Technical Transparency
"Runs in your browser, nothing is sent to a server" is an easy claim to make and a hard one to trust blindly. This page explains exactly what that means mechanically for the free tools, so you don't have to take it on faith — and is equally direct about the one part of the site that does use a server: Cryonel API Guard, our paid product, which necessarily stores some data to do its job.
Free tools: zero network requests for tool data
Every free tool (JSON, JWT, YAML, CSV, OpenAPI, Base64, UUID, timestamp, regex, JWKS/PEM, JSON Schema) is implemented with plain browser-native APIs — JSON.parse, the Web Crypto API for JWT signatures and JWKS/PEM conversion, atob/btoa for Base64, regular string/array processing for everything else. None of it calls fetch or XMLHttpRequest to send what you typed anywhere.
Verify it yourself: open your browser's DevTools, go to the Network tab, use any tool with real (or fake) sensitive data, and watch the request list. Page-load requests may include Google AdSense, but clicking Validate, Decode, Convert, or any other tool action sends no request containing your input or output.
Free tools: what's actually stored, and where
localStorage['cryonel-theme']— your light/dark mode preference. One string, set only when you click the theme toggle, never read by anything except the page itself.localStorage['cryonel-recent-tools']andlocalStorage['cryonel-favorite-tools']— up to eight recently opened tool slugs and the tool slugs you explicitly favorite. They contain route identifiers such asjson-validator, never the data you paste or generate, and never leave this device.sessionStorage['cryonel-handoff']— a versioned record containing source/target tool slugs, media type, and the value you explicitly send. The destination reads and immediately clears it. It never leaves your browser and doesn't survive a tab close.sessionStorage['cryonel-workflow']— the active recipe's version, ordered tool slugs, current index, completed slugs, and a compatibility notice. It never contains tool input or output; ending the workflow or closing the tab removes it.- Shareable recipe links (/recipe) — a recipe link only ever encodes which tools and in what order, as a
#hash fragment. Browsers never send the part of a URL after#to a server, and the link deliberately cannot encode your actual data. - Analytics is route-only and consent-gated. The GA4 tag uses measurement ID
G-GMK4DMQYT3with storage denied by default. Public page views and twelve allowlisted product/funnel events are forwarded only after “Allow analytics”. The only eligible account routes are/app/signupand/app/dashboard, and no account page-view event is sent. Event fields are limited to fixed routes, tool slugs, destination routes, signup method, monitor source, plan and billing period. Query strings, hashes, arbitrary values, tool/account content, specs, emails and user IDs are rejected.
The service worker only caches files, not your data
Cryonel registers a service worker (/sw.js) so the site loads fast and works offline after your first visit. It caches static files — HTML, CSS, JS, icons — using a network-falling-back-to-cache strategy. A service worker can only see requests that actually go out over the network; since free-tool data never triggers a network request in the first place, the service worker never sees it either.
Cryonel API Guard: what it stores, and why
API Guard is a genuine exception to "nothing is sent to a server" — it monitors an OpenAPI spec you register and can't do that without keeping some state. Here's exactly what, mechanically:
- Account: email + a bcrypt hash of your password (never the password itself). Sessions are server-side rows in a database, identified by a random token in an
httponly,secure,SameSite=Laxcookie — not a JWT you could inspect, by design, so a session can be revoked (e.g. "log out everywhere") by deleting a database row rather than waiting for a token to expire. - Watched APIs: the spec URL (needed to re-fetch it) plus a parsed and normalized copy of the spec and a hash of it — not the original raw text. The hash lets a re-check skip the (more expensive) diff entirely when nothing changed.
- The URL fetch is SSRF-guarded: only
http/httpson ports 80/443, private/loopback/link-local addresses rejected (including IPv4-mapped IPv6 forms), redirects not followed, and the connection is pinned to the exact IP that was validated so a DNS answer can't change between the check and the connect (DNS rebinding). Remote$refpointers inside a spec are deliberately left unresolved rather than fetched, for the same reason. - Change history: what changed and how severe (breaking / potentially breaking / non-breaking / documentation-only), per watched API.
- Outbound alerts: Pro users can configure Slack incoming-webhook or generic HTTPS destinations. Destination URLs and generic signing secrets use authenticated secretbox encryption at rest. Delivery re-validates and pins the public DNS result, follows no redirects, and retries network errors, HTTP 429, and server errors up to three attempts. Generic JSON is signed with HMAC-SHA256 and excludes account email, user ID, spec URL, and raw spec content.
- CLI and GitHub Action: base and candidate specifications are read and compared inside the developer machine or GitHub runner. A local JSON file can filter matching rule codes or schema locations and set the exit threshold. The action writes the remaining classifications and locations to the job summary and optional PR comment; it does not upload either specification to Cryonel.
- Billing: handled by Polar as Merchant of Record — Cryonel never receives or stores your card details. Polar notifies us of subscription state via a webhook, which is signature-verified (HMAC-SHA256, the Standard Webhooks spec) before anything is trusted, and processed idempotently so a redelivered notification can't double-apply.
- Deletion: removing a watched API deletes its spec data and history immediately; deleting your account removes all your sessions, watched APIs, and history. Billing event records are kept longer for accounting (full detail 90 days, then reduced to minimal metadata for up to 24 months) but never contain your spec content.
- Logs: application logs (30 days) and security/auth logs (90 days) never contain spec content or auth/session tokens.
If you downgrade from Pro to Free with more watched APIs than the Free plan allows, none of them are deleted — the oldest stays active and the rest are paused (monitoring stops, data stays) until you either upgrade again or remove some.
Advertising
Cryonel loads the Google AdSense publisher script only on documentation and reference pages using publisher ID ca-pub-7970408813538482. Tool workspaces, the homepage, API Guard, pricing, services and account routes do not load it. The repository does not render manual ad units or empty advertising placeholders. Ad serving in the EEA, United Kingdom, or Switzerland must remain disabled until a Google-certified consent management platform is active. See the Privacy Policy and Cookie Policy.