Privacy Policy

DevCraftKit has no accounts and no sign-up. The tools process what you type or paste in your own browser, so that text is not sent to DevCraftKit. There are two exceptions to know about: the URL mode of the Redirect Chain Analyzer makes a request from your browser to the address you enter, and the Open Graph & Social Preview Analyzer sends the public URL you enter toDevCraftKit so the page can be fetched (details below). The site uses Google Analytics to measure how its pages are used; that covers the pages visited, not what you enter into a tool (see Analytics). It may also display advertising from Google AdSense, which uses cookies of its own (see Advertising).

Most tools on DevCraftKit run as JavaScript in your browser. When you paste a log, a JSON document, a header block, a Content-Security-Policy, an .htaccess file or a CIDR block, the analysis happens on your device and the text is not uploaded to a DevCraftKit server, stored in a database or shared with anyone. Closing or reloading the page discards it.

Exceptions you should know about:

• Redirect Chain Analyzer, URL mode. To inspect a URL, your browser sends a request directly to that URL, without credentials and without reading the page body. The website you enter can see the request, including your IP address, as it would for any visit. DevCraftKit does not proxy or store the request or the result. In Manual Chain mode nothing is requested; the text you paste is analysed locally.
• Open Graph & Social Preview Analyzer. Browsers cannot read other websites' pages, so this tool works on our server. When you click Analyze, the URL you entered is sent to DevCraftKit, which downloads that public page and up to ten of its social images once, reads the metadata and returns the result. Private, local and internal addresses are refused, JavaScript on the page is not run, and no credentials or cookies are sent. DevCraftKit does not store the URL or the result, does not write the full URL to its logs, and does not send it to analytics. The page you analyze can see a request from DevCraftKit's servers (not from your IP address). A finished analysis of a public page without a query string may be held in server memory for about 30 seconds so repeat checks do not hit the same site again, and request rates are limited using a hashed form of the requester's address that is kept only in memory. The preview images shown in the results are loaded by your own browser directly from the image hosts, which can see that request.
• Log Sanitizer endpoint. The Log Sanitizer page works entirely in your browser. DevCraftKit also exposes a programmatic endpoint for log sanitization. If someone sends text to it directly, the text is processed in server memory to build the response and is not written to a database or kept by DevCraftKit. Your hosting provider may still record standard request metadata (see Server logs).

Even when processing is local, treat real secrets with care. Do not paste credentials you cannot afford to expose into any web page, and rotate a secret if it has been leaked.

• Your light or dark theme preference.
• Custom find-and-replace rules you create in the Log Sanitizer, if you create any.

These are kept in your browser's local storage on your device. They are not sent to DevCraftKit. Clearing your browser's site data, using a private window, or switching browsers or devices removes or hides them.

Like most websites, the infrastructure that delivers DevCraftKit may record standard technical information about each request, such as IP address, requested address, browser type and time. This is used to operate and secure the service. DevCraftKit does not use it to build profiles of visitors, and how long such logs are kept is determined by the hosting provider.

There is no login, and DevCraftKit does not use cookies for its own tracking. Google Analytics sets first-party cookies in your browser (named _ga and _ga_ followed by an identifier) to tell visits apart (see Analytics). Cookies and similar identifiers may also be set by third-party advertising services when ads are shown (see Advertising). You can block or delete cookies in your browser settings; the tools keep working without them.

DevCraftKit uses Google Analytics (Google tag) to understand which pages are visited and how people find the site. When a page loads, your browser sends Google information such as the page address and title, the referring page, the browser and device type, and an approximate location derived from your IP address, together with a pseudonymous identifier stored in the cookies described above. Google processes this on the site owner's behalf and applies its own privacy policy.

Analytics is separate from the tools. What you type, paste or upload into a tool is not sent to Google Analytics and is not included in page addresses, page titles or analytics events. If your browser or a content blocker blocks Google Analytics, the site and its tools work the same way. The site owner also uses Google Search Console and Bing Webmaster Tools to see how the site appears in search results; these report data from the search engines themselves and do not place scripts on pages.

DevCraftKit may show ads served by Google AdSense, which is how the free tools are supported alongside optional donations. Ads are labelled and kept separate from the tools. When ads are shown, Google and its advertising partners may use cookies or similar identifiers to deliver and measure ads and, where permitted, to personalise them based on your browsing. In regions that require consent (for example the European Economic Area, the United Kingdom and Switzerland) a consent message from Google is shown, and you can change your choice from it.

DevCraftKit does not send what you enter into a tool to any advertising provider. You can learn how Google uses information from sites that use its services at policies.google.com/technologies/partner-sites, manage personalised advertising at adssettings.google.com, or opt out of interest-based ads from many providers at aboutads.info/choices.

• Hosting and delivery: the provider that serves the site and may keep standard server logs.
• Google Analytics: site usage measurement, as described under Analytics. Loaded from Google Tag Manager's servers (googletagmanager.com) and sending data to Google Analytics servers.
• Google AdSense: advertising, only where enabled, as described above.
• Buy Me a Coffee: the optional "Buy me a byte" links open the Buy Me a Coffee website. DevCraftKit does not load a Buy Me a Coffee script on its pages; once you follow a link, that site's own policy applies.
• Fonts and icons are served from DevCraftKit's own domain, so loading them does not contact a font provider.

DevCraftKit does not keep what you enter into the tools. Data in your browser's local storage stays until you clear it. Retention of server logs is governed by the hosting provider, and retention of analytics and advertising data by Google.

• Use Manual Chain mode in the Redirect Chain Analyzer if you do not want your browser to contact a URL.
• Clear site data in your browser to remove saved rules and your theme choice.
• Block third-party cookies, use a private window, or use the ad settings links above to limit advertising data.
• Opt out of Google Analytics with a content blocker or Google's browser opt-out add-on.
• Ask a question or raise a concern through the Contact page.

DevCraftKit is a tool for developers and is not directed at children, and it does not knowingly collect personal information from them.

All connections to DevCraftKit use HTTPS. Because tool input stays in your browser (apart from the exceptions listed above, which are not stored), there is no central store of what people analyse. No system is perfectly secure, so keep real secrets out of anything you do not need to paste.

If the way the site handles data changes, for example when a service is added, this page is updated and the date above changes. See also the Terms of Use and the Disclaimer.