Privacy policy

The short version

Local workbenches compute in your browser. Your inputs and the results they produce are not sent to UtilityForge, whether or not you have an account.

You can use every local tool without an account, with no sync, forever. An account exists so a subscription can be managed and so saved work can follow you between devices when you explicitly ask it to.

Three things reach our servers on their own: aggregate analytics events, sanitised error and performance reports, and the query you submit to a live-data page (which is forwarded to the named provider). Everything else is opt-in.

Browser-local workbenches

Published local calculators, text tools, converters, and developer utilities process their values in the page. UtilityForge does not receive those values for the calculation or transformation, and does not log them.

Saved tools, recents, run counts, theme and motion preferences, collections, and presets are written to your browser's local storage on this device. Clearing that storage removes them; no server copy exists unless you turned sync on.

A share link you create may contain the tool names you chose to share. Do not put sensitive values in a shared link — the product never includes tool inputs in one.

What an account is for

Creating an account stores an email address and a password hash. The password is hashed with scrypt and a per-account random salt and cannot be read back by anyone, including us; a reset replaces it rather than revealing it.

Sign-in creates a session record: an opaque token whose SHA-256 hash is stored, along with when the session was created and last used. Sessions are revocable individually from the account page, and every session is destroyed when the account is deleted.

The account page states, in the same words as this policy, exactly which records exist on the account right now, and offers export and deletion.

Sync: what moves, and what never moves

Sync is off until you turn it on, and it is a merge rather than an upload: turning it on reconciles the records you already have on this device with the account copy, and a failed sync never shortens the local record.

What can be on the account: saved tool slugs, recently opened tool slugs with timestamps, run counts, the auto-rerun preference, collections, presets, playground environment names, non-secret environment values, and redacted guarded-request history.

What can never be on the account: tool inputs, tool results, pasted or uploaded content, playground secret values, request bodies, response bodies, header values, cookies, and authorization values. A preset field whose name looks like a credential is refused rather than stored.

Subscriptions and payments

Payments are processed by PayPal. UtilityForge receives and stores the subscription identifier, plan, billing cycle, status, and current period end so it can grant the plan the subscription pays for. Card and bank details are never sent to, or stored by, this server.

Billing webhooks from PayPal are signature-verified, replay-protected, and recorded for the purpose of reconciling the plan state. If a webhook cannot be verified it is rejected and the plan is not changed.

Live-data providers

A live-data page sends the query needed to obtain the named provider's response, and the provider applies its own terms and privacy practices. Do not submit personal or confidential information to a live-data search field.

The response is cached server-side with its source and freshness state so fallback can be labelled honestly. This is the only feature where your input reaches a third party, and every one of those pages says so on the page.

Analytics, error reports, and performance

The site uses Vercel Analytics for page and interaction events. Its event calls carry route and tool identifiers, event names, result counts, and query length where relevant. They do not send calculator inputs, pasted text, request bodies, headers, or credentials, and the sanitiser that enforces that is unit-tested.

Frontend error reports and Core Web Vitals samples are sent to our own endpoints, not a third party. A report contains the route path, a bucketed timing value, an error name, and a coarse user-agent family; error messages, stack traces, user identifiers, and input values are stripped before the request leaves the page.

The Secure API Playground

The guarded Playground executes a request only after explicit consent, and its controls record HMAC-derived identifiers and bounded event metadata. It does not record the request URL, body, header values, cookies, authorization values, API keys, tokens, passwords, or the response body.

The browser-direct request builder is a separate tool: your browser makes that request, UtilityForge never sees it, and nothing about it is stored beyond what your browser keeps for you.

What you can do about it

Turn sync off on the account page: the account copy stops being updated and this device keeps working. Revoke any signed-in session, including ones you no longer recognise. Export everything stored in this browser as a JSON file. Download the account copy of your saved work. Delete the account: saved work, sessions, tokens, and the identity row are removed. Clear local storage through your browser to remove the device copy.

Account deletion removes the account, its sessions, its reset tokens, and the synced copy. It does not touch what is stored in your browser — that is yours, and the browser controls it.

Subprocessors and retention

The deployment runs on Vercel (hosting and analytics), stores application data in a managed Postgres database, processes payments through PayPal, and queries the providers named on /api-sources. Each is named here because a policy that hides its processors is not a policy.

Records are kept while they serve the purpose described above: workspace records until you delete them or the account, session records until they expire (30 days) or are revoked, and billing records for as long as a subscription can be reconciled or the law requires.

Contact, corrections, and changes

Privacy questions, access requests, and deletion questions go to privacy@utilityforge.app, or support@utilityforge.app for account support. Security reports go to security@utilityforge.app; the disclosure process is published on the contact page.

A material change to these practices appears in this policy and in the changelog. This policy was last updated on 19 September 2026 to document accounts, sync, billing, diagnostics, and deletion, all of which shipped after the previous version was written.