Privacy
Privacy is described per tool.
73 current tools process input inside the browser. KitLumi does not receive, store, or log text, images, PDFs, or generated output entered into those Local Only tools. IP Lookup is the one API-backed exception.
Tool input
Local Only tools do not send pasted text, selected files, or generated output to a KitLumi processing server. Input is not added to the URL. The JSON Formatter writes a draft to browser local storage only after the user explicitly enables Remember draft; disabling that option removes the saved draft. Other workspaces clear when the tab is closed or refreshed.
Local preferences
Image OCR may cache only its public language models in IndexedDB to avoid repeated downloads. Its images and recognized text are not saved. Use Clear OCR models cache in that workspace to remove its model entries; unavailable browser storage falls back to temporary loading.
The light or dark theme preference is stored in the browser’s local storage under kitlumi-theme. It contains only the selected theme name. A legacy toolbox-theme preference may be read once so existing visitors keep their chosen theme.
Clipboard and downloads
Clipboard access occurs only after the user selects Paste or Copy, and the browser may ask for permission. Downloads are generated in the browser. Some tools create a temporary blob: URL scoped to the current page; the tool revokes it after a direct download or when replacing output where practical, and the browser discards any remaining URL when the page closes.
Analytics and advertising
KitLumi has no advertising code. Optional usage measurement is disabled by default and, when configured, requires a visitor to select Share tool usage counts in the footer. Only tool ID, interface language, event type, coarse duration bucket, and a fixed error code are submitted to our same-origin endpoint and Cloudflare Analytics Engine. We do not include tool input, output, filenames, IP lookup values, page queries, or persistent visitor identifiers in these events. Hosting providers may separately process network metadata under their own policies. Unchecking the preference stops future events; browser Do Not Track and Global Privacy Control also disable collection.
Cloudflare Web Analytics
KitLumi uses Cloudflare Web Analytics to automatically measure page visits, referring sites, browser and device categories, and page performance. It does not use analytics cookies, local-storage visitor identifiers, or fingerprinting. Visitors do not need to select a checkbox. We do not send tool input, output, or filenames as analytics events. The previous Google Analytics integration is no longer loaded; its old consent preference and host-only analytics cookies are removed when a page loads. These aggregate statistics are separate from the optional tool-usage measurement described above. Browser blockers and network conditions may prevent measurements.
IP Lookup
IP Lookup makes a request only after the user selects Look up IP. Loading its sample fills the field but does not send a request. The browser first contacts ipquery.io (opens in a new tab) with the requested IP address, when supplied; the network request necessarily exposes the connection IP as well. Only a network error, HTTP 429 rate limit, or HTTP 5xx server error causes the same lookup to be sent to ipwho.is (opens in a new tab). Invalid input and other client errors do not trigger that fallback.
KitLumi does not proxy, store, or log provider requests or responses. Each contacted provider applies its own logging and retention policy; review the primary service information above and the ipwho.is privacy policy (opens in a new tab). Location and network fields are approximate, and this free two-provider workflow has no availability SLA.
Other API-backed tools
If another tool later needs an external API, it will be labeled API-backed next to its title. Its page will identify the data sent, the provider involved, and why the request is required.
Effective: