Privacy Policy
How Hostt protects your privacy and keeps your data secure
🔒 Your Privacy is Protected
Most text, code, and image tools process their input in your browser. Network, lookup, audit, monitoring, and alert tools send the data needed for the requested operation to Hostt's server-side endpoints or named providers. Tool inputs, uploaded filenames, target URLs, and account identifiers are excluded from analytics.
✅Privacy-first analytics✅No personal data tracking✅No cookies for functionality✅Open source transparency
🛠️ How Our 53 Tools Work
Client-Side Processing (45 Tools)
🔍 Image Magnifier
- • Process images entirely in your browser using HTML5 Canvas
- • Create magnifying glass effects without uploading files
- • Export processed images directly to your device
📄 Diff Checker
- • Compare text files using client-side JavaScript algorithms
- • File contents never leave your browser
- • Real-time highlighting and difference detection
🔄 Text to Markdown
- • Convert rich text and HTML using the Turndown library
- • Paste from Word, web pages, or enter HTML directly
- • All conversion happens in your browser
📊 Word Counter
- • Real-time text analysis with JavaScript
- • Count characters, words, sentences, and paragraphs
- • Calculate reading time estimates locally
🏷️ HTML Tag Checker
- • Validate HTML using client-side parsing
- • Detect unclosed, mismatched, or invalid tags
- • HTML5 compliant validation with line number reporting
🎨 Favicon Generator
- • Generate multi-size favicon packages with adjustable cropping
- • Process images entirely in your browser with security validation
- • Create all 25+ icon sizes for browsers, mobile apps, and PWAs
- • Selected image contents are not uploaded to Hostt
⚡ Image Optimizer
- • Compress and convert images using client-side processing
- • Support for PNG, JPG, GIF, WebP, AVIF, and HEIC formats
- • Advanced compression with quality control and format conversion
- • All processing happens locally - no image uploads
📝 Text Processing Tools (5 Tools)
- • Prefix/Suffix: Add text to line beginnings/ends
- • Remove Duplicates: Clean duplicate lines while preserving original order
- • Remove Empty Lines: Clean blank lines and whitespace
- • Remove Extra Spaces: Format spacing with advanced options
- • Combination Generator: Generate combinations from multiple lists
Server-Side Processing (8 Tools)
🌐 HTTP Viewer
- • Inspect HTTP headers from any URL
- • Server-side processing to bypass browser CORS limitations
- • Headers only - no content download for security
- • Rate limited to 5 requests per minute
- • No request data is logged or stored
🔗 Redirect Detector
- • Track URL redirect chains and analyze paths
- • Server-side requests follow and report redirect steps
- • View status codes, headers, and timing for each step
- • Rate limited and security validated
- • No URLs or redirect data is stored
🔍 DNS Lookup
- • Look up A, AAAA, MX, TXT, CNAME, and NS records
- • Server-side processing for reliable DNS resolution
- • Rate limited to prevent abuse (10 requests per minute)
- • No domain queries are logged or stored
📊 Uptime Monitor
- • Check website availability and response times
- • Server-side checks to bypass CORS restrictions
- • Your site list stored locally in browser
- • Rate limited and security validated
- • No monitoring data stored on servers
🌍 IP Intelligence
- • Get geolocation, ISP, and security threat information
- • Server-side API integration with timeout protection
- • Rate limited to 5 requests per minute
- • API keys redacted from logs for security
- • No IP lookup data is stored
🔧 Tech Detection
- • Identify technologies used by websites (CMS, frameworks, etc.)
- • Server-side browser automation with Puppeteer
- • Strict rate limiting (2 requests per 2 minutes)
- • Network request interception for security
- • No website data or results are stored
🚀 Lighthouse Auditor
- • Run Google PageSpeed Insights audits
- • Server-side Google PageSpeed Insights request
- • Very strict rate limiting (2 requests per 2 minutes)
- • No audit data or URLs are stored
🔔 Alert Manager
- • Scheduled website checks with email alerts
- • Secure user accounts with magic link authentication
- • Server-side storage for alert rules and monitoring data
- • Encrypted data storage with privacy protection
- • Email notifications sent securely via Mailgun
- • No personal data tracking or sharing
Why server-side? These tools need network access that browser security restrictions, DNS APIs, scheduled jobs, or provider credentials do not permit directly from the page.
🚫 What We Don't Do
- ✗Store your files, images, or text content
- ✗Track your browsing behavior
- ✗Collect personal information
- ✗Use invasive cookies
- ✗Share data with third parties
- ✗Require user registration
- ✗Log your tool usage patterns
- ✗Sell or monetize your data
✅ What We Do
- ✓Process most data entirely in your browser
- ✓Use secure, rate-limited APIs when necessary
- ✓Implement strong security headers
- ✓Privacy-oriented Plausible analytics and limited Google Analytics page measurement
- ✓Provide tools completely free of charge
- ✓Maintain transparent, open practices
- ✓Protect against malicious URLs and attacks
- ✓Continuously improve security and privacy
⚙️ Technical Details
Security Measures
- • Content Security Policy (CSP): Prevents XSS attacks and unauthorized script execution
- • HTTPS Everywhere: All connections are encrypted with TLS
- • Advanced Rate Limiting: Distributed rate limiting with IP-based tiers and concurrency controls
- • Input Validation & Sanitization: All user inputs validated, HTML sanitized with DOMPurify
- • SSRF Protection: DNS-over-HTTPS resolution, private IP blocking, request interception
- • CORS Restrictions: Origin-restricted CORS headers, no wildcard access
- • PII Protection: No personally identifiable information logged in production
- • Magic Link Authentication: Secure passwordless authentication for Alert Manager
Data Processing
- • Client-Side: 13 tools process data entirely in your browser using JavaScript
- • Server-Side: 8 tools use secure serverless functions for CORS bypass and API integration
- • No Persistence: Most tools store no data; Alert Manager uses encrypted storage
- • Memory Only: Server processing uses only temporary memory for most operations
- • Immediate Cleanup: All processing data is cleared after response
- • Secure Storage: Alert Manager data encrypted in Vercel KV with user consent
Analytics & Monitoring
We use Plausible Analytics for privacy-oriented aggregate traffic data. We also use Google Analytics 4 to measure canonical page visits and publisher engagement in Beaconhouse.
- • Privacy-First: Plausible is GDPR, CCPA, and PECR compliant
- • Plausible: Plausible does not use tracking cookies or local storage
- • Limited GA4: Advertising signals and advertising-personalization signals are disabled
- • Minimal GA4 Event: Hostt sends only the canonical page path, location, and title; Google may process standard request and device metadata
- • Aggregate Use: We use analytics reporting to understand aggregate page visits and usage patterns
- • Open Source: Plausible's code is fully open source and auditable
- • Canonical Pages Only: GA4 receives the canonical page path, location, and title—never tool inputs, uploaded filenames, target URLs, or account identifiers
What we track: Aggregate page visits, popular tools, and general usage patterns to improve the service.What we don't track: Tool content, uploaded filenames, target URLs, account identifiers, or cross-site advertising profiles.
Questions About Privacy?
We're committed to transparency and protecting your privacy. If you have any questions about how we handle data or our privacy practices, we're here to help.
Last updated: August 22, 2025
Updated to reflect recent security enhancements and new tools