Privacy Policy & Terms of Use

The short version

This section is a summary written for people rather than lawyers. It is not a substitute for the rest of the document, but nothing below contradicts it.

The tools do not upload anything. Every tool on this site runs inside your own browser. Photos, files, text, passwords and recordings you put into a tool are processed on your device and are never transmitted to us or to anyone else. There is no server that could receive them.
There are no accounts. We do not ask for your name, email address or any other identifying detail, and there is nowhere to enter one.
We use Google Analytics to count visits. It records which pages are opened, roughly where in the world from, and on what kind of device. It does not see anything you type into a tool. There are no session recordings, no heatmaps and no fingerprinting.
We show ads through Google AdSense. Along with Analytics this is the only third-party code on the site, and it does set cookies and collect data about your visit. Both are described in full below, along with how to opt out.
Some settings are saved on your device — your light or dark theme choice, your recently used emoji, your saved time zones — using browser storage that we cannot read remotely.
The tools come with no guarantees. They are free utilities, not professional advice. Do not rely on them for anything where being wrong would matter.

Who we are

Pikkit (“we”, “us”, “our”) operates the website at pikkit.net and the free browser-based tools published on it. For the purposes of the UK and EU General Data Protection Regulation, Pikkit is the data controller for the limited personal data described in this policy.

This policy applies to pikkit.net and all of its subpages. It does not apply to any other website, including sites you reach by following a link from here.

You can contact us about anything in this policy at privacy@pikkit.net.

What we collect, and what we don't

It is easier to start with what does not happen, because it is unusual and because it is the whole point of the site.

What the tools never do

Every tool on this site is written in JavaScript that runs on your own computer or phone. When you open an image in the image cropper, encrypt a document with the file encryptor, check a password in the password strength checker, or record your voice with the voice recorder, the data stays in your browser's memory for as long as the page is open and is discarded when you close the tab.

Specifically, we do not:

upload, receive, store, read, index or back up any file, image, video, audio recording, document or archive you open in a tool;
upload, receive, store or log any text, password, passphrase, encryption key or personal information you type into a tool;
send the contents of a tool to any third party, advertiser or artificial intelligence service;
require, request or accept an account, email address, telephone number or payment detail;
operate any contact form, comment system, newsletter or login;
record your screen or your session, build heatmaps of what you click, or attempt to fingerprint your device;
send anything you type into a tool to our analytics or to our advertising partner -- measurement sees the address of the page you opened, never its contents;
sell personal information, in the ordinary sense of that phrase (see the California notice for the broader statutory meaning as it applies to advertising).

You can verify the first point yourself: load any tool page, disconnect from the internet, and the tool will keep working. A page that was quietly uploading your files could not.

What we do collect

Three narrow categories, each covered in its own section below:

settings you choose, saved in your own browser and readable only by your own browser;
standard technical request data recorded by our hosting provider, in the way that every web server on the internet records it;
page-visit measurement collected through Google Analytics;
advertising data collected by Google, as our advertising partner.

What is stored on your device

The site uses your browser's local storage to remember a handful of preferences between visits. Local storage is not a cookie: it is never transmitted to a server, is not attached to network requests, and cannot be read by us or by any other website. Everything the site stores is namespaced under the prefix pikkit:.

What is saved depends on which tools you use, and covers only settings — never the content you put into a tool. The full list is:

Appearance — whether you chose the light or dark theme.
Emoji — the emoji you have recently copied, and your preferred skin tone, so the ones you use stay to hand.
Clocks and time zones — the time zones you added, and whether you prefer a 12- or 24-hour display.
Timers — a countdown you set, alarm times, Pomodoro lengths and completed-session counts.
Counters — tally counts and scoreboard values, so a running total survives a page reload.
Screen ruler — your calibrated pixels-per-inch figure and preferred unit.

You can delete all of it at any time by clearing site data for pikkit.net in your browser settings, which is normally found under Privacy, Cookies, or Site settings. Clearing it removes your preferences and nothing else; the tools carry on working with their defaults.

What our host records

The site is hosted by Vercel Inc. Like every web host, Vercel's servers record standard technical information about each request in order to deliver the page, keep the service running and protect it from abuse. This typically includes your IP address, the page requested, the date and time, your browser's user-agent string, the referring page if any, and basic response data.

We do not use these logs to build a profile of you, do not combine them with any other data, and do not attempt to identify individual visitors from them. Under UK and EU data protection law an IP address can be personal data, which is why it is disclosed here. Vercel processes this information on our behalf as a processor and retains it for a limited period under its own retention schedule. Vercel's privacy notice is published at vercel.com/legal/privacy-policy.

Advertising and Google AdSense

This site is funded by advertising served through Google AdSense. Together with Google Analytics, described in the next section, this is the only third-party code running on these pages. We want to be direct about it, because the rest of the site collects so little.

The disclosures required of AdSense publishers, in full:

Third-party vendors, including Google, use cookies to serve ads based on your prior visits to this website or other websites.
Google's use of advertising cookies enables it and its partners to serve ads to you based on your visit to this site and/or other sites on the internet.
You may opt out of personalised advertising by visiting Google Ads Settings.
Alternatively, you can opt out of a third-party vendor's use of cookies for personalised advertising at aboutads.info/choices, or, in Europe, at youronlinechoices.eu.
Where we have not enabled personalised advertising, or where you have opted out, Google may still serve non-personalised ads. Non-personalised ads still use a limited amount of information — broadly, the content of the page and coarse location — for frequency capping, aggregated reporting and fraud prevention.

In serving these ads Google may collect or receive information including your IP address, device and browser information, the pages you view on this site, and identifiers stored in cookies or similar technologies. This processing is carried out by Google as an independent controller under its own privacy policy, which is published at policies.google.com/privacy. A description of how Google uses information from sites that use its services is at policies.google.com/technologies/partner-sites.

If you are in the European Economic Area, the United Kingdom or Switzerland, you should be presented with a consent message before personalised advertising cookies are set, and you can change or withdraw your choice at any time through that message. We do not control the content of Google's advertisements, and an advertisement appearing here is not an endorsement.

Google Analytics

We use Google Analytics 4 to understand how many people use the site and which tools they use. This is ordinary audience measurement: it tells us that the password strength checker had more visitors than the barcode generator last week, so we know what is worth improving.

What it records

the address of each page you open on this site, and when;
an approximate location derived from your IP address — typically city level, and in some regions only country level;
device and browser information: screen size, operating system, browser, language;
how you arrived — a search engine, a link from another site, or directly;
a randomly generated identifier stored in a cookie, so that two page views in the same visit are counted as one visit rather than two people.

What it does not record

This is the part worth being precise about, because the tools on this site handle sensitive material. Google Analytics receives the address of the page you opened. It does not receive anything you put into a tool. It never sees the text you paste, the passwords you generate or test, the files or photographs you open, the contents of an archive, or any recording you make. Those never leave your browser at all, so there is nothing for analytics to collect.

We have not enabled Google Signals, we do not use Analytics for advertising remarketing, and we do not upload any customer data to it. We have no way to identify you personally from it, and we do not try to.

How to opt out

Install Google's official Analytics opt-out browser add-on, which blocks it on every site.
Turn on Do Not Track or Global Privacy Control in your browser, or block third-party scripts with a content blocker.
Block cookies for this site in your browser settings.

Opting out does not affect any tool on this site. Every one of them works with analytics and advertising blocked entirely.

Cookies and how to control them

We set no cookies of our own. Your saved preferences use local storage, which is a different mechanism and is never transmitted anywhere.

Every cookie on this site is set by Google, and there are two kinds:

Analytics cookies, named _ga and _ga_<id>. These are first-party cookies — stored under this site's own domain — holding a random identifier and a session timestamp. They expire after two years unless you clear them sooner.
Advertising cookies, set by Google's ad services to serve and measure ads and to detect fraud and invalid traffic.

You can control them in several ways, which stack:

through the consent message, if one is shown to you;
through Google Ads Settings, which turns off ad personalisation across Google's network;
through the Google Analytics opt-out add-on, for measurement specifically;
through your browser's own cookie settings, which can block third-party cookies entirely;
through a content blocker or a privacy-focused browser.

Blocking these cookies does not stop the tools working. Every tool on this site functions with all cookies and all scripts from other domains blocked, because none of them depend on it.

Camera, microphone and screen access

A few tools need access to hardware: the voice recorder uses your microphone, the webcam recorder uses your camera and microphone, and the screen recorder captures a screen or window you choose.

These tools use standard browser APIs that cannot run without your explicit, per-visit permission, granted through a prompt shown by your browser rather than by us. Once granted:

the audio, video or screen capture is processed entirely on your device;
nothing is streamed, uploaded or transmitted to us or anyone else;
the recording exists only in your browser's memory until you download it, and is discarded when you close or reload the page;
we do not receive any indication that you granted permission, or that a recording was made.

You can revoke access at any time in your browser's site permissions, and the recording stops the moment you close the tab.

Legal bases for processing

Where the UK GDPR or EU GDPR applies, we rely on the following legal bases:

Legitimate interests (Article 6(1)(f)) for the technical request data recorded by our host, which is necessary to deliver the site, keep it available and protect it against abuse. We consider this a limited and expected use that does not override your rights.
Consent (Article 6(1)(a)) for analytics cookies and for advertising cookies and personalised advertising, obtained through the consent message where required, and withdrawable at any time.
Consent for access to your camera, microphone or screen, given through your browser's permission prompt.

Preferences stored in your own browser are not processed by us at all, since we never receive them.

Your privacy rights

Depending on where you live, you may have some or all of the following rights: to access the personal data we hold about you; to have it corrected; to have it erased; to restrict or object to how it is processed; to receive it in a portable format; to withdraw consent at any time without affecting processing already carried out; and to complain to a data protection authority.

An honest note on what these rights mean here. Because we operate no accounts and no database, we hold almost nothing about you and, in the ordinary case, have no way to connect a request to any particular record. Requests that concern advertising data are usually best directed to Google, which holds advertising and analytics data as its own controller, through your Google Account or the privacy tools linked above. We will help where we can, and will tell you plainly when the data you are asking about is not something we have.

To make a request, email privacy@pikkit.net. We aim to respond within 30 days. We do not charge for this, and we will not ask you for more identifying information than is necessary to answer.

If you are in the UK you may complain to the Information Commissioner's Office at ico.org.uk. If you are in the EEA you may complain to your national supervisory authority.

Notice for California residents

Under the California Consumer Privacy Act as amended by the California Privacy Rights Act, California residents have the right to know what personal information is collected and how it is used, to request its deletion or correction, to opt out of the sale or sharing of personal information, to limit the use of sensitive personal information, and not to be discriminated against for exercising any of these rights.

We do not sell personal information for money. However, the CCPA defines “sharing” broadly enough that the use of advertising cookies for cross-context behavioural advertising may fall within it. To opt out, use Google Ads Settings, block third-party cookies in your browser, or send a Global Privacy Control signal, which we and our advertising partner treat as a valid opt-out request.

The categories of personal information involved are identifiers (such as an IP address and the cookie identifiers used by analytics and advertising), internet activity information (such as pages viewed and how you arrived), and coarse geolocation inferred from your IP address. We collect no sensitive personal information, and we do not knowingly collect personal information from anyone under 16.

Residents of Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana and other states with comparable legislation have broadly equivalent rights and may exercise them in the same way.

Children's privacy

This site is a general-audience site and is not directed at children. We do not knowingly collect personal information from children under 13, or under 16 where local law sets that higher threshold, and there is no mechanism on the site through which a child could submit personal information to us.

If you believe a child has provided personal information in connection with this site, contact us at privacy@pikkit.net and we will take appropriate steps.

How long anything is kept

Content you put into a tool — held only in your browser's memory while the page is open, then discarded. We never hold it at any point.
Preferences in local storage — kept on your device until you clear your browser's site data. We never receive them, so we cannot delete them for you, and clearing them is entirely within your control.
Server request logs — retained by our hosting provider for a limited period under its own schedule, then deleted.
Analytics data — retained by Google Analytics on a rolling schedule set in the property, after which event-level data is deleted; aggregate reports persist. The _ga cookie on your device expires after two years.
Advertising data — retained by Google under its own retention policies, which are described in Google's privacy policy.

International transfers

The site is served from a global content delivery network, and our hosting, analytics and advertising providers are established in the United States. Using the site therefore involves your request data being processed outside your own country, including in the United States.

Where personal data is transferred out of the UK or EEA, our providers rely on recognised transfer mechanisms, which include the European Commission's Standard Contractual Clauses, the UK International Data Transfer Addendum, and the EU-US and UK-US Data Privacy Framework where applicable.

Security

The site is served over HTTPS, so traffic between your browser and the server is encrypted in transit. Security headers are set to reduce the risk of common attacks, and the site loads no third-party code other than Google's advertising and analytics scripts.

The strongest security property here is structural rather than procedural: we cannot lose your files in a breach because we never hold them. There is no database of user content to steal.

That said, no method of transmission over the internet and no method of electronic storage is completely secure, and we cannot guarantee absolute security. Where a tool produces something sensitive — an encrypted archive, a generated password, a recording — you are responsible for storing it safely afterwards. In particular, a password or key used with an encryption tool exists only on your device: if you lose it, the data cannot be recovered by us or by anyone else, because we never had it.

Links to other sites

This site links to external websites, and advertisements shown here link to sites we do not control. We are not responsible for the content, privacy practices or accuracy of any external site, and this policy does not apply once you leave pikkit.net. We suggest reading the privacy policy of any site you visit.

Changes to this policy

We may update this policy to reflect changes to the site, to the services it uses, or to the law. The current version always appears on this page, and the effective date at the top changes when it does. Material changes will be reflected here before they take effect wherever practical. Continuing to use the site after a change means you accept the revised policy, so it is worth glancing at the date from time to time.

No professional advice

The tools on this site are free utilities provided for general information and convenience. Nothing on this site is professional advice, and no professional relationship is created by using it. In particular:

The financial and pricing tools — including the VAT calculator, the discount calculator, the tip calculator and the percentage calculator — are arithmetic aids. They are not tax, accounting, financial or legal advice. Tax rates change, vary by category and vary by jurisdiction, and the rates included are standard rates provided for convenience only. Verify any figure with a qualified professional or the relevant tax authority before relying on it.
The health-related tools — including the BMI calculator — are not medical advice, diagnosis or treatment, and are not a substitute for consulting a qualified healthcare professional. BMI in particular is a crude population-level measure that says nothing reliable about an individual. Never disregard professional medical advice, or delay seeking it, because of something you read or calculated here.
The document and identity tools — including the passport photo maker and the photo print sheet — handle geometry only. They cannot and do not certify that a photograph will be accepted by any passport office, visa authority, licensing body or other institution. Requirements differ by country and document, change without notice, and cover matters no software can assess. Check the issuing authority's own specification.
The security tools — including the password strength checker, the password generator and the file encryptor — are provided without any warranty as to the security they afford. A strength estimate is an estimate, not a guarantee that a password cannot be broken.
The barcode generator produces a graphical encoding of the value you type. It confers no right to use any particular number. Retail product codes must be based on a company prefix licensed from GS1, and using a number you are not entitled to may infringe the rights of others.

Accuracy, availability and “as is”

We take care to make the tools correct, and we test them against known values. Even so, the site and everything on it are provided “as is” and “as available”, without warranties of any kind, whether express, implied or statutory. To the fullest extent permitted by law, we disclaim all such warranties, including the implied warranties of merchantability, fitness for a particular purpose, title, accuracy and non-infringement.

Without limiting that, we do not warrant that the site will be available, uninterrupted, timely, secure or error-free; that results obtained from any tool will be accurate, complete, current or reliable; that any defect will be corrected; or that the site is free of harmful components. Content may be out of date, and we are under no obligation to update it.

You should independently verify any output that matters before relying on it, and you should keep your own copy of any file you value before processing it. We may change, suspend, restrict or withdraw the site or any tool at any time, without notice and without liability.

Your responsibilities

By using the site you agree that:

you are responsible for the content you process with the tools, and you have the right to process it — including any necessary rights, permissions or consents from other people who appear in, own or are identifiable from it;
you will not use the site for any unlawful purpose, or to create, process or distribute material that is unlawful, infringing, defamatory, fraudulent or harmful;
you will not use the site to impersonate any person or organisation, or to create a document, code or identifier you are not entitled to create;
you will not attempt to interfere with, disrupt, overload, probe or gain unauthorised access to the site or its infrastructure, and will not use automated means to access it in a way that imposes an unreasonable load;
you will not remove, obscure, block or interfere with advertising, security features or attribution, or attempt to circumvent any technical limitation;
you are responsible for keeping your own backups, and for the safekeeping of anything a tool produces, including passwords and encryption keys;
you will comply with all laws applicable to you, including data protection law, if you process other people's personal data using these tools.

Limitation of liability

To the fullest extent permitted by applicable law, in no event will Pikkit, or anyone involved in creating, producing or delivering this site, be liable for any indirect, incidental, special, consequential, exemplary or punitive damages, or for any loss of profits, revenue, goodwill, data, files, business or anticipated savings, arising out of or in connection with your use of, or inability to use, this site or any tool on it — whether the claim is based in contract, tort (including negligence), strict liability, statute or any other legal theory, and whether or not we have been advised of the possibility of such damages.

To the fullest extent permitted by applicable law, our total aggregate liability for all claims relating to the site is limited to the greater of the amount you paid us to use it — which is nothing — or ten units of your local currency.

Nothing in this policy excludes or limits our liability for death or personal injury caused by negligence, for fraud or fraudulent misrepresentation, or for any other liability that cannot lawfully be excluded or limited. Some jurisdictions do not allow the exclusion of implied warranties or the limitation of liability for certain damages, so some of the above may not apply to you; in that case our liability is limited to the smallest extent permitted by law. These limitations apply even if a limited remedy is found to have failed of its essential purpose, and survive any termination of your use of the site.

Intellectual property

The name Pikkit, the design of the site and the code behind the tools are owned by Pikkit and protected by copyright and other laws, except for third-party material used under licence. Emoji names and groupings derive from the Unicode Character Database, published by the Unicode Consortium under the Unicode licence.

You may use the tools freely for personal and commercial purposes, and anything you produce with them is yours: we claim no rights over your output. You may not copy, republish, resell or redistribute the site itself, or a substantial part of it, or present it as your own, without our permission.

Indemnity

You agree to indemnify and hold harmless Pikkit and anyone involved in operating this site from any claim, demand, loss, liability, cost or expense, including reasonable legal fees, arising out of your breach of these terms, your misuse of the site, your infringement of anyone else's rights, or content you process using the tools.

Governing law and general terms

This policy and your use of the site are governed by the laws of the country in which the operator of this site is resident, and any dispute arising out of or in connection with your use of the site is subject to the exclusive jurisdiction of the courts of that country. If you are a consumer, this does not deprive you of the protection of the mandatory laws of your own country of residence.

If any provision of this policy is found to be unenforceable, that provision will be limited or severed to the minimum extent necessary and the remaining provisions will stay in full force. Our failure to enforce any provision is not a waiver of it. This policy, together with anything expressly referenced in it, is the entire agreement between you and us regarding your use of the site.

Contact

Questions about this policy, requests about your data, and anything else: privacy@pikkit.net.

If you have found something on this site that is factually wrong, we would genuinely like to know — the tools are tested, but nothing is perfect, and a correction helps everyone who uses them next.

Privacy policy and terms of use