Privacy Policy
Last updated: August 30, 2026
This describes what DevKit actually does with the data you give it. It’s written to match the real implementation, not a generic template — different tools handle data differently, and this page says which is which.
Tools that never leave your browser
Most of DevKit — JSON, encoding, generators, JWT, regex, diff, timestamps, hashing, SQL formatting, log analysis, format conversion, and the diagram tools — runs entirely in your browser. What you type or paste into these is never sent to a server, DevKit’s or anyone else’s. Closing the tab is enough to remove it.
Tools that use DevKit’s server
API Client. Cross-origin requests are relayed through DevKit’s server (a same-origin browser restriction, not a DevKit choice). The target URL, method, headers, and body pass through the server only to make that one request and are not logged or stored — on failure, the server logs at most the method and target hostname, never headers, bodies, or full URLs.
Mock API Generator. Mock endpoint definitions you create are held in the server’s memory so they can respond to requests. They are not written to a database and are lost when the server restarts.
Code Share (pastes). A paste’s title, content, language, visibility, and expiration are stored in a database so the link works for others. Ownership (for My Pastes, editing, and deleting) is tracked with an anonymous, random identifier in an httpOnly cookie on your browser — not an account or email address. Only a one-way hash of that identifier is stored, not the cookie value itself.
AI tools
The Error Explainer, Code Explainer, Git Command Generator, SQL Generator, and Regex Generator send the text you submit to Google’s Gemini API to generate a response. This only happens when you click the tool’s generate button, and only if the person running this DevKit instance has configured an API key — otherwise these tools show a setup notice and make no network call. DevKit’s server does not store your prompts or the AI’s responses; they pass through for that one request. Use of these tools is subject to Google’s own terms and privacy practices for the Gemini API, which DevKit does not control.
Cookies
DevKit sets exactly one cookie — the anonymous, httpOnly paste-ownership identifier described above. It is not used for tracking, analytics, or advertising, and nothing else on the site sets a cookie. Your light/dark theme preference is stored in your browser’s local storage, not a cookie.
Local storage
Favorites, recently used tools, API Client request history, saved diagrams, and your theme preference are kept in your browser’s local storage. This data stays on your device, is never transmitted to DevKit, and is cleared whenever you clear your browser’s site data for this site.
Analytics
DevKit does not use any third-party analytics, tracking pixels, or advertising services.
Server logs and IP addresses
To prevent abuse, requests to server-backed tools are rate-limited using a request’s IP-related headers as a temporary, in-memory counter key — this is never written to a log or a database. Operational error logs record generic outcomes (for example, that an AI request failed, or which hostname a proxy request couldn’t reach) and never include request bodies, headers, prompts, or API keys.
Data retention and deletion
- Pastes are kept until you delete them from My Pastes, or until their chosen expiration passes (checked on every read, and also removed automatically in the background). A paste set to “Never” expire is kept until you delete it yourself.
- Mock API definitions live only in server memory and are gone on server restart.
- Everything else described above is local-only and is deleted the moment you clear it from your browser.
Third-party services
Depending on how this instance of DevKit is configured, it may use a MongoDB database (for Code Share) and Google’s Gemini API (for the AI tools). No other third-party service is used.
Security
The API Client’s proxy blocks requests to private/internal network addresses. Routes that change data require a same-origin request and are rate-limited. Server secrets (API keys, database credentials) are kept in environment variables and are never sent to the browser. DevKit does not execute pasted or generated code. This is a description of what’s implemented, not a certification, security audit, or a claim of encryption, GDPR, or CCPA compliance.
Your choices
DevKit has no account system, so there is no profile or email address to manage. You can delete any paste you own from My Pastes at any time, and clear favorites, recent tools, history, and saved diagrams by clearing this site’s data in your browser.
Contact
Questions about this policy can be raised as a GitHub issue.
This page describes how DevKit’s software behaves. It is not legal advice.