~/envtools

Privacy Policy

Last updated: 8 October 2026

TL;DR

Every tool on this site runs in your browser. Your .envcontent is never sent to us, never logged, and never stored on our servers. We only measure how the site is used with Google Analytics if you agree to it, and you can change your mind at any time via .

1. Controller

The controller within the meaning of the GDPR is the operator named under “Contact / Impressum” at the end of this page.

2. Your input in the tools

All parsing, validation, conversion, encryption and secret generation happens locally in your browser. The tools do not transmit what you type or paste, and they do not put it into the page address (URL), so it is also not visible to the analytics services described below. The only exception is the optional breach check described in section 4. Google Analytics and Ahrefs Web Analytics never receive the content of a tool.

3. What we collect ourselves

  • Anonymous page views. Path, referrer, country (if available from the CDN), your browser's user agent string, and a random session ID. The session ID is kept in your browser's session storage (not in a cookie) and disappears when you close the tab. No IP address is stored. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in knowing which pages are used).
  • Tool opens. The slug of the tool you opened (e.g., env-validator) and, in a few cases, a short action label such as “sample”. Not what you pasted into it.
  • Ratings. 1–5 stars keyed by a hashed IP, to prevent duplicate votes. We don't keep the IP itself. Your own rating is remembered in your browser's local storage.
  • Email list. If you sign up for the launch notice, we store your email address, the page you signed up on, your country (if available from the CDN) and your user agent. The sign-up form uses Altcha, a proof-of-work check that runs on our own server, without a third-party captcha provider. Legal basis: your consent, Art. 6(1)(a) GDPR. You can ask us to delete your address at any time.
  • Error reports. If a page crashes, your browser sends a technical report to our server: page path, error message, stack trace and user agent. The tools do not attach your input to it.

4. Breach check (opt-in only)

When you click "Check online" on a detected secret, or use the quick-check widget, here is exactly what happens:

  • For password-type values: Your browser computes a SHA-1 hash of the value. Only the first 5 characters of that hash are sent to our server, which forwards them to the HaveIBeenPwned API (k-anonymity). The complete hash and the original value never leave your browser.
  • For API keys and tokens: Your browser computes a SHA-256 hash. That hash — not the original value — is sent to our server, which checks it against our database of known-leaked secret hashes.

We do not log breach check queries. Breach checking is never automatic — it only happens when you explicitly click "Check online."

5. Audience measurement (Google Analytics and Ahrefs Web Analytics)

Google Analytics 4 (only with your consent)

If you allow the “Analytics” category in the cookie banner, we load Google Analytics 4, a web analytics service of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. It helps us understand which pages are visited and how often. Until you accept, nothing is requested from Google Analytics and no Google Analytics cookie is set.

  • Cookies: _ga and _ga_<ID>, valid for up to 2 years. They hold a random identifier that recognises your browser on repeat visits.
  • Data: pages viewed, approximate location, device, browser, referrer. According to Google, IP addresses are neither logged nor stored in Google Analytics 4. Google Signals and ad personalisation are not enabled. No tool input is ever sent to Google Analytics, and we do not send custom events. Measurement is switched off in the administrator area.
  • Third-country transfer: Data may be transferred to Google LLC in the USA. Google is certified under the EU-US Data Privacy Framework.
  • Legal basis: your consent, Art. 6(1)(a) GDPR and § 25(1) TDDDG.
  • Retention: 14 months.
  • Withdrawal: at any time with effect for the future via . Withdrawing deletes the Google Analytics cookies from your browser and stops measurement. Your choice is stored in two first-party cookies of our consent tool (see “Consent management” below).

Ahrefs Web Analytics

We also use Ahrefs Web Analytics, a service of Ahrefs Pte. Ltd., 16 Raffles Quay, #33-03 Hong Leong Building, Singapore 048581 (i.e. outside the EU/EEA), for anonymous visit statistics. It is cookieless and does not store anything on your device. Visits are told apart by a hash of your IP address and user agent that changes every day; your raw IP address is used only momentarily to determine an approximate location and is not stored. The service honours the Do Not Track and Global Privacy Control signals of your browser. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in anonymous reach statistics). You can object at any time (Art. 21 GDPR) by contacting us or by enabling Do Not Track or Global Privacy Control in your browser.

6. Cookies & advertising

We use Google AdSense (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland) to show ads. The AdSense script is loaded with the page, so your IP address and browser data reach Google when a page opens. By default we set Google's Consent Mode signals for ad storage, ad user data and ad personalisation to “denied”, so until you consent only non-personalized, contextual ads are shown. Your consent for advertising is managed through Google's own consent tool (a Google-certified consent management platform), where it is shown on your first visit. It is separate from our banner: our cookie banner and only control the analytics category (Google Analytics). You can change your advertising choice via that same Google consent prompt or in your Google Ads Settings.

Consent management (Conzent)

The cookie banner is provided by Conzent, an open-source consent management platform that we run ourselves on our own server at consent.aiwebsitedetector.com (Hetzner, Germany). It is not a third-party service. When the page opens, your browser loads the banner script from that server, so your IP address reaches it (legal basis: Art. 6(1)(f) GDPR, our legitimate interest in obtaining and proving valid consent, together with the legal obligation to be able to demonstrate consent, Art. 7(1) GDPR). When you make or change a choice, we store a consent record: a random session ID, the domain, your IP address in shortened or pseudonymised form (not the full address), your country, language, the choice per category and the time. These records are kept for up to 3 years as proof of consent and then deleted. Aggregated daily page-view counts are kept without personal data.

As soon as the banner is shown, the consent tool sets two first-party cookies on your device, before you have made a choice: conzent_id (a random ID that links your later choice to its consent record) and lastRenewedDate (the date from which consent has to be renewed). Both last 12 months. We treat them as strictly necessary for obtaining and proving consent (§ 25(2) no. 2 TDDDG). They contain no information about you and are not used for measurement or advertising. After you choose, the cookies conzentConsent and conzentConsentPrefs (12 months) store the choice itself.

What is stored on your device

  • Technically necessary or requested by you: your theme choice (theme), your language choice (preferred-locale and the cookie NEXT_LOCALE, 1 year), your own ratings (rated_<tool>), your cookie choice and its proof (the consent cookies conzent_id, lastRenewedDate, conzentConsent and conzentConsentPrefs, 12 months), and a session cookie for administrators (admin_session) that regular visitors never receive.
  • Session storage: the random session ID and a per-tool flag for the anonymous statistics in section 3, deleted when you close the tab.
  • Only with your consent: _ga and _ga_<ID> from Google Analytics (up to 2 years).
  • Advertising: cookies set by Google AdSense, depending on your choice in Google's consent tool, including FCCDCF, in which Google's consent message stores that choice.
  • Ahrefs Web Analytics: nothing is stored on your device.

7. What we never collect

  • The content of your .env files.
  • The secrets you generate.
  • Login info — there isn't any login for visitors.

8. Hosting

This site is hosted on servers provided by Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany.

9. Your rights

You have the right to access, rectification, erasure, restriction of processing, data portability and to object (Art. 15–21 GDPR), and to withdraw a consent at any time (Art. 7(3) GDPR). You can also lodge a complaint with a data protection supervisory authority.

Contact / Impressum

Responsible for content: Ailiniyazi Maimaiti
E-Mail: contact@envtools.dev

Questions? Open an issue on the repository.