Privacy Policy

1. Controller identity and contact

Sikelia Tools is a Sikelia Labs service published attools.sikelialabs.com. This product-specific notice supplements the central Sikelia Labs privacy information. The legally relevant controller identity and contact details required by GDPR Article 13 are maintained in theSikelia Labs Privacy Policy.

Primary project domain: sikelialabs.com.
Privacy and general enquiries: [email protected].
Security reports: [email protected].

2. Data processed by browser-only tools

Most Sikelia Tools run entirely in your browser. Text, names, lists, dice results, generated teams, converted documents and compressed images are not sent to Sikelia Tools servers merely to perform those local operations.

Some tools use browser localStorage to remember convenience settings or bounded local state, such as selected themes, counts, recent results or tool preferences. This information stays in the browser profile on your device and can be removed by clearing the site's local data. Content-bearing Converter and Image Compressor workflows do not upload their input to Sikelia Tools.

3. Private Note

Private Note is the deliberate server-backed exception. Your browser generates a fresh random 256-bit key and encrypts the note with AES-GCM-256 before upload. For an ordinary note, the decryption key is carried only in the share link'sURL fragment; browsers do not send that fragment in HTTP requests. The service stores encrypted ciphertext, an opaque note identifier and timestamps required for expiry and one-time consumption.

If you optionally enable password protection, the password is not sent to or stored by the server. In the browser, PBKDF2-HMAC-SHA-256 with a fresh random salt and 600,000 iterations derives a key that AES-GCM-wraps the independently random note key. The URL fragment contains the salt and wrapped-key material, not the password. A wrong password is rejected locally before the one-time note is fetched, so an incorrect password attempt does not consume the stored note. There is no password recovery. A weak password can still be guessed offline by someone who obtains the protected link, so use a long, unique passphrase and share it separately.

Notes are limited to 8 KiB of UTF-8 plaintext. You choose a lifetime between 60 seconds and 7 days. A successful consume deletes the stored note; an expired, already-consumed or unknown note is treated in the same uniform way. The service also necessarily observes limited connection metadata, including an IP address, for network delivery, abuse prevention and bounded rate limiting. Private Note is encrypted-content storage, not a zero-metadata service.

Never use Private Note as the only copy of information you must retain: a lost link, forgotten password, consumed note or expired note is intentionally unrecoverable.

4. Infrastructure and security data

The public site and server-backed Private Note components use Cloudflare infrastructure. Cloudflare may process technical connection information needed to deliver and protect requests, such as IP address, request time, protocol/security information and abuse signals. Sikelia Tools does not currently add visitor analytics, advertising pixels, remarketing or profiling to that processing.

5. Purposes and legal bases

• Provide a requested tool or Private Note operation: processing needed to provide the service you actively request (GDPR Article 6(1)(b), where applicable).
• Security, rate limiting and service integrity: limited technical processing based on legitimate interests in protecting users and infrastructure (Article 6(1)(f)).
• Legal obligations: information may be processed where necessary to comply with an applicable legal obligation (Article 6(1)(c)).

Sikelia Tools does not use the data described here for advertising profiles or solely automated decisions that produce legal or similarly significant effects.

6. Retention

• Local tool state remains on your device until you clear it or the tool replaces it.
• Private Note ciphertext is kept only until first successful consumption or the chosen expiry, never longer than 7 days by design.
• Private Note rate-limit state is bounded to the applicable fixed security window.
• Optional Private Note passwords and decrypted note keys are not stored server-side.
• Infrastructure/security logs, where generated by hosting or network providers, follow the relevant provider and operational retention controls.

7. Recipients and international transfers

Personal data is not sold. Technical data may be processed by infrastructure providers necessary to host, deliver and secure the service, principally Cloudflare. Where a provider processes personal data outside the European Economic Area, the applicable transfer mechanism for that service is used, such as an adequacy decision or appropriate contractual safeguards where required.

8. Your GDPR rights

Where the GDPR applies and Sikelia Tools holds personal data about you, you may have the right to request access, correction, erasure, restriction and portability, and to object to processing. Where consent is the legal basis, you may withdraw it without affecting processing that was lawful before withdrawal. Because most tool data never leaves your browser and there are no user accounts, Sikelia Tools may not possess server-side data that can be linked back to you.

Send privacy requests to [email protected]. You also have the right to lodge a complaint with theGarante per la protezione dei dati personalior another competent supervisory authority.

9. General-audience service and data minimisation

Sikelia Tools does not require an account or ask visitors to provide an age. Avoid entering unnecessary personal, confidential or sensitive information into general randomisation tools. Private Note is designed for transient encrypted delivery, not as a permanent vault, records system or emergency communication service.

10. Cookies, policy changes and related documents

The current site does not load optional analytics, advertising or profiling scripts and therefore does not display a consent banner merely for local browser state or technically necessary delivery/security mechanisms. If optional tracking is introduced later, it must remain disabled until any legally required consent has been obtained and these notices are updated.

Last updated: 8 September 2026.

See the Cookie & Local Storage Policy,Terms of Use, and thecentral Sikelia Labs Privacy Policy.