Privacy Architecture for Online Tools

“Runs in a browser” and “stays on your device” are not the same claim. This audit separates local transformations, server APIs, infrastructure telemetry, and advertising so users can decide what data is appropriate for each tool.

1. The Problem with Cloud-Only Tools

Many online tools require you to upload your files or text to a server. This creates several risks:

• Data Persistence: How long is your data stored on their disks?
• Third-Party Access: Who else has access to those servers?
• Privacy Policy Loopholes: Is your "anonymous" data being used to train AI models?

2. The Solution: Local Browser Processing

The Base64 Converter uses browser encoding APIs and the JSON Formatter uses JSON.parse/JSON.stringify. Image compression, coordinate conversion, and standard Tesseract OCR also process the selected input in browser code. These actions do not post the payload to a SonicToolLab API.

This approach offers:

• No payload upload: The transformation starts after the page code and any required model assets have loaded.
• Reduced Exposure: Keeping input in the browser avoids creating an additional server-side copy, although users should still keep their browser and device secure.
• Clearer failure boundary: a transformation can still fail because of browser memory, file limits, or unsupported formats; local does not mean unlimited.

3. Transparency in AI Usage

When AI is required (for example, Regex explanation or AI OCR), the tool is labeled accordingly. The submitted text or image is sent over HTTPS through our server to the configured AI provider, whose processing and retention terms also apply. Do not submit secrets or regulated data to an AI mode.

4. Processing Matrix for This Tool Site

• Local browser: JSON formatting, Base64, coordinate conversion, image compression, and standard OCR transform input on the device.
• Browser network: currency, weather, and IP features request external or server data; the query and ordinary request metadata cross a network boundary. The Location tool reads browser geolocation and handles the coordinates locally on its page.
• Cloud AI: AI-labelled generation, explanation, translation, or editing sends the submitted payload through a SonicToolLab API to the configured model provider.
• Advertising: AdSense is limited by an explicit route allowlist to reviewed articles and selected content-rich tools. Authentication, payment, chat, Builder, hubs, legal pages, noindex pages, and 404s are excluded.

5. A Data-Flow Checklist

1. Check whether the action is marked local or AI before adding real input.
2. Open browser DevTools Network and run a harmless sample; local transforms should not upload that payload.
3. Remove API keys, access tokens, customer records, and document metadata even when using a local tool.
4. Remember that hosting, security, and ad providers may receive ordinary request data such as IP address and user agent when a page loads.
5. Use the Google consent message to manage advertising choices where it applies; ads are restricted to article and selected content-rich tool pages.

Consent configuration is partly an account-side control: the site exposes Google's privacy-options hook and a privacy-policy fallback, while the certified CMP message for the EEA, UK, and Switzerland must be active in AdSense Privacy & messaging. A page-level link cannot substitute for that account configuration.

6. Conclusion

Privacy shouldn't be a premium feature; it should be the default. By choosing local-first tools, you protect your intellectual property and personal data without sacrificing efficiency.