Privacy Policy

The short version

tapdot tools run entirely in your browser. Nothing you type, paste, or generate is ever sent to any server. No accounts. No cookies. No trackers. Your data stays on your device — always.

What we collect

Nothing from the tools themselves. All processing happens locally in your browser using JavaScript, across every collection — Study, Write, Dev, Marketing, Finance, Legal, HR, Health, Design, and Productivity. Text, numbers, dates, and files you enter into any tool are never transmitted anywhere. They never leave your device.

Anonymous visit counts only. We use Cloudflare Web Analytics to count page visits. No cookies are set and no personal data is collected. Your visit is never tied to your identity. Cloudflare sees only that a page was loaded — not who loaded it, not what you typed, not what you did. You can read Cloudflare's privacy policy at cloudflare.com/privacypolicy.

WSTester — a network tool by nature

WSTester's whole job is to connect to a WebSocket server. Your browser connects directly to the URL you enter — there is no proxy and tapdot never sees the address or the messages. What you send goes only to that server.

Two exceptions — the only other network requests any tool makes

CiteMaker URL lookup. CiteMaker has an optional feature that fetches a webpage's title and author when you paste a URL. To read that page, the URL you paste is sent through a public proxy service (allorigins.win). This only happens when you choose the URL lookup feature — manual citation entry sends nothing anywhere. Use the Manual tab and no network request is ever made.

CurrencyConvert exchange rates. Finance's CurrencyConvert tool fetches live exchange rates from a public rates API (open.er-api.com) so conversions are accurate. Only the request for rates is made — the amounts and currencies you're converting are never sent, since the conversion math happens locally after the rates are loaded. Rates are cached in your browser for the day to minimise requests.

What we do not collect

• No cookies — none, ever
• No IP addresses stored
• No personal information of any kind
• No cross-site tracking
• No advertising tracking
• No user accounts or sign-ups
• No text, documents, or content you enter into any tool

Local storage

Many tools save your data to your browser's localStorage so it persists between sessions — flashcards, notes, habits, budgets, medication logs, saved palettes, and similar. Your dark-mode preference is also stored locally. None of this data ever leaves your device, and it can be cleared at any time through your browser settings or by clearing your browser's site data for tools.tapdot.org.

On-device AI

Several tools — including BiasCheck, FlashForge, CronLab, HeadlineScore, EmailSubjectTester, AdCopyWriter, PersonaBuilder, JobDescriptionWriter, InterviewKit, ContractRead, SymptomDiary, and SleepLog — can use your browser's built-in on-device AI (Gemini Nano, via Chrome's Prompt API) when available. The AI model runs entirely on your own machine — text you enter is never uploaded to any AI provider. If on-device AI is unavailable, each tool falls back to a plain template or simple local rule-based logic. Either way, nothing is sent to a server.

Health tools

BMICalc, MedicationLog, SymptomDiary, CycleTracker, WaterIntake, and SleepLog handle information that can be unusually sensitive — body measurements, medications, symptoms, and cycle dates. This data is stored only in your browser's localStorage and is never transmitted anywhere, including to us. These tools are informational only and are not a substitute for professional medical advice.

Legal and HR tools

ContractRead, NDAGenerator, PrivacyPolicyGen, TermsBuilder, CopyrightChecker, SalaryBand, JobDescriptionWriter, InterviewKit, OfferLetterBuilder, and OnboardingChecklist process documents and compensation data that can be confidential. All generation and analysis — including the on-device AI used by ContractRead, JobDescriptionWriter, and InterviewKit — happens locally. Outputs from these tools are templates and starting points, not legal advice.

Data & AI tools

SchemaViz, NotebookView, VectorLens, and DataSetInspect handle some of the most sensitive material on this site — database schemas, analysis notebooks, embeddings of your source documents, and model training data. None of it is transmitted: files you open are read with the browser's own FileReader and parsed in the page.

SchemaViz does not connect to a database, and cannot. Browsers have no raw TCP socket API, while MySQL and PostgreSQL speak binary TCP protocols, so no web page can reach a database server directly. Tools that appear to do so are relaying credentials and query results through a server operated by someone else. SchemaViz reads schema definitions you paste or open — never a live connection, and it never asks for credentials.

NotebookView renders the HTML outputs stored inside a notebook (pandas tables, for example). Because a notebook may have come from someone else, that markup is sanitised before display: script tags, iframes, inline event handlers, and javascript: URLs are removed.

Contact

Questions about this privacy policy? Email rkmohanchn@gmail.com.