Privacy Policy

1. Overview

CryptKit (“we,” “our,” or “us”) operates the website available at cryptkit.dev. This Privacy Policy explains what information is associated with your use of our services and how we handle it.

We are committed to transparency. CryptKit is a purely client-side application — we do not collect personally identifiable information (PII) and there is no user account system, no server-side logging of user input, and no database that stores your sensitive data.

We do, however, use limited third-party analytics and advertising services (detailed below) that process anonymized, non-PII data such as page-view counts and anonymized IP addresses. These services are standard for any website that offers free content and are configured to minimize data collection.

2. Information We Do NOT Collect

• We do not collect your tool inputs. Passwords, private keys, mnemonic phrases, encrypted messages, and any other data you type into our tools are processed entirely within your browser. They are never transmitted to our servers or any third party.
• We do not collect names, email addresses, or account information. There is no registration or login system.
• We do not use server-side analytics or tracking pixels that capture user input or browsing behavior beyond standard page-view metrics.
• We do not sell or share personal data with third parties.

Browser storage. CryptKit does not use localStorage, sessionStorage, or IndexedDB to persist any user data. We have deliberately chosen not to implement features like “recently used tools” or “favorites” that would require client-side persistent storage.

3. Third-Party Services

We use the following third-party services, each governed by its own privacy policy:

• Google Analytics 4 (GA4) — We use GA4 to collect anonymized usage statistics (page views, approximate geographic region, device type) so we can understand how many people use CryptKit and improve the site. GA4 is configured with IP anonymization enabled, meaning your IP address is shortened before storage and is not used to personally identify you. GA4 cookies (_ga, _gid) collect only anonymous session identifiers. (Note: This resolves the earlier contradiction where we claimed “no cookies for tracking.” GA4 is analytics, not invasive tracking — but we should have been explicit about it from the start.)
• Google AdSense — We display advertisements served by Google. Google may use cookies (such as NID, IDE) to serve ads based on your prior visits. You can opt out of personalized advertising by visiting Google Ads Settings.
• Google Fonts — Fonts are loaded from Google’s CDN. Google may receive your IP address when font files are requested. We are evaluating self-hosting options to eliminate this.

4. Cookies

CryptKit itself does not set any first-party cookies. However, third-party services (Google Analytics 4, Google AdSense) may place cookies in your browser. These cookies are governed by the respective third parties’ privacy policies.

You can control and delete cookies through your browser settings. Note that disabling cookies may affect the functionality of third-party services (e.g., ads may not display correctly, or analytics may not track your visit).

For detailed information about which specific cookies are used, please see our Cookie Policy.

5. Data Security

Because we do not collect or store your sensitive data, there is nothing on our servers to breach. All cryptographic operations are performed locally in your browser using the Web Crypto API. Your passwords, keys, and sensitive inputs never leave your device.

Your responsibility. While we take care to ensure our tools use well-established algorithms and cryptographically secure random number generators, the security of your generated credentials depends on factors beyond our control, including your device security, browser version, and operating environment. You are solely responsible for:

• Safely storing and backing up any passwords, keys, or mnemonic phrases you generate.
• Verifying the strength and suitability of generated outputs before use.
• Using dedicated, audited tools (e.g., hardware wallets, password managers) for high-value assets.

6. Children’s Privacy

CryptKit is not directed to children under the age of 13 (or 16 in the European Economic Area). We do not knowingly collect any personal information from children. If you believe a child has provided us with personal information, please contact us and we will take appropriate action.

7. Your Rights (GDPR / CCPA)

Because we do not collect personal data, there is no personal data to access, correct, delete, or port. However, with respect to third-party cookies:

• GDPR (EU/EEA): You have the right to restrict processing of your data. You can block third-party cookies via your browser settings or use Google’s opt-out tools.
• CCPA (California): You have the right to opt out of the “sale” of personal information. Google AdSense may be considered a “sale” under CCPA. You can opt out via Google Ads Settings.

8. Changes to This Policy

We may update this Privacy Policy from time to time. Any changes will be posted on this page with an updated revision date. We encourage you to review this page periodically.

9. Contact Us

If you have questions about this Privacy Policy, please contact us at our contact page.