Privacy & Security Policy
Last updated: October 29, 2026. TabKit Tools is engineered from the ground up to protect your privacy through mathematical isolation: your files, data, and passwords never leave your browser.
Zero Server Processing
All computation runs in your local JavaScript runtime using HTML5 Web APIs. We operate no processing servers.
Zero Data Mining
No tracking of your file contents or input payloads. Your calculations and documents stay strictly confidential.
Local Sandbox Storage
Workspace layouts are stored locally in your browser's localStorage. You can export or clear data with a single click.
01. The Local-First Architecture
Unlike conventional online utility websites that transmit your confidential files, spreadsheets, text documents, or passwords to remote cloud servers for conversion or parsing, TabKit Tools executes 100% of its computation client-side.
When you upload an image for compression, a PDF for merging, a JSON payload for formatting, or generate a cryptographically strong password, that data stays in your computer or phone's volatile RAM memory. It is never transmitted across the network.
02. Information We Do Not Collect
To ensure absolute transparency and compliance with global privacy standards (including GDPR, CCPA, and CPRA), we explicitly state what is NEVER collected:
- No Personal Identifiable Information (PII): We do not require account registration, names, email addresses, phone numbers, or credit card numbers.
- No File or Text Content: Any file dropped onto TabKit (PDF, Excel, CSV, image, SQL, markdown) is parsed solely in browser memory via WebAssembly and HTML5 File APIs.
- No Password or Crypto Storage: Passwords and hashes generated with the Web Cryptography API (
window.crypto) exist solely on your screen and are never logged or stored. - No IP or Location Tracking: We do not log IP addresses or request geolocation data.
03. Third-Party Advertising & Google AdSense
To keep TabKit Tools 100% free and continuously maintained without requiring subscriptions or paywalls, we display digital advertisements served by Google AdSense and Google-certified ad networks.
In accordance with Google publisher policies, we provide the following mandatory disclosures regarding advertising cookies:
- Third-Party Vendor Cookies: Third-party vendors, including Google, use cookies (such as the DoubleClick DART cookie) to serve ads based on a user's prior visits to TabKit Tools or other websites on the Internet.
- Personalized Advertising: Google's use of advertising cookies enables it and its partners to serve ads to our visitors based on their visit to our site and/or other sites on the web.
- User Choice & Opt-Out Options: Users may opt out of personalized advertising at any time by visiting Google Ads Settings. You may also opt out of third-party vendor cookies for personalized advertising by visiting AboutAds.info Choices or the European Interactive Digital Advertising Alliance (EDAA).
- Isolation from Tool Data: Google AdSense runs strictly within sandboxed iframes. Advertisers and advertising scripts have zero access to the data, text payloads, tokens, passwords, or files you process inside TabKit's local client-side tools.
04. Browser Storage & Cookies
We utilize standard browser Web Storage (localStorage) strictly for functional user preferences:
- Workspace Decks: Storing which tools you have pinned to your active deck and custom deck names.
- Theme & Layout: Remembering your card width toggles (1 column vs 2 columns) and visual preferences.
You have full control over this data. You can inspect it directly in your browser's Developer Tools, export a complete JSON backup at any time, or click Reset Workspace to wipe it completely.
05. Content Security Policy & External Assets
Our web servers are configured with an industry-grade Content Security Policy (CSP), strict HSTS, and origin isolation headers:
- Strict CSP Directives: Disallows object execution (
object-src 'none'), prevents clickjacking (frame-ancestors 'none'), and restricts script origins. - Open Source Client Libraries: Client-side libraries (such as PDF-lib, SheetJS, and Tailwind CSS) are delivered over secure HTTPS and run locally without calling remote APIs.
- Offline Service Worker: Our Service Worker caches application assets locally so that you can disconnect your Internet connection and use TabKit in complete offline isolation.
06. Contact & Open Audits
Because TabKit Tools is designed for maximum security and transparency, our client-side code is unminified and open for inspection. If you have questions regarding our privacy architecture, please contact us: