Privacy Architecture for Online Tools

“Runs in a browser” and “stays on your device” are not the same claim. This audit separates local transformations, server APIs, infrastructure telemetry, and advertising so users can decide what data is appropriate for each tool.

1. The Problem with Cloud-Only Tools

Many online tools require you to upload your files or text to a server. This creates several risks:

• Data Persistence: How long is your data stored on their disks?
• Third-Party Access: Who else has access to those servers?
• Privacy Policy Loopholes: Is your "anonymous" data being used to train AI models?

2. The Solution: Local Browser Processing

The Base64 Converter uses browser encoding APIs and the JSON Formatter uses JSON.parse/JSON.stringify. Image compression, coordinate conversion, and standard Tesseract OCR also process the selected input in browser code. These actions do not post the payload to a SonicToolLab API.

This approach offers:

• No payload upload: The transformation starts after the page code and any required model assets have loaded.
• Reduced Exposure: Keeping input in the browser avoids creating an additional server-side copy, although users should still keep their browser and device secure.
• Clearer failure boundary: a transformation can still fail because of browser memory, file limits, or unsupported formats; local does not mean unlimited.

3. Transparency in AI Usage

When AI is required (for example, Regex explanation or AI OCR), the tool is labeled accordingly. The submitted text or image is sent over HTTPS through our server to the configured AI provider, whose processing and retention terms also apply. Do not submit secrets or regulated data to an AI mode.

4. A Data-Flow Checklist

1. Check whether the action is marked local or AI before adding real input.
2. Open browser DevTools Network and run a harmless sample; local transforms should not upload that payload.
3. Remove API keys, access tokens, customer records, and document metadata even when using a local tool.
4. Remember that hosting, security, and ad providers may receive ordinary request data such as IP address and user agent when a page loads.
5. Use the Google consent message to manage advertising choices where it applies; ads are restricted to article and selected content-rich tool pages.

Conclusion

Privacy shouldn't be a premium feature; it should be the default. By choosing local-first tools, you protect your intellectual property and personal data without sacrificing efficiency.