Privacy

Without an account

Browsing the catalog needs no account and sets no cookies. Your theme choice is kept in your own browser's local storage. Previews load stylesheets and SVG files from cdn.htmltool.io, which sees the request like any web server does.

What we store for an account

• Account: your name, email address, whether the email is verified, and a hashed password. If you sign in with GitHub, Google or Apple, we store the link to that account and the profile picture URL it provides.
• Web sessions: a session record with its expiry, IP address and browser user agent, so you stay signed in and can spot unfamiliar sessions.
• Favorites and collections: the items you save, collection names and their order.
• DevOps for Mac sessions: for each Mac you sign in from, the device name, user agent, IP address, when it was created and last used, and a hash of its token. You can see and revoke these on the devices page.
• Abuse protection: short-lived rate-limit counters keyed by IP address or account.

Cookies

The only cookies are the ones that keep you signed in. They are first-party, HTTP-only and expire with the session. There are no tracking, advertising or analytics cookies.

Hosting

The site runs on Cloudflare Workers and the data lives in a Cloudflare D1 database. Cloudflare processes requests on our behalf, including IP addresses, to serve and protect the site. Emails, such as password resets, are sent through Cloudflare when email is enabled.

Sharing

We don't sell or share your data. It is only disclosed if the law requires it.

Deleting your data

Delete your account from account settings. That removes your profile, sessions, favorites, collections and DevOps for Mac sessions. For anything else, email support@htmltool.io.