Short version: when you open a tool, your browser downloads the page and its code once. From then on, the work happens on your own computer or phone. The files you open and the text you type aren't uploaded to us or anyone else, apart from the specific cases listed below.
What happens when you use a tool
- Your browser loads the tool's page and scripts from curlybits.com, like any website.
- When you pick a file, the browser reads it into the page's memory on your device. Nothing is sent to a server.
- The tool does the work with JavaScript and WebAssembly running in your browser, using open-source libraries such as SVGO, js-beautify, CSSO, DOMPurify, sql-formatter, js-yaml, marked and fflate. These libraries are served from curlybits.com itself, not loaded from other websites.
- The result is created on your device, and the Download button saves it straight from the browser.
- When you close or reload the page, what you entered is gone. We have no copy.
- Some choices, such as dark mode or your favorite tools, are remembered in your browser's local storage. They stay on your device.
Check it yourself
You don't have to take our word for it:
- Watch the network. In Chrome or Edge, press F12 (on a Mac, Cmd+Option+I), open the Network tab, then use a tool. You'll see the page's own files load, and no request carrying your file or text.
- Go offline. Open a tool, then turn off Wi-Fi or mobile data and use it. It keeps working, because it never needed the internet to do the job. You can also install curlybits as an app, or choose Make every tool work offline at the bottom of any page.
The exceptions, in full
These are the only cases where something other than our own page files goes over the network while you use the site:
- HTML and Markdown previews. If what you paste links to images, stylesheets or fonts on other websites, your browser loads them to draw the preview, as it would on any web page. Your own text isn't sent anywhere. The HTML viewer runs your code in a sandbox.
- Google Analytics counts page views and clicks on the “Was this tool useful?” buttons. It never receives what you type, paste or open in a tool. Details are in the privacy policy.
- Google AdSense. When ads are shown, Google's ad code loads on the page, subject to your cookie choices. Ads can't see what's inside a tool.
- Hosting. curlybits is served through Cloudflare and Hostinger. Like any web host, they see requests for our pages (your IP address, browser and the page asked for), not anything you do inside a tool. Cloudflare Web Analytics also counts visits, without cookies.
If you spot anything else, please tell us and we'll fix it or add it here.
Questions
Is it safe to use for an ID card, passport or bank statement?
The file is processed on your device and isn't uploaded, so we never see it. The usual care still applies: use a device you trust, and remember that browser extensions you've installed can read the pages you visit, on any website.
Do you keep copies of my files?
No. We never receive them, so there's nothing to keep, and nothing we could recover if you lose your result.
Do the tools work without an internet connection?
Yes, once a page has loaded, apart from the exceptions above that need a one-time download.
Is curlybits open source?
Not at the moment. Every script runs in your browser, though, so you can inspect what it does with your browser's developer tools.
How does the site pay for itself?
Through ads, not through your data. There's no paid plan, no sign-up and no limit.
Updated