Privacy statement

We have no accounts, run no analytics and do not track you across pages or sites. We do not keep a record of what you type, calculate or open. The only lasting information our server keeps is how many times each tool's page was opened per day, with nothing about who opened it, as described below.

Most tools calculate in your browser: typing in their fields sends nothing to us. The exceptions are tools that need our server, and shared links; these and the MCP server are explained below.

HowToolbox (how.box) is responsible for the processing described here (the controller). For anything about privacy, write to contact@how.box

Some tools ask our server for public data, such as reference interest rates or a domain's DNS records, or ask it to check a website you name. Our server handles the request and keeps nothing about you. When it checks a website, that site sees a request from our server, never from you.

So that the original sources are not asked again for every visitor, our server keeps public answers, such as a domain name and its records, for a limited time: from seconds to a few days, depending on the data. It never keeps who asked.

To prevent abuse, our server counts requests for a short time under a code made from your IP address. The code cannot be turned back into the address and changes every day. The counts expire on their own when the limit's time window ends and are never logged. The AI agent access statement lists the limits.

The MCP server receives the inputs an agent sends to calculate an answer. Inputs and results are never logged or kept.

Opening a shared tool link sends its address, including any values in it, to our server, which works out the answer so the page can show it at once. The values are not logged or kept with anything about you. Only share links whose contents you are happy for others to see.

The “What is my IP?” tool shows the address our server sees for your connection, with an approximate location and network. An IP address is personal data. We process it in memory only to answer you; we do not log, store or cache the address or result. The location is an estimate, not your device’s GPS position.

IP geolocation by DB-IP, using the offline DB-IP Lite City and ASN databases under CC BY 4.0. No lookup or visitor address is sent to DB-IP. You cannot enter someone else’s IP address.

Cloudflare delivers this site for us. It provides the secure connection and protects the site against attacks. To do this, it processes every request, including your IP address, the page address with anything in it, and the information your browser sends with it. Cloudflare acts as our processor under its data processing terms and keeps this information only as those terms allow. We receive no request logs from Cloudflare.

Cloudflare adds nothing to our pages: no scripts, no analytics, no cookies and no challenge pages.

A shield label on each tool tells you what happens to what you enter. “Private · runs on your device” means typing in the tool sends nothing to us; opening a shared link is the exception described above. Some of these tools download public data, such as exchange rates, but that request carries nothing you entered.

Tools for passwords and personal details, such as a Wi-Fi password or a name and address, also say “Not saved in the link or anywhere else”. Those fields never appear in the page address or your browser history, and copied links leave them out. Passwords are never put in a link. You can choose to include other personal details in a link you copy, and the tool warns that anyone with the link can see them.

“Server check · no input logs” means the tool sends what you enter, for example the website address to check, to our server. We do not log it. Public check results may be kept for a short time, as described above.

The label comes from what each tool is built to send, and automated tests check that tools marked private send nothing you enter. On pages with ads, Google's ad script also runs on the page; the label describes what we send and keep, not what that script could technically read.

Our own code keeps only the following in your browser: the preferences you choose and the list of tools you opened recently. They exist only for features you use, stay on your device and are never sent to us, except the language choice, which your browser sends with each page request so that we can show the page in your language.

You can remove them at any time by clearing this site's data in your browser settings.

A tool can use your camera, microphone, a MIDI keyboard or your location only after you turn it on, and your browser asks for your permission. Everything stays on your device: we never record or receive the picture, the sound, the notes or your position. “Use my location” asks your browser once for a rough position, rounded to about 1 km, and uses it only in your browser; you can always type a place instead.

Images and files you choose, drop or paste into a tool, and codes read with the camera, are also handled on your device and not uploaded. Printable files and downloads are made on your device too. Ads are removed while a tool is in full screen and while you print.

Browser-information tools read facts your browser makes available, such as its version, screen size, supported features and preferences, to show them to you. These facts stay on your device: they are not sent, stored or logged, and no permission is requested.

A few tools remember their state in your browser so that it survives a reload. It stays on your device and is removed by the tool's Reset button or by clearing this site's data in your browser.

The site is free because of advertising. Ads come from Google (AdSense) and are labelled “Sponsored Links”. They appear on catalog and tool pages, beside or below the tool, never inside it; on phones, Google may also show an ad bar at the bottom of the screen. These information pages, tools made for children and some other pages show no ads and load no ad script.

On pages with ads, Google's consent dialog comes first. It asks only in the European Economic Area, the United Kingdom and Switzerland, where the law requires consent, and allowing and declining are equally easy; elsewhere it does not ask. Google works out the region for advertising; our own-IP tool’s location estimate is not used for ads. No ad is requested before you answer. To change your answer later, use “Privacy and cookie settings” at the bottom of any page with ads.

If you allow it, Google may store and read information on your device, such as the advertising cookies listed below, and may personalize ads according to your choices. The dialog names the companies and purposes involved and lets you choose them one by one. Where consent is not required, Google shows these ads without asking.

If you decline, Google shows ads that are not personalized. Google describes limited ads as ads shown without using personal data for personalization; with them, Google's ad script sets no advertising cookies on this site. Google may still use cookies or local storage only to detect fraud and invalid traffic.

Either way, Google receives each ad request with information such as your IP address, details of your browser and the page address, so that it can deliver the ad. While ads are on, we take your tool settings out of the page address, so Google does not see what you enter. The ads are shown in separate frames that cannot read the page. Google decides how it uses this information as an independent controller, under its own policies.

Cookies Google may set on this site (advertising cookies only with your consent)

Google chooses these names and may change them; its own description is linked in the table below.

Our server keeps short technical logs to keep the site running and secure, for example which page or tool was requested (without the part of the address after “?”), the response status and how long it took. The logs never contain IP addresses, browser details or anything you entered.

For MCP calls, technical logs record the method, catalog tool name, outcome, duration and protocol version. Calls that use our cached reference rates also record the rate action, response status and duration. These logs contain no inputs, results, client details or request identifiers.

To show which tools are popular, our server adds one to a tool's count for the day when it sends you the tool's page. Only the date, the tool and the number are kept: nothing about who opened it and no record of your visit. Previews, prefetches and automated visitors that say they are bots are not counted. Counts are kept for 400 days, and the site shows only the order of the most opened tools, never the numbers.

We process the little personal data described here on these grounds under the EU General Data Protection Regulation (GDPR):

• delivering the site securely and preventing abuse, including your IP address as it passes through Cloudflare and our server: our legitimate interest in running a secure, working site;
• advertising: your consent, given or refused in Google's consent dialog, for storing and reading information on your device and for personalized ads; you can withdraw it at any time. Without consent, our legitimate interest in funding the free site with ads that are not personalized;
• email you send us: our legitimate interest in answering you.

Google and Cloudflare may process data outside the EU, including in the United States. Both are certified under the EU–US Data Privacy Framework and also use the EU's standard contractual clauses.

Anyone can use the tools without giving personal details. Tools made for children show no ads of any kind.

Under the GDPR you can ask for access to your personal data and for its correction or deletion, object to processing based on legitimate interest, and withdraw your consent at any time. Apart from email you send us, we keep no personal data that we could link to you, so for most requests there is nothing for us to find.

For advertising, change your choice at any time with “Privacy and cookie settings” at the bottom of any page with ads; Google's own privacy controls also apply.

If you think we handle your data unlawfully, you can complain to the Office of the Data Protection Ombudsman in Finland (tietosuoja.fi) or to the data protection authority where you live.

Questions about privacy are welcome by email: contact@how.box

If you write to us, we use your email address and message only to reply, and keep them only as long as the matter needs.