Privacy Policy

Overview

WebUtil.io ("we", "us", "our") provides free, browser-based developer tools and web utilities. We are committed to protecting your privacy. This policy explains what data we collect, how we use it, and your rights.

Client-Side Processing

All tools on WebUtil.io process your data entirely within your web browser using JavaScript. Your input data is not transmitted to our servers. The one exception is the optional group link of the Secret Santa Generator: there, names and matches are encrypted in your browser first, and only that encrypted data is stored on our server (see “Secret Santa group links” below). No text, code, JSON, hashes, tokens, or any other content you enter into our tools is ever sent to us in readable form.

Data We Collect

Analytics

We may use analytics tools to understand how visitors use our site. If analytics are active, the following data may be collected:

• Pages visited and time spent
• Referring website
• Browser type and operating system
• Approximate geographic location (country/region level, based on anonymized IP)

IP addresses are anonymized before storage. We do not share analytics data with third parties.

Contact Form

If you contact us through our contact form, we collect the information you provide: your name, email address, and message. This data is used solely to respond to your inquiry and is not shared with third parties.

Server Logs

Our web server automatically logs standard access information including IP addresses, browser user agents, requested URLs, and timestamps. These logs are retained for security purposes and are automatically deleted after 30 days. For Secret Santa group links, the log contains the random room ID in the requested URL, but never the key needed to read the contents.

Secret Santa group links

If an organizer chooses “One link for the group chat” in our Secret Santa Generator, we store a small, encrypted record on our own server in Germany (EU) so that each participant can open their name exactly once.

• What is stored: the list of names and one box per person (their match, and the budget, date and wishes the organizer entered). Both are encrypted with AES-GCM in the organizer’s browser. The key is only in the part of the link after “#”, which browsers never send to a server, so we cannot read names, matches or wishes. We also store a random room ID, which of the names have been opened, the deletion date, and a one-way hash of the organizer’s secret token.
• What is not stored: no accounts, no email addresses, no IP addresses. To prevent abuse we count requests per network for one hour, using a key derived from the IP address and the current hour. The count and the key are discarded after that hour.
• Deletion: when a name is opened, its box is handed out once and deleted from our server right away; only the “opened” mark remains. The organizer can reset it, delete the whole group, or draw again at any time. The whole record is deleted automatically 7 days after the gift exchange date, and in any case no later than 60 days after it was created. Encrypted copies may remain in our encrypted server backups until those backups are rotated out under our regular retention schedule. They cannot be read there either, because the key never reached our server.
• Purpose and legal basis: we store this only to provide the group link you asked for (Art. 6(1)(b) GDPR) and to protect the service against abuse (Art. 6(1)(f) GDPR, our legitimate interest in a working, secure service). The data is not shared with anyone and not used for analytics or advertising.
• The organizer creates the draw and could technically see all matches before sending the link — just like with the per-person links. We cannot.

Cookies

WebUtil.io uses the following cookies:

• Essential cookies — Required for the website to function (e.g., consent preferences). These cannot be disabled.
• Analytics cookies — Used to track anonymous usage statistics. These are only set with your consent.

We use Klaro as our consent management tool, which allows you to control which non-essential cookies are set. You can change your preferences at any time.

Advertising

We may display advertisements provided by Google AdSense or similar advertising networks. These services may use cookies to serve ads based on your prior visits to this or other websites. You can opt out of personalized advertising by visiting Google Ads Settings.

Third-Party Services

Beyond what is described above, we do not share, sell, or transfer your personal data to any third party.

Your Rights (GDPR / CCPA)

Depending on your location, you may have the right to:

• Access the personal data we hold about you
• Request correction or deletion of your personal data
• Object to or restrict processing of your personal data
• Data portability
• Withdraw consent at any time (without affecting the lawfulness of processing before withdrawal)

To exercise any of these rights, please contact us.

Children's Privacy

Our services are not directed at children under the age of 13. We do not knowingly collect personal information from children.

Changes to This Policy

We may update this privacy policy from time to time. Changes will be posted on this page with an updated revision date.

Contact

If you have questions about this privacy policy, please reach out via our contact page.