Privacy

How the tools work

UtilDock is a static website. When you open a tool, your browser downloads some HTML, CSS and JavaScript, and everything after that happens locally. Parsing, formatting, validating and comparing all run inside a Web Worker in your tab. Opening a file with the Load button — or dropping one onto the page — reads it from your disk into memory; it is not an upload.

What is stored on your device

So that a refresh does not lose your work, each tool saves its current input to your browser's localStorage, along with your theme choice and a few preferences such as indent size. This data stays on your device, is readable only by UtilDock in your browser, and is never transmitted anywhere. Clearing your browser's site data for this domain removes all of it.

Cookies, tracking and analytics

UtilDock sets no cookies, runs no advertising, and embeds no third-party trackers, social widgets, or hosted fonts. There is no account system, so there is nothing to sign up for and no profile to build. You will never see a consent banner here, because there is nothing to consent to.

That includes analytics. We run no analytics product, and nothing in this site's source code loads one. There is one exception we do not fully control, and rather than leave you to find it in the page source, it is described in full below.

Our host, Cloudflare

UtilDock is a set of static files served by Cloudflare Pages. Like any web host, Cloudflare processes the network requests needed to deliver a page and may retain limited technical data — IP address, user agent, timestamps — for security and abuse prevention, governed by Cloudflare's own privacy policy. That covers requests for the site's own files. What you paste into a tool is never part of any request, so it is never in any log.

Cloudflare also injects a small analytics script into the HTML of sites it serves, pointing at static.cloudflareinsights.com. It is not in our source code and we did not put it there; it is added at Cloudflare's edge as the page is delivered. Taken on its own it is a mild thing — no cookies, no fingerprinting, no cross-site profile, and no sale of data — but it is still a request to somebody else's server, and this site's whole claim is that there are none.

So the browser refuses to run it. The Content-Security-Policy described below forbids loading scripts from any origin but this one, and your browser enforces that before a single byte is fetched. The script is present in the markup and never executes; no analytics data about your visit reaches Cloudflare or anyone else. You can confirm it in seconds — see below.

The Content-Security-Policy

A Content-Security-Policy is a header a site sends to instruct your browser about what that page is allowed to do. Unlike a privacy promise, it is not a statement of intent — it is a rule your browser enforces on our behalf, whether we like it or not.

Ours says, in effect:

• Load nothing from anywhere else. Scripts, styles, fonts and images may come only from this domain. No CDN, no hosted font, no embedded widget — and no analytics beacon.
• Send nothing anywhere else. The page cannot open a connection to any other server. This is the important one: even if a dependency we rely on were compromised tomorrow, it would have nowhere to send your data.
• Run no generated code. The policy omits unsafe-eval, so nothing on the page can build and execute new code at runtime. This shaped the tools themselves: our JSON Schema validator interprets schemas rather than compiling them, because the compiling kind could not run here.
• Submit no forms, and load in no frames. There is nowhere for data to be posted, and the site cannot be embedded and dressed up as something else.

This is why the privacy claim on this page is a description of a mechanism rather than a policy you have to trust us to keep.

Verifying this yourself

You do not have to take our word for any of it. Open your browser's developer tools, switch to the Network tab, and use any tool on this site: every request goes to this domain. The one exception is the Cloudflare beacon described above, which you will see listed as blocked, with nothing transferred — the Console tab names the policy that stopped it.

The stronger test takes ten seconds: load any tool, disconnect from the internet, and keep working. Paste a document, format it, compare it. It all still runs, because there was never anything to send.

Changes

If this policy ever changes, the date at the top of this page changes with it. The commitment that your data stays in your browser is not something we intend to revisit.