Trust & Verification
A verifiable privacy promise. Not our words — your own eyes.
We Cannot Upload Your Data
Not because we promise — because of architecture. ToolVault has no user-data backend server and no database (only a stateless request-forwarding endpoint). Even if we wanted to upload, there's nowhere to send it.
Technical Architecture
Frontend Layer
React + Web Crypto API. All computation happens in your browser.
Service Worker
Caches the pages and assets you visit. The tools you have used keep working offline.
✗ Backend Server
Tool inputs are not stored in an app database. A minimal proxy exists only for API Tester (optional) so CORS-blocked requests can be relayed — it is not a general upload backend.
✗ Database
Does not exist. There is nowhere your input could be stored.
✗ Input Data Tracking
Your tool input enters no analytics script or server log.
How to Verify (30 seconds)
- 1Open any tool page on this site
- 2Press F12 to open browser DevTools
- 3Switch to the Network panel
- 4Use the tool normally (type text, click buttons)
- 5Observe: the page issues only anonymous-stats requests (no ad requests at this stage — ads load only after Google approval and your explicit consent); your input appears in none of them
Compared to Other Tool Sites
| Feature | ToolVault | BeJSON | tool.lu | CodeBeautify |
|---|---|---|---|---|
| Data flows to | Browser (proxy only if you opt in) | Server | Server | Server |
| Tool paste uploaded | No (except explicit proxy request) | Uploaded | Uploaded | Uploaded |
| Works offline | ✅ | ❌ | ❌ | ❌ |
| Tool input tracked | Never | Possibly | Possibly | Possibly |
Mathematical Privacy, Not Legal Privacy
Most websites say "we promise not to upload your data" — that's a legal promise you cannot verify. We say "we cannot upload your data" — that's an architectural fact you can verify yourself.
How This Site Stays Free
Anonymous visit statistics (Google Analytics) load by default (EEA/UK visitors: only after your explicit consent in Cookie Settings; elsewhere you can disable them anytime, and browser GPC opt-out signals are honored); we use them to understand tool usage and keep the tools free. Ads (Google AdSense) load only after Google approval AND your explicit acceptance in Cookie Settings — at this stage the site shows no ads and loads no ad scripts at all, keeping only the AdSense account-verification meta. Statistics and ads record page views only — they never contain, and have no access to, anything you type into a tool. Most computation runs inside your browser; the optional API Tester proxy only forwards the HTTP request you choose to send. You can inspect these requests in the DevTools Network panel.
FAQ
Why is there no AI feature?+
Any AI call requires sending your data to a model host, which conflicts with our default local-first stance. Instead, we use deterministic local algorithms (Schema inference, template libraries, Web Crypto API) to cover most of what AI would do.
How do favorites sync across devices?+
Favorites are stored in your browser's localStorage and never uploaded. You can export a backup from the favorites page and import it on another device.
What happens if your server goes down?+
Mostly nothing. Every tool page you visit is cached automatically by the Service Worker — those tools keep working even if our servers go down. Tools you have never opened need the network for the first load.
Are there really no cookies?+
No statistics scripts load until you accept cookies; theme and language preferences are stored in localStorage (never uploaded). After acceptance, Google Analytics sets an anonymous analytics cookie. Verify with uBlock Origin or DevTools → Application panel.