receive address from a public extended key and checks a public block explorer for that amount. A private key is never stored here. A donation address is not an invoice.
Access
veilsphere operates the site. Staff can read contact messages, sanitized error reports, and legal requests. Pro project contents stay encrypted. An admin can decrypt them only through the legal export after counsel review.