NiftyKit

Privacy policy

Last updated: 2 November 2026

Summary

  • The tools process what you type or paste in your browser. My code never sends your input to me or anyone else, and never puts it in the page address.
  • NiftyKit shows adverts from Google AdSense. Google and its partners use cookies and similar technologies to show and measure ads, and to personalise them if you agree. In the UK, the European Economic Area and Switzerland you are asked for your consent first.
  • There are no accounts and no analytics. NiftyKit’s own code sets no cookies.
  • My hosting provider, Hostinger, keeps standard server logs (such as IP addresses) to deliver and protect the website.
  • If you email me, I use your message only to reply.

Who I am

This policy covers the NiftyKit website at niftykit.app (“NiftyKit”, “I”, “me”). NiftyKit is created and run by Stuart Mathieson, an independent web developer in Scotland, who is the data controller responsible for deciding how personal data collected through the website is used. You can contact me about privacy at[email protected].

Text and data you enter into the tools

Every NiftyKit tool runs as JavaScript in your web browser. Whether you paste text, such as JSON or a token, or choose a file, such as an image to compress or a download to check against its hash, the processing happens on your own device. What you enter, and any file you choose, is:

  • not uploaded to my servers or anyone else’s;
  • not logged, stored or shared by me;
  • not passed to the advertising code on the page;
  • not put in the page address, which is sent to Google with ad requests;
  • not saved in your browser’s storage, so it is gone when you close or reload the page.

The only exceptions to the page address rule are the timer, which keeps the length of a countdown after the# so you can bookmark it, and the time zone converter, which keeps the time zones you chose.

You can check this yourself: open your browser’s developer tools, choose the Network tab and use a tool. On pages with ads you will see requests to Google’s ad servers, but none that contain your input. Once a page has loaded, its tool keeps working even if you go offline. The only exceptions are the YAML converter and the passphrase word list, which are downloaded from my server the first time you use them.

Ads and the content of the page

Google’s ad code runs on the same pages as most of the tools. It is there to choose, show and measure ads, and my code does not give it anything you enter. As with any script on a web page, though, I cannot technically stop third-party code from reading the page it runs on.

So the tools where you are most likely to enter a secret carry no ads at all: thePassword Generator, the JWT Decoderand the Certificate Decoder. Those pages load no third-party code, and they tell your browser to block connections to any other website, so even a mistake in my code could not send what you enter elsewhere.

For anything else that is highly sensitive, such as a live production secret, you can load the tool, disconnect from the internet and then use it. The tools work offline, and nothing at all can leave your device.

Your browser or operating system may have its own features, such as clipboard history, autofill or browser extensions, that can see or store text. Those are outside my control and covered by their own privacy terms.

Advertising

NiftyKit is free to use because it shows adverts on most pages. They are served by Google AdSense, a service of Google. Google may also show ads from other advertising companies (“vendors”) that it works with.

What Google receives

When a page loads, Google’s ad code runs in your browser and sends Google information so that it can choose an ad, show it, count it, and prevent fraud. This includes:

  • the address of the page you are viewing;
  • your IP address, from which Google estimates a rough location;
  • your browser, device type, screen size and language;
  • cookies or similar identifiers, where they are allowed;
  • how you interact with the ads, such as whether one is viewed or clicked.

Google uses this data as an independent controller, under its own privacy policy. Google explains this inhow Google uses information from sites that use its services, and lists the cookies it uses for advertising in how Google uses cookies in advertising.

Your choices in the UK, the EEA and Switzerland

If you visit from the UK, the European Economic Area or Switzerland, Google shows a consent message the first time you visit. It is a Google-certified consent management platform that follows the IAB Europe Transparency and Consent Framework. It asks whether Google and its vendors may store and read cookies on your device and use your data to personalise ads. You can accept, refuse, or choose purposes and vendors one by one.

If you refuse, you can still use every tool. Google may then show non-personalised or limited ads, which are chosen from the page you are on and your general location rather than from your browsing history. My legal basis for advertising cookies is your consent, which you can change or withdraw at any time with thePrivacy and cookie settings link at the bottom of every page.

Your choices everywhere else

Elsewhere, Google may use cookies to personalise ads. You can turn ad personalisation off inGoogle’s My Ad Center. To opt out of personalised ads from many other advertising companies, visit aboutads.info, oryouronlinechoices.eu in Europe. Most browsers also let you block or delete cookies, including third-party cookies.

What I see

I do not receive personal data about you from Google. AdSense gives me summary reports, such as how many ads were shown on each page and what they earned. Nobody pays to be featured or recommended in a tool or a guide, and ads are never made to look like part of a tool or a download button.

Information collected when you visit

The website is hosted by Hostinger (HOSTINGER, UAB, based in Lithuania in the European Union). Like any web server, Hostinger’s servers automatically record technical information when your browser requests a page or file. This normally includes:

  • your IP address;
  • the date and time of the request;
  • the page or file requested and whether it was delivered successfully;
  • your browser and operating system (the “user agent”);
  • the referring page, if your browser sends it.

This information is used to deliver the website, keep it secure, prevent abuse and diagnose technical problems. I do not use it to identify you, track you across other websites or build a profile of you. My legal basis is my legitimate interest in operating a secure, working website. Hostinger processes this data on my behalf as a data processor and keeps logs only for a limited period. SeeHostinger’s privacy policy for more.

Cookies and similar technologies

NiftyKit’s own code does not set cookies and does not use your browser’s storage, tracking pixels or fingerprinting. The cookies and similar technologies on this website come from Google’s advertising and consent code:

  • Consent cookies remember the choice you made in the consent message, so you are not asked on every page.
  • Advertising cookies, such as Google’s __gads and __gpi, are used to show and measure ads, limit how often you see the same ad, and prevent fraud. Where you have agreed, they are also used to personalise ads. Google and its vendors may also set cookies on their own domains.

In the UK, the EEA and Switzerland these are only used for advertising in the ways you have agreed to in the consent message. Cookie names and lifetimes are set by Google and change from time to time; Google’sadvertising cookie page has the current details.

Analytics and other third parties

I do not use analytics services. Apart from Google’s advertising and consent code, pages do not load scripts, fonts or other resources from third-party websites. Links to other websites, such as this policy’s links to Google and Hostinger, are covered by those websites’ own privacy policies.

If I introduce privacy-friendly analytics in future, I will update this policy first. Analytics would only record things like which tool was opened or that a result was copied, never the content you enter.

If you contact me

If you email [email protected], I receive your email address, your name if you include it, and the contents of your message. I use this only to reply to you and to improve NiftyKit, based on my legitimate interest in responding to enquiries. I keep messages only as long as needed for that purpose and then delete them. Please do not send me passwords, personal data or confidential content you have used in a tool.

Sharing your information

I do not sell, rent or trade personal data. The organisations that handle data on my behalf are my web hosting and email providers, which do so to provide their services to me. Google receives the information described underAdvertising directly from your browser, as an independent controller. I may disclose information if I am legally required to, for example in response to a valid court order.

Where data is stored

Hostinger is based in the European Union. Depending on the data centre and content delivery network used to serve the website, server logs may be processed in other countries. Google processes advertising data in many countries, including the United States. Where data is transferred outside the UK or the European Economic Area, Hostinger and Google rely on legal safeguards such as standard contractual clauses or adequacy arrangements, as described in their own privacy policies.

Your rights

Under UK and EU data protection law (the UK GDPR and the GDPR), you have the right to:

  • ask whether I hold personal data about you and get a copy of it;
  • ask me to correct or delete it;
  • object to or ask me to restrict how I use it;
  • ask me to transfer it to you or another organisation, where that applies;
  • withdraw your consent to advertising cookies at any time, without affecting what happened before.

In practice, the only personal data I hold that can be linked to you is usually an email you have sent me. Because server logs are not linked to names or accounts, I usually cannot match them to a particular person. To use any of these rights, email [email protected]. I will reply within one month. For data that Google holds about you, use the tools in your Google account or contact Google directly, because I cannot access or delete it.

If you are unhappy with how I handle your data, please contact me first so I can try to help. You also have the right to complain to a data protection authority: in the UK, the Information Commissioner’s Office (ico.org.uk), or the authority in your own country if you live in the EU.

Children

NiftyKit is a general-audience website and is not aimed at children. It does not knowingly collect personal data from children, and there are no accounts or forms that ask for it.

Security

The website is served only over an encrypted HTTPS connection and uses security headers that, for example, stop other websites from embedding its pages and block browser plugins. Because tool input is never sent to my servers, it cannot be exposed by a breach of them.

Changes to this policy

If I change how NiftyKit handles data, I will update this page and the “Last updated” date at the top. I will not reduce your privacy protections without making that clear here first.

Contact

Questions about this policy or your data: [email protected].