Privacy Policy

1. Tool data

Most Z Tools utilities perform their primary transformation locally in browser JavaScript. This includes JSON, JWT, Base64, Hash, URL, Markdown, QR, Password, Case, and Color. Z Tools does not provide a server API that receives the working input for those transformations.

The site may keep small, non-content interface settings such as a selected mode or algorithm in the URL. Working content—JSON, JWTs, Base64, URLs, passwords, Markdown, QR payloads, and hash input—is not written to the URL, browser history, or site analytics by this build.

2. Image Compressor

Image Compressor is the server-processing exception. The image is uploaded to the server for PHP GD processing. The current limits are 10 MiB and 12.5 megapixels. Files use randomized, session-bound names and are not served directly from the upload directory. The download flow uses an expiring HMAC-protected URL, and temporary image files are cleaned within 5 minutes.

3. Self-hosted access statistics

Z Tools keeps append-only daily analytics files for 180 days. A record can include: timestamp; an anonymized IPv4 /24 or IPv6 /48 prefix; page/script name; request path (up to 200 characters); event type and target; external referrer host; two-letter country code when the hosting/edge layer supplies it; up to 200 characters of the user-agent string; and HTTP status. Known bot/user-agent patterns and admin/assets/temp paths are excluded where the implementation specifies.

The analytics module does not make an outbound analytics API call. Country data may be populated from a CF-IPCountry request header when present.

4. Contact Form

The Contact Form stores the name, email address, category, message text, creation time, and read/unread state in protected local server files. These messages are retained until manually deleted from the Z Tools admin dashboard. The site does not forward them to a public Gmail address or third-party support service.

5. Security/session data

Session cookies are used where server state is necessary, including CSRF protection, rate limiting/session binding, Image Compressor ownership, and admin access. Security controls may also write short-lived local rate-limit files. Z Tools does not offer public user accounts.

6. Google AdSense connection

The site currently loads the Google AdSense JavaScript associated with its publisher account so the site can be connected/reviewed. Z Tools does not intentionally render visible ad slots in this build. Loading Google-hosted JavaScript can cause network requests and data handling by Google under Google’s own policies. If advertising is enabled later, this policy should be reviewed again before deployment.

7. External links and vendored libraries

Documentation may link to standards and primary references on other websites. Following those links leaves Z Tools. Tool libraries used for core workflows are served from this site where the current implementation vendors them.

8. Requests and questions

Use the Contact Form for privacy questions or requests. Do not include passwords, access tokens, private keys, or unrelated sensitive data in a message.