Privacy Policy

1. Controller identity and contact

Sikelia Tools is a Sikelia Labs service published at tools.sikelialabs.com. This product-specific notice supplements the central Sikelia Labs privacy information. The legally relevant controller identity and contact details required by GDPR Article 13 are maintained in the Sikelia Labs Privacy Policy.

Primary project domain: sikelialabs.com.
Privacy enquiries and data-rights requests: [email protected].
General enquiries: [email protected].
Security reports: [email protected].

2. Data processed by browser-only tools

Most Sikelia Tools run entirely in your browser. Text, names, lists, dice results, generated teams, converted documents and compressed images are not sent to Sikelia Tools servers merely to perform those local operations.

Some tools use browser localStorage to remember convenience settings or bounded local state, such as selected themes, counts, recent results or tool preferences. This information stays in the browser profile on your device and can be removed by clearing the site's local data. Content-bearing Converter and Image Compressor workflows do not upload their input to Sikelia Tools.

3. Private Note

Private Note is the deliberate server-backed exception. Your browser generates a fresh random 256-bit key and encrypts the note with AES-GCM-256 before upload. For an ordinary note, the decryption key is carried only in the share link's URL fragment; browsers do not send that fragment in HTTP requests. The service stores encrypted ciphertext, an opaque note identifier and timestamps required for expiry and one-time consumption.

If you optionally enable password protection, the password is not sent to or stored by the server. In the browser, PBKDF2-HMAC-SHA-256 with a fresh random salt and 600,000 iterations derives a key that AES-GCM-wraps the independently random note key. The URL fragment contains the salt and wrapped-key material, not the password. A wrong password is rejected locally before the one-time note is fetched, so an incorrect password attempt does not consume the stored note. There is no password recovery. A weak password can still be guessed offline by someone who obtains the protected link, so use a long, unique passphrase and share it separately.

Notes are limited to 8 KiB of UTF-8 plaintext. You choose a lifetime between 60 seconds and 7 days. A successful consume deletes the stored note; an expired, already-consumed or unknown note is treated in the same uniform way. The service also necessarily observes limited connection metadata, including an IP address, for network delivery, abuse prevention and bounded rate limiting. Private Note is encrypted-content storage, not a zero-metadata service.

Never use Private Note as the only copy of information you must retain: a lost link, forgotten password, consumed note or expired note is intentionally unrecoverable.

4. Infrastructure and security data

The public site and server-backed Private Note components use Cloudflare infrastructure. Cloudflare may process technical connection information needed to deliver and protect requests, such as IP address, request time, protocol/security information and abuse signals. This infrastructure processing is separate from Cloudflare Web Analytics/RUM.

Cloudflare Web Analytics (Real User Measurements, or RUM) is enabled on public Sikelia Tools pages, including for visitors in the European Union. The beacon is not loaded on Private Note routes. Cloudflare documents that Web Analytics does not use cookies or localStorage for these metrics, does not fingerprint individual visitors, does not log URL query strings, and does not collect or use visitors' personal data.

Google Analytics 4 and Cloudflare Zaraz tool-usage counters are optional. Both are disabled until you give renewed, explicit analytics consent using the Sikelia Tools banner. The counters use fixed event names identifying only a public tool opening or completed action, with no entered text, generated results, location, visitor ID, or fingerprint supplied by Sikelia Tools. Cloudflare may process technical network metadata to receive an event. These optional counters are separate from Cloudflare Web Analytics/RUM. No advertising pixels, remarketing or profiling are enabled.

5. Purposes and legal bases

• Provide a requested tool or Private Note operation: processing needed to provide the service you actively request (GDPR Article 6(1)(b), where applicable).
• Security, rate limiting and service integrity: limited technical processing based on legitimate interests in protecting users and infrastructure (Article 6(1)(f)).
• Optional GA4 and tool-usage counters: Google Analytics 4 and Cloudflare Zaraz named tool-action events are used only after your explicit analytics choice (Article 6(1)(a), consent). You can withdraw consent at any time from Cookie preferences.
• Cloudflare Web Analytics/RUM: this privacy-first aggregate measurement is enabled on public pages, including for EU visitors, and is operated separately from the Google Analytics consent choice. Cloudflare states that Web Analytics does not collect or use visitors' personal data. To the extent applicable law treats related technical processing as personal-data processing, Sikelia Tools relies on legitimate interests in aggregate service measurement and performance (Article 6(1)(f)), subject to applicable requirements.
• Legal obligations: information may be processed where necessary to comply with an applicable legal obligation (Article 6(1)(c)).

Sikelia Tools does not use the data described here for advertising profiles or solely automated decisions that produce legal or similarly significant effects.

6. Retention

• Local tool state remains on your device until you clear it or the tool replaces it.
• Private Note ciphertext is kept only until first successful consumption or the chosen expiry, never longer than 7 days by design.
• Private Note rate-limit state is bounded to the applicable fixed security window.
• Optional Private Note passwords and decrypted note keys are not stored server-side.
• Cloudflare Web Analytics metrics follow Cloudflare's Web Analytics service retention controls and are not stored in Sikelia Tools localStorage.
• Infrastructure/security logs, where generated by hosting or network providers, follow the relevant provider and operational retention controls.

7. Recipients and international transfers

Personal data is not sold. Technical data may be processed by infrastructure providers necessary to host, deliver and secure the service, principally Cloudflare. If you accept analytics, Google also receives the limited analytics data generated by Google Analytics 4. Where a provider processes personal data outside the European Economic Area, the applicable transfer mechanism for that service is used, such as an adequacy decision or appropriate contractual safeguards where required.

8. Your GDPR rights

Where the GDPR applies and Sikelia Tools holds personal data about you, you may have the right to request access, correction, erasure, restriction and portability, and to object to processing. Where consent is the legal basis, you may withdraw it without affecting processing that was lawful before withdrawal. Because most tool data never leaves your browser and there are no user accounts, Sikelia Tools may not possess server-side data that can be linked back to you.

Send privacy requests to [email protected]. You also have the right to lodge a complaint with the Garante per la protezione dei dati personali or another competent supervisory authority.

9. General-audience service and data minimisation

Sikelia Tools does not require an account or ask visitors to provide an age. Avoid entering unnecessary personal, confidential or sensitive information into general randomisation tools. Private Note is designed for transient encrypted delivery, not as a permanent vault, records system or emergency communication service.

10. Cookies, policy changes and related documents

The site displays a renewed analytics consent dialog when no current choice has been stored. Choosing Accept analytics enables optional GA4 and Cloudflare Zaraz tool-usage counters; choosing Necessary only keeps both off. The counts are based on predefined tool/action events and not on user identities or tool content. You can reopen Cookie preferences from the footer and withdraw consent at any time. Cloudflare Web Analytics/RUM is enabled separately on public pages, including for EU visitors, and is not controlled by the banner. Private Note routes do not load the Web Analytics beacon.

Last updated: 9 October 2026.

See the Cookie & Local Storage Policy, Terms of Use, and the central Sikelia Labs Privacy Policy.