Privacy

This page is written to be checkable rather than reassuring. Anything below can be verified from your own browser in about a minute, and the last section tells you how. Where something does leave your browser, it is named here — a privacy page that claims “no third-party requests” while loading two of them is worse than no privacy page at all.

What Sofritools does not do

• No accounts. There is no sign-up, no login, no email field, and no mailing list.
• No cookies. None — not for sessions, not for preferences, not for advertising. Google Analytics is configured in cookieless mode (analytics_storage: 'denied'), so it reports page views without writing or reading any cookie. That is also why you have never seen a consent banner here: there is nothing to consent to.
• No uploads. Files you drop into a tool are read by your own browser and processed in memory. They are never transmitted anywhere.
• No backend and no database. The site is a set of static files. There is no application server that could receive your input even if the code tried to send it.
• No storage of your content. Tools do not write what you type tolocalStorage, IndexedDB, or anywhere else. Close the tab and it is gone.
• No ads, trackers, pixels, fingerprinting, session recording, heatmaps, A/B testing SDKs, or chat widgets. There is no advertising code on this site at all.

What does leave your browser

Two third parties are contacted. Neither receives your tool input (the text you type, the files you open).

• Cloudflare Web Analytics — static.cloudflareinsights.com. A small beacon script is injected by the host on every page. It reports the page URL, the referrer, and coarse load-performance timings, and Cloudflare derives country, browser and device class from the request itself. It sets no cookies, does no cross-site tracking, and builds no per-visitor profile; what I see is an aggregate count of which pages get visited.
• Google Analytics 4 — www.googletagmanager.com and*.google-analytics.com. A standard GA4 tag loads on every page and reports page views (URL, referrer, screen size, browser, country). It is configured incookieless mode: consent is set to analytics_storage: 'denied'before the tag fires, which tells GA4 not to write or read any cookie and not to use browser storage for a client identifier. Without a client ID, Google cannot distinguish returning visitors from new ones, so the data I see is page-view counts and traffic sources — not user-level behavior. The reason both services exist: Cloudflare shows me real-time performance; GA4 shows me search-query data that Cloudflare does not have.

The two typefaces, Bricolage Grotesque and IBM Plex Mono, used to come from Google Fonts. They are now served from this site’s own origin under /fonts/, so no request goes to fonts.googleapis.com or fonts.gstatic.com any more — which is why font-src in the policy below is 'self'.

One more thing worth stating plainly, since it is true of every website: the site is hosted on Cloudflare, so requests for these pages pass through their network and appear in ordinary edge logs (IP address, URL, timestamp, user agent) the same way they would with any host. That is request metadata, not your data. SeeCloudflare’s privacy policy for what they do with it.

How to check all of this yourself

Do not take my word for it. Three things you can do right now:

1. Open your browser’s developer tools, go to the Network tab, then use any tool on this site with real input. You will see the two hosts above and nothing else. You will not see your input going anywhere, because there is no request carrying it.
2. In the same panel, look at the response headers for the page. The site sends a Content-Security-Policy that your own browser enforces — it is a list of the only places this page is permitted to talk to. A tool that tried to POST your data to some other endpoint would be blocked by the browser, not merely discouraged by me.
3. Turn off your Wi-Fi and keep using the tool. After your first visit the tools keep working offline, which is only possible because the work was never happening on a server.

default-src 'self';
script-src 'self' 'unsafe-inline' https://static.cloudflareinsights.com https://www.googletagmanager.com;
style-src 'self' 'unsafe-inline';
font-src 'self';
img-src 'self' data: https://www.google-analytics.com;
connect-src 'self' https://cloudflareinsights.com https://www.google-analytics.com https://analytics.google.com https://region1.google-analytics.com;
object-src 'none'; base-uri 'none'; form-action 'self';
frame-ancestors 'none'; upgrade-insecure-requests

Offline use and the service worker

The site registers a service worker so the tools work with no connection. It keeps copies of pages, styles, scripts, and icons in your browser’s own Cache Storage, on your device. That cache holds the site’s files, never your input, and nothing in it is sent anywhere. You can wipe it any time by clearing site data for sofritools.com in your browser settings. Pages are always fetched from the network first when you are online, so an update reaches you immediately rather than being masked by a stale copy.

Your data rights, briefly

There is nothing to request, export, or delete, because there is nothing held: no account, no database, no analytics profile tied to you, no email address. If you are evaluating this site for GDPR, CCPA, or an internal review, the useful summary is that Sofritools collects no personal data and processes no user content off-device; the only processing that happens at all is your host-level request metadata at Cloudflare and cookieless page-view counts in Google Analytics.

If any of this changes

Sofritools will eventually carry contextual affiliate links, and high-traffic converter pages may carry ads. If and when that happens, this page changes first and says exactly what was added, what it loads, and from where. Three things are not on the table regardless: uploading your files, tracking cookies, and selling anything about you. If you ever find this page contradicting what the site actually does, treat your browser’s network tab as the source of truth and this page as the bug.