Privacy Policy

1. Our core principle: your files stay on your device

All tools on GuruToolkit run entirely inside your web browser using standard web technologies (HTML, CSS, JavaScript, WebAssembly, Canvas, Web Crypto API, File API). The bytes of the files you upload — PDFs, images, JSON, JWTs, anything — never leave your computer.

Files are processed by JavaScript running in your browser tab. They are not transmitted to any of our servers, to any third-party servers, or to any cloud service. The only exception is the PageSpeed Insights tool, which fetches the URL you choose to analyse directly from Google's public API from your browser.

You can verify this yourself: open your browser's DevTools → Network tab, then use any of our tools. You will not see your files being uploaded.

2. What data we collect

We collect a small amount of anonymous usage data so we can understand which tools are useful and which are not. The data we collect is limited to what is listed below; we do not collect names, addresses, phone numbers, or any direct personal identifiers.

Categories of data we collect:

• Anonymous visitor ID — a random UUID generated and stored in your browser's localStorage on your first visit. It is used to deduplicate votes and feedback. It cannot be used to identify you across other sites.
• Page views and tool usage counters — every time you open a tool page, an anonymous "view" event is recorded. Every time you successfully complete a tool's main action, an anonymous "usage" event is recorded. No file content is included.
• Likes and dislikes — when you click the like/dislike button on a tool page, your choice and (for dislikes) the reason you typed are stored.
• Free-text feedback — when you submit the feedback form, the type, content, optional email, and the locale of the page you submitted from are stored.
• Hashed IP address — your request IP is hashed with a rotating server-side salt and stored alongside votes and feedback, to make vote / feedback spam significantly harder.
• Standard server logs — the API stores request logs (timestamp, route, status code, hashed IP) for abuse detection. Logs are retained for at most 30 days.

3. Why we collect each piece of data

We collect only what we need to operate the site, prevent abuse, and improve the tools:

• Anonymous visitor ID — to ensure each user can only vote once per tool, and to deduplicate the view counter so refreshing the page doesn't inflate it.
• View counts — to display popularity and decide which tools deserve more attention. View counts are session-deduplicated: one view per browser session per tool.
• Usage counts — to measure which tools are actually used (vs just opened). Usage is only fired after a tool's main action completes successfully.
• Likes / dislikes / reasons — to surface satisfaction signals and turn negative feedback into actionable input for future improvements.
• Feedback (type + content + optional email + locale) — so we can read bug reports and feature requests, and follow up with you by email if you asked us to. Email is never displayed publicly.
• Hashed IP — for soft rate-limiting (e.g. one vote per IP per minute) so a single attacker cannot flood the API. The raw IP is never stored.
• Server logs — to detect and investigate abuse (e.g. automated bots trying to inflate counters).

4. Cookies, localStorage and similar storage

We do not use advertising cookies or third-party tracking cookies. The only persistent storage we set in your browser is:

We use the following browser storage keys:

If you clear these keys, the site will regenerate them on your next visit. There is no cookie banner because the only persistent storage is first-party and strictly functional.

• gt-visitor-id (localStorage) — random UUID used to identify your browser for vote / feedback deduplication. Cleared when you clear site data.
• gt-viewed: (sessionStorage) — marks that the current browser session has already counted a view for the named tool, so refreshing the page does not double-count. Cleared when you close the tab.
• i18n_redirected (cookie, set by @nuxtjs/i18n) — remembers which language you prefer so we don't redirect you again on the next visit.
• nuxt-color-mode (cookie, set by @nuxtjs/color-mode) — remembers your light / dark theme preference.

5. Google Analytics 4 (GA4)

We plan to enable Google Analytics 4 (GA4) on the main website to help us understand aggregate traffic patterns — which pages are visited, in what order, from which countries, and on which devices. GA4 is configured to be privacy-respecting:

GA4 is loaded only after the page has finished rendering core content, and only when a valid measurement ID is configured server-side. We do not use GA4 to track the files you process with our tools; no tool input or output is sent to Google.

GA4 sets its own cookies (e.g. _ga, _ga_*) on your browser. You can opt out using the Google Analytics Opt-out Browser Add-on, or by blocking analytics cookies in your browser settings.

• IP anonymisation is enabled (Google truncates the last octet of visitor IPs before storage).
• Advertising features (Remarketing, Demographics & Interests reports) are disabled.
• No Google Signals / cross-device tracking is enabled.
• Data retention is set to the minimum (14 months) allowed by GA4.

6. Advertising and Google AdSense

We plan to display advertising on this site through Google AdSense. Google AdSense uses cookies and similar technologies to serve ads and to support ad reporting, frequency capping, and ad selection.

Because we use Google AdSense, Google and its partners may collect information about your visits to this site and to other sites that carry Google ads, then use that information to select which ads to show you. This is a standard part of how personalised advertising works on the open web.

Advertising-related data is collected and processed by Google (and by other vendors in Google's certified partner network) under Google's own privacy terms — not ours. We do not see who you are, only aggregate statistics such as impression counts, click counts, and click-through rate.

We have configured Google AdSense to minimise data collection and to respect your choices:

• Specific disclosure required by Google AdSense: third party vendors, including Google, use cookies to serve ads based on a user's prior visits to your website or other websites.
• Google's use of advertising cookies enables it and its partners to serve ads based on your visit to your site and/or other sites on the Internet.
• Categories of advertising-related data Google may collect: pages visited on this site, links clicked, interactions with ads (view or click), approximate location (country / region / city), device and browser information, and advertising identifiers stored in your browser by Google.
• Opt out of personalised advertising any time via Google Ads Settings (https://adssettings.google.com/authenticated) or the industry-standard opt-out portal at https://www.aboutads.info.
• EU / EEA / UK users: a consent banner will request your permission before any advertising cookies are loaded. You can change your preferences at any time via the "Cookie settings" link in the footer. The default for EEA / UK is non-personalised ads unless you opt in.
• California residents (CCPA / CPRA): you have the right to opt out of the "sale" or "sharing" of personal information. You can exercise this right by toggling off personalised ads in Google Ads Settings, by using our "Do Not Sell or Share My Personal Information" link in the footer, or by contacting us at the address below.
• Children: we will not knowingly serve personalised advertising on pages that target children under 13, and Google AdSense is configured not to serve personalised ads to known minors.
• Editorial integrity: our choice of which tools to build, how to rank or feature them, and how we respond to feedback is independent of any advertiser. No advertiser has any input into editorial decisions.

7. Third-party services we use

We rely on a small number of third-party services to run the site. Each is used for a specific purpose and processes the minimum data necessary:

• jsDelivr CDN (cdn.jsdelivr.net) — used by the Markdown Editor's optional Mermaid diagram renderer to load mermaid@11 on demand. No site data is sent to jsDelivr beyond the standard HTTP request for the JS file.
• Google PageSpeed Insights API (www.googleapis.com/pagespeedonline) — used only by the PageSpeed tool. The URL you submit is sent directly from your browser to Google. We never see the URL or the result.
• Google Fonts (fonts.googleapis.com / fonts.gstatic.com) — used by the App Icon Generator for typeface previews. Standard HTTP requests for CSS and font files.
• Material Symbols (fonts.googleapis.com) — used by the App Icon Generator for icon previews. Same as above.

8. Where your data is stored and how long we keep it

Counters (view, usage) and likes / dislikes are stored in our PostgreSQL database. The database is hosted in a single region; we do not replicate personal data across regions.

Feedback entries and their associated hashed IP are kept for as long as they are useful for product decisions. Pending feedback is reviewed by a site administrator; entries marked resolved are retained for 12 months for trend analysis, then deleted.

You can request deletion of your feedback at any time (see §9).

9. Children

GuruToolkit is a general-purpose tool site and is not directed at children under 13. We do not knowingly collect personal data from children. If you believe a child has submitted feedback, contact us and we will delete it.

10. Your rights and choices

Because we do not ask you to create an account, we cannot look up "your data" by name or email. The controls we do offer:

If you want a copy of all data associated with your browser, or want any feedback / vote you submitted deleted, contact us with your visitor ID (find it in your browser's localStorage under the key gt-visitor-id) and we will respond within 30 days.

• Clear localStorage — removes your anonymous visitor ID. Subsequent actions will be treated as a brand-new visitor.
• Block analytics — install the GA Opt-out add-on, or use your browser's cookie / script blocking features.
• Use the tools in private / incognito mode — localStorage is cleared when the window closes, giving you a fresh visitor ID per session.
• Do not submit feedback with an email address if you don't want to be contacted.
• Do not paste production secrets (real JWTs, real API keys, real customer data) into tools like JWT Decoder or Base64 Text — even though the data stays in your browser, your browser history and screenshots may capture it.

11. Changes to this policy

We may update this policy from time to time as we add features (e.g. when GA4 is enabled, or when new categories of data are collected). The "Last updated" date at the top will reflect the most recent change. Material changes will be announced on the homepage for at least 14 days.

12. Contact

Questions, requests, or complaints about this policy can be sent to [email protected]. We respond within 30 days.