Security

The most secure data is data that never exists. This site is a fully static application: there are no user accounts, no databases of user answers, and no server-side processing of anything you type into a tool. Your tool data lives only in your browser.

Measures in place

• Strict HTTP security headers: Content-Security-Policy, HSTS, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, and Permissions-Policy (grade us at securityheaders.com).
• HTTPS everywhere, with HTTP and www variants redirected.
• Backend endpoints (newsletter, contact, chat) are rate-limited, CAPTCHA-protected, input-validated, and can be disabled instantly via kill switches without affecting the site.
• Dependencies are audited and updated; the site ships no third-party scripts before consent.

Responsible disclosure

Found a vulnerability? Please report it privately to [email protected] — see our security.txt. We appreciate reports and will acknowledge them promptly.