Privacy Policy

1. Tool Input and Network Checks

Most converters and utilities, including the CSV to JSON converter, process input in your browser without sending it to our tool service. Network tools make requests only when you start them. The destination service can see the submitted target and the connecting IP address.

• SSL certificate checker: your browser sends the public hostname and port directly to NetworkCalc. NetworkCalc retrieves the certificate from the target server and returns it to your browser. HeyUtils does not proxy or store this report. NetworkCalc can see your IP address and query, and its own policies govern its processing and logs.
• HTTP header and redirect checks: the URL is sent to a HeyUtils Worker, which resolves the hostname and requests the public destination. These endpoints return results without application-level report storage. DNS resolvers and destination servers receive the information needed for these requests.
• DNS, email DNS, network and IP/ASN lookups: the browser contacts the providers named by the tool, including Cloudflare or Google DNS, Globalping, OXL GeoIP and RDAP services. The provider receives the hostname, IP address, ASN or network-test settings you submit, along with your connecting IP address.
• HTTP client and CORS tester: your browser contacts the URL you enter. The HTTP client sends the request headers and body you configure. The destination receives that data; these requests do not pass through a HeyUtils proxy.
• Webhook tester: senders submit requests to a temporary HeyUtils inbox. We store the method, path, query string, receipt time, selected request headers and body in Cloudflare Durable Object storage until the inbox expires. Common credential headers are redacted before storage, including Authorization, cookies and API-key/token headers. Forwarding and Cloudflare-specific headers are omitted. The path, query and body are not automatically redacted; use synthetic test data without real secrets or personal data.

2. Information We Do Collect

Information you provide directly

• Webhook request data submitted to the temporary inbox, as described in Section 1.
• Messages you send us through the feedback widget, which opens your own email application with your message, page URL, and basic browser/locale details pre-filled — this is sent from your email client, not from our servers.

Information collected automatically

• Visit analytics on pages where analytics are enabled. The current configuration loads a script from app.pageview.app, which can receive page-visit metadata and your connecting IP address. Processing by that provider is subject to its own policies.
• Standard web server logs (such as IP address and request timestamps) kept by our hosting provider for security and reliability.
• For HeyUtils network endpoints, client IP addresses are used to enforce rate limits; hosting, DNS and external API providers may retain their own operational logs.
• Cookies or local storage used only for site functionality, such as remembering that you dismissed a language-suggestion banner. See Section 5.

3. How We Use Information

• To operate, maintain, and improve the Service.
• To understand aggregate usage patterns, such as which tools and categories are most used, so we know what to build next.
• To respond to feedback or support requests you send us directly.
• To detect and prevent abuse of the Service (for example, automated scraping that degrades performance for other users).
• To comply with legal obligations.

4. How We Share Information

We do not sell personal information. Locally processed tool input does not reach our tool service. Network targets reach the services described in Section 1. Webhook events are stored by our hosting provider; reading them requires the inbox management key held in the browser tab. We may share the limited information described above with:

• Service providers that host the site or provide analytics and network lookups, subject to their respective service terms and privacy policies.
• Law enforcement or government agencies when required by law or to protect the rights and safety of users or the public.
• A successor in the event of a merger, acquisition, or sale of assets.

5. Cookies and Local Storage

HeyUtils uses browser local storage for theme preferences, dismissed language suggestions, and JSONPath expressions you explicitly save. These browser records remain until you remove them or clear site storage. You can clear cookies and local storage through your browser settings; doing so resets these preferences and saved expressions. The analytics provider described in Section 2 may have its own browser-storage practices.

6. Data Retention

Locally processed tool input is not sent to our tool service. Each Webhook inbox expires 30 minutes after creation, rather than 30 minutes after each incoming request. At expiry, its stored events and management-key hash are deleted; a non-sensitive expiry marker remains so the endpoint can distinguish an expired inbox. An inbox accepts at most 50 events with a maximum body size of 64 KiB per event. Closing or clearing the browser tab does not immediately delete the server inbox: the same expiry still applies. Other HeyUtils network-check endpoints do not persist completed reports in application storage. Hosting logs, analytics and third-party API records follow the respective providers' retention policies.

7. Security

We use industry-standard measures (such as HTTPS) to protect the Service and any limited information we do collect. No method of transmission over the Internet or electronic storage is 100% secure, and we cannot guarantee absolute security.

8. Your Rights

Depending on your location, you may have rights to access, correct, or request deletion of personal data we hold about you. HeyUtils has no accounts, but feedback messages and temporary Webhook submissions can contain personal data. Locally processed input is not available to us. To ask about data we hold, contact us at hi@heyutils.com.

9. Children's Privacy

The Service is not directed to individuals under the age of 13, and we do not knowingly collect personal information from children. If you believe a child has provided us information (for example, through the feedback form), contact us and we will delete it.

10. Third-Party Links and Ads

The Service links to third-party websites and uses the network providers described in Section 1. We encourage you to review their privacy policies. The current configuration does not enable Adsterra or Google AdSense scripts. If advertising is enabled later, this policy will be updated to identify the provider and relevant data handling.

11. Changes to This Policy

We may update this Privacy Policy as the Service evolves — for example, if a future tool needs to make network requests to function. We will update the effective date above when we do, and material changes will be noted on this page.

12. Contact Us

If you have any questions about this Privacy Policy, contact us at hi@heyutils.com.