Privacy policy

What we collect, and what we don’t

maratool does not have user accounts. There is nothing to sign up for, nothing to log into, and no profile data to leak. There is no Google Analytics, no PostHog, no Mixpanel, no Plausible, no Fathom. Three third parties do get a request on every page: Cloudflare Web Analytics, the feedback button, and Google Fonts (the Inter and Instrument Serif web fonts, served from fonts.googleapis.com and fonts.gstatic.com). None of them sets a cookie, and the analytics and feedback scripts are described below.

Almost every tool runs entirely in your browser using JavaScript and the standard Web APIs (Web Crypto, DOMParser, FileReader, Canvas, etc.). Inputs you type or files you drop into a tool stay on your device. For these tools, there is no server-side processing of any input.

The one tool that talks to a server: Instagram video downloader

The Instagram video downloader is the only tool on the site that talks to a server. When you paste an Instagram URL, your browser sends that URL to a small Cloudflare Worker in this same repository. The worker then calls a third-party Instagram API to fetch the video — RapidAPI’s instagram120 by default, with public fallbacks to cobalt.tools and kohi if that fails. This indirection is required because Instagram blocks direct fetches from the browser.

The worker source is in worker/src/index.js on GitHub. It does not write request data to any database, KV, or analytics. It does emit an error message to Cloudflare logs if the upstream API call fails, and Cloudflare itself records standard infrastructure access logs (timestamp, requesting IP, URL path) that the project does not control. The Instagram URL you paste is also visible to whichever upstream API ends up serving the request (RapidAPI, cobalt.tools, or kohi). If you would rather not share that, skip this tool.

What is stored locally in your browser

Some tools use localStorage to persist preferences and recent activity on your own device. None of this is transmitted to any server. Specifically:

• Recently used tools — the last few tools you opened, for the sidebar list and the command palette.
• Pinned tools — favourites you star with the ★ Pin button.
• Tool-specific drafts — a handful of tools (e.g. markdown editor) save in-progress work so you don’t lose it on refresh.

You can clear all of this with your browser’s site-data controls. Clearing it has no effect outside your browser.

Server logs

maratool is hosted on Cloudflare Pages. Cloudflare keeps standard request logs (IP address, user-agent, requested URL, response code) for routing, security, and abuse prevention. These logs are retained per Cloudflare’s standard policy and are not used by maratool for any analytics or profiling.

Analytics

Every page loads Cloudflare Web Analytics. It reports one page view plus the browser’s own performance timings, and nothing else:

• What it sends — the page path, the referring URL, and timing numbers (load time, Core Web Vitals). The request itself carries your IP address and user-agent, the same as every other request to the site; that is where the country column in our dashboard comes from.
• What it does not do — it sets no cookie, writes nothing to localStorage, and stores no visitor ID. There is no identifier tying one page view to the next, so what we read is aggregate: which pages get traffic, which referrers they come from, how fast they render.
• Your tool input is not in it — the beacon reports the path only, dropping the query string and the # fragment. That matters because several tools keep your work in the URL fragment. This is Cloudflare’s code rather than ours, and the file updates on their schedule, so treat it as a description of the beacon we checked rather than a guarantee we enforce.

A tool embedded inside a blog post is not counted a second time.

Feedback button

The feedback button in the corner of every page is loaded from marapulse.com. Fetching it tells that host your IP address, user-agent, and which page you were on, the same as fetching any other file. It sets no cookie and writes nothing to localStorage. Opening it loads the feedback form in an iframe from the same host; nothing is sent until you submit it.

Ads

maratool is supported by ads served via Google AdSense. AdSense uses cookies and similar technologies to serve and measure ads. This is the one place on the site where cross-site tracking can occur. Google’s use of advertising cookies is governed by the Google Privacy & Terms — Advertising policy. You can opt out of personalized advertising at Google Ad Settings.

AI crawlers

We allow major AI search crawlers (GPTBot, ClaudeBot, PerplexityBot, Google-Extended, Applebot-Extended) to read public pages so AI assistants can cite our tools. We block training-only crawlers (CCBot, Bytespider). See our robots.txt for the full list.

Contact

Questions about privacy: [email protected]. Site is operated by Marcell Almeida (Brazil) — see the about page.

Changes

Material changes to this policy will be reflected in the "Last updated" date at the top of this page.