Privacy policy
The short version: nothing you type or generate is sent to us, because the tools run entirely in your browser. The only data that leaves the page is anonymous usage counting.
Updated 21 October 2026
What we collect
No accounts, no sign-up, no email capture. What we do collect is page-view statistics through Google Analytics 4: which page was opened, where the visit came from, roughly which country and device. That is the whole list — there is no tag manager beyond that one tag, no session recording, no advertising pixel, and no profile of your behaviour across other sites.
Nothing you type or generate enters the analytics payload. A password, a random number or a decoded QR code never leaves the tab, so there is nothing to send even if we wanted to.
What your browser keeps
One preference is stored by this site, and only if you use the language menu: the key itoolify.locale in localStorage, holding a language code such as ja. It exists so the next visit opens in the language you picked, it never contains anything you generated, and clearing site data removes it.
Google Analytics sets two cookies of its own: _ga, which holds a randomly generated client identifier, and _ga_<container>, which holds session state. Both expire after two years by default. They are how returning visits are recognised at all — without an identifier every visit is a new one. Clearing site data removes them, and blocking them does not affect any tool: the generators and the scanner work identically with analytics switched off.
A generated password or number exists in a JavaScript variable for as long as the tab is open, and it is gone when you close or reload the page. Nothing is added to your clipboard unless you press Copy.
Camera access on the QR pages
The scanner asks for camera permission only after you press the button that opens the camera — never on page load. Video frames are processed in the page and discarded frame by frame. They are not uploaded, recorded, saved, or measured against any server. You can revoke the permission at any time in your browser's site settings; the upload path (decoding an image file you choose) does not need the camera at all.
The one network request a tool makes
Beyond the analytics tag, the only network request the tools make is for a static wordlist file (/wordlist.txt, about 62 KB) on this domain, used by the passphrase generator the first time you switch to passphrase mode. It is a plain file download with no query string — it carries nothing about you, and it happens only in that mode. Everything else, including every password and every QR decode, works offline once the page has loaded.
Hosting logs
Like any website, the provider that serves these pages may keep standard access logs — IP address, user agent, requested path, timestamp — for security and abuse prevention. Those logs are not linked to anything you do inside a tool, because the tools send no requests. We do not use them to analyse behaviour.
Third parties
One third party: Google Analytics, operated by Google Ireland Limited for visitors in the EEA and by Google LLC elsewhere. The tag is loaded from googletagmanager.com on every page and receives the page address, the referring page, an approximate location derived from your IP address, device and browser details, and its own cookie identifier. Google's terms forbid using this data to identify individuals, and we have not enabled any advertising or cross-site features.
There are no embedded fonts, no other third-party scripts and no external images on the tool pages. If advertising is ever added, this page will be updated before that change goes live, with the service named and a plain description of what it would receive.
If the law where you live requires consent before analytics cookies are set, use your browser's cookie controls or a content blocker: the tag is not essential and the site works fully without it.
Your rights
Data-protection rules such as the GDPR give you rights to access, correct, export and erase the personal data a service holds about you. We hold none, so there is nothing to request — but if you believe otherwise, write to [email protected] and we will answer within 30 days.
Children
The site is a set of general-purpose utilities and is not directed at children under 13. Because it collects no personal data at all, it does not knowingly collect anything from anyone, of any age.
Changes
Material changes will be reflected in the date at the top of this page. Because there is no account system, there is no way to notify you individually — the date is the notice.
Contact
Questions about this policy: [email protected].