Local when it can be, and clear when it cannot.
The short version: most tools process your input entirely in the browser and send nothing. The checks that look up DNS, certificates, mail or HTTP have to reach the network, and this page says exactly what they send.
what we never collect
- Input from the in-browser tools. Those run locally, with no server involved.
- Personal information. There are no accounts, forms, or sign ups for the tools.
- Behavioral tracking. There are no advertising pixels, no fingerprinting, and no cross-site tracking by us.
- Anything you paste into a tool. It is never logged, stored, or sent to analytics, including by the tools that use the network.
tools that use the network
Some checks cannot work without the network: you cannot read a domain's DNS records or a host's certificate from inside a browser tab. Each of these tools carries a badge on its own page saying so. None of this data is logged, sold, or kept beyond what the check needs to run.
DNS, MX, propagation, reverse DNS, blacklist, BIMI, domain registration and email health checks run on our server, which queries public DNS resolvers, RDAP and public blacklists. The domain or address you enter is sent to make those queries and is not stored.
The SSL checker, bulk checker, OCSP checker and CT log lookup connect to the host you name, or to public CT and OCSP endpoints, from our server. The hostname is sent to make the connection and is not stored. Decoding a certificate, matching a key and converting formats all happen in your browser instead.
The API tester runs public URLs from our server so that CORS does not block them, and runs localhost URLs in your browser only; the request is executed and returned, not stored. The HTTP header check and IP lookup also run from our server, which fetches the URL or queries public IP data.
Receives requests on our server and holds them in a temporary in-memory store for up to 24 hours so you can read them, then deletes them.
The MCP endpoint
The same network checks are available to AI coding agents over the Model Context Protocol at /api/mcp. A call sends one argument, a domain, host, IP address or URL, which is used to make the lookup and is not stored. The endpoint needs no key and no account, and it is rate limited by IP address like the rest of the site.
Hosting
The site is served as static pages with a small number of server routes for the network checks. Like any web host, the hosting provider may keep standard server logs (IP address, requested page, user agent) for security and operations. These logs are not used to identify or profile you and contain none of your tool input.
Browser storage
toolhq keeps a few things in your browser's local storage, on your device, to make the site nicer to use: your light or dark theme, your chosen language, and a short list of tools you recently opened so you can find them again. That list holds only tool names and dates, never anything you typed into a tool. It is optional and asks for your consent the first time; you can decline, and declining clears it. None of this storage is sent to us or to anyone else.
Page counts
The site counts page views using the host's cookieless analytics. The count is anonymous and aggregate: which pages were visited and roughly from which country. There are no persistent identifiers, no fingerprinting, and no way to follow a visitor across sites or sessions. Nothing you type into a tool is ever part of it. It exists so we know which tools are useful and which need work.
Live chat
The site includes a live chat widget provided by Tawk.to, a third party. When a page loads, the widget loads a script from Tawk.to and sets its own cookies so it can run. If you open a chat, the messages you send and basic technical details about your visit are processed by Tawk.to under their own privacy policy. This is the one third party that loads by default; nothing you type into a tool is ever passed to it, and you are never required to use the chat.
Pricing and changes
The core browser tools are free to use and need no account. There are no ads today. If ads or a paid tier are added later, they will be clearly separated from the tool work area, this policy will be updated first, and the privacy behaviour described above will not change quietly. Any change to this policy is visible in the site's public source history.