Privacy Policy

— S., [email protected]

What data I collect

None that identifies you. tomlkit.org is a static site. Every tool on this domain (TOML utilities listed in the sidebar) processes your data entirely in your browser using JavaScript. Nothing you paste, drop, or open is transmitted to my servers, because there are no servers handling your file content.

What I don't do

• No accounts. The tools never ask you to register, and none of them work differently if you stay anonymous.
• No analytics scripts (no Google Analytics, no Plausible, no Mixpanel, no Hotjar).
• No tracking cookies. The site does not set any cookies at all.
• No advertising pixels.
• No selling or sharing your data with anyone. If you give us an email address it is used to reply to you about what you asked for, and for nothing else.

Third parties that see your IP

Your browser loads a couple of assets from third-party CDNs so the site stays small and fast. Those hosts necessarily see your IP address:

• Google Fonts — fonts.googleapis.com and fonts.gstatic.com, for the Open Sans font.
• jsDelivr — cdn.jsdelivr.net, for libraries used by some tools (@iarna/toml).
• Your hosting provider (for the tomlkit.org domain) can see standard web-server access logs: IP, user-agent, URL, timestamp. I don't use these logs for anything beyond debugging outages and keep them only as long as the host retains them by default.

None of those third parties see the contents of your file, because the content never leaves your browser.

Local storage

The tools currently do not write to localStorage, sessionStorage, or IndexedDB. If that changes in a future update (for example, to remember your last-used options), it will be clearly documented here and nothing will ever be sent to a server.

If you give us your email

Some pages offer a form to hear about an offline version, an API, or licensing. It is optional, it is never required to use any tool, and no tool behaves differently if you ignore it.

If you do submit it, we store:

• The address itself, what you asked about, and the page you asked from.
• The date, and the exact consent wording you agreed to.
• A salted hash of your IP address — never the address itself — to show the consent was genuine and to stop the form being flooded.

We email you about the thing you asked about, and nothing else. Your address is never sold, rented, or shared with a third party. Every email carries an unsubscribe link, and you can ask us to delete the record at any time by writing to the address below — we will, without asking why.

Contact

Privacy questions or concerns: [email protected]. Happy to take a bug report if you spot anything on this site that calls home and shouldn't.