Privacy Policy

Principles

LittleOne Tools is a browser-based toolbox for general-purpose users, designed for no-login, no-install use. We handle data under the following principles:

• Local-first. Aside from a few explicitly disclosed third-party calls, tool inputs and outputs are not uploaded by our tools.
• Minimal storage. We use localStorage / sessionStorage only when needed, and any storage stays scoped to the browser and device you are using.
• No accounts. The site has no signup, login, or user accounts; we have no way to identify you.
• Analytics runs only after consent. This GA4 pilot loads Google Analytics 4 only after you opt in to analytics; reject/default paths do not send analytics requests to Google. The site still does not enable Google Ads, AdSense, or any commercial CMP.

Local data inventory (localStorage / sessionStorage)

The items below are the local-storage entries actually used by the current code. These local-storage values are kept in browser storage and are not uploaded by our tools. Clearing site data in your browser removes all of them at once.

Site-wide (applies to every page)

• theme — Stores your light/dark theme preference. Holds only the string "light" or "dark".
• visit_history — Tracks the tools you have recently opened so the homepage "Recently Used" list can show them. Capped at 50 entries; each entry contains only the tool ID, timestamp, category ID, emoji, and tool name. It does not contain anything you typed into a tool.
• littleone:consent — When analytics or ads switches are enabled, stores your consent version, timestamp, and analytics / ads preferences. It is not written while those switches are disabled; when enabled, it stores only your choice, not tool inputs.

Per-tool (only written while using that tool)

Some tools persist a small amount of local state to improve usability. These entries are only read and written by the tool that owns them, and fall into four categories:

• Preferences — Options you have chosen inside a tool (e.g. the display style in the lunar-calendar converter, whether the orientation hint is dismissed in the e-signature tool, the voice setting in the countdown timer).
• History and results — Tools such as the reaction-time test, statistics calculator, random picker, lunar-calendar converter, and text-to-image generator save history or results when you trigger them. The reaction-time history auto-expires after 90 days.
• Favorites / saved lists — The emoji reference and special-symbols reference store the items you mark as favorites; the random picker stores the lists you build.
• Optional saved self-test results — The color-blindness self-test saves birth year, color-vision type, and entries only after you opt in via "Save this result locally". Data is written only to your device's localStorage and can be cleared at any time.

Session-only (cleared when you close the tab)

• qr-scan-history — The QR-scanner keeps scan results within the current session so you can reuse them while the tab is open. They are cleared automatically when you close the tab or browser.

Storage types we do not use

Our own current code does not use any of: cookies, IndexedDB, Service Worker, Cache API, or Web SQL. If you opt in to GA4, Google Analytics may use its own browser storage for basic visit measurement; ads remain disabled. If we later introduce a tool or an ad script that needs heavier storage, this section will be updated and your explicit consent will be requested via the consent flow.

Third-party network calls

The current code has two classes of external runtime network calls: the user-triggered HIBP lookup, and GA4 analytics that loads only after you opt in.

Password breach lookup (HIBP k-anonymity)

The password-strength tools send a request to https://api.pwnedpasswords.com/range/ (the public Have I Been Pwned API) only when you actively click the "Check if leaked" button. That endpoint uses a k-anonymity design:

• The password is first hashed locally in your browser using SHA-1.
• Only the first 5 characters of the hash are sent to HIBP. The plaintext password and the full hash are not uploaded by the tool.
• HIBP returns every hash that starts with those 5 characters, and the browser compares the remaining characters locally to decide whether your password appears in the known-breach set.

The call is triggered only when you click the lookup button. If you do not use the password-strength tools, your browser never makes any request to HIBP.

Google Analytics 4 (after opt-in only)

After you opt in to analytics in the consent banner, the browser loads the GA4 tag from https://www.googletagmanager.com/ and sends basic visit measurement to https://www.google-analytics.com/ or https://region1.google-analytics.com/. The current Measurement ID is G-E80VEPRF3Z. Reject/default paths do not load these Google requests.

Other external resources

Aside from HIBP and opt-in GA4, the site does not embed any third-party fonts, maps, exchange-rate or weather APIs, social embeds, or third-party iframes at runtime. Heavier libraries (PDF.js, JSZip, figlet, highlight.js, MediaPipe, regexp-tree, etc.) are bundled as npm packages and served from our own domain, so they do not contact third-party domains while you use the site. If a future tool genuinely needs a new external endpoint, it will be disclosed in this section.

Analytics and ads

Current status

• The site is in a GA4 pilot: Google Analytics 4 loads only after you opt in to analytics, using Measurement ID G-E80VEPRF3Z; reject/default paths do not send analytics requests to Google.
• The site does not show any ads. In the current ads-disabled configuration, tool pages do not render ad slots and do not load any ad-network script.
• There is no public/ads.txt file, and we have not applied to AdSense or any ad pilot.
• Because of the above, we also do not run any commercial Consent Management Platform. If we later operate in regions or scenarios that require a CMP, that will be evaluated separately.

How GA4 works now

• You are asked, via a consent banner, whether you agree to analytics.
• Until you opt in, your browser will not send any analytics data to Google. After opt-in, only basic events (such as page views) will be sent.
• Ad-related signals — ad_storage, ad_user_data, ad_personalization — will stay denied by default, so opting into analytics does not automatically enable ad personalization.
• You can return to necessary-only at any time from Cookie settings in the footer.

If ads are enabled later

• public/ads.txt will only be added after we receive a real publisher ID.
• Sensitive tool pages (finance / health) will not be part of the first ad pilot by default and will require a separate policy review.
• Before any activation, this page will be updated and your explicit consent will be requested via the consent flow; personalized ads only run if you explicitly opt in.

Data sharing

Aside from the HIBP k-anonymity call and opt-in GA4 basic visit measurement described above, anything you type, generate, save, or favorite inside our tools is not uploaded by our tools or shared with any third party. The GA4 processor is Google Analytics (Google LLC / Google Ireland, depending on your region and Google's terms). Ads remain disabled.

What you can do

• Clear local data. Use your browser's developer tools — Application → Storage — to clear our site's localStorage and sessionStorage, or use "Clear site data" in browser privacy settings.
• Clear per-tool history. The color-blindness self-test, reaction-time test, random picker, special-symbols reference, emoji reference, statistics calculator, text-to-image tool, and others all have a "Clear" button.
• Clear "Recently Used". The "Clear" button at the top right of the homepage's "⏱ Recently Used" block removes visit_history in one click.
• Change cookie / analytics preferences. If analytics or ads switches are enabled, the footer shows "Cookie settings" so you can reopen the consent banner and update littleone:consent.
• Skip the password lookup. If you prefer to avoid even the password-range lookup, simply avoid the "Check if leaked" button on the password-strength tools (the local strength score itself does not call HIBP).
• Reach out. If you have questions about this policy or a specific tool, see the Contact page.

Changes to this policy

When the code reality changes — for example, a new third-party call, GA4 going live, or ads being introduced — this page will be updated and the "Last updated" date at the top will move forward. For sector-specific disclaimers and the boundaries of our tools, see the Disclaimer page.