Tools by Lunar Turtle
Back to tools

Privacy Promise

Most tools run in your browser, so your data stays on your device. If a tool needs to send data to my server, it tells you what is sent and why.

  • Local by default: most tools process input in your browser and do not upload your content, which means your data stays on your device.
  • If a tool needs upload, we say so clearly: when a tool requires network processing, we explain what is sent and why.
  • No hidden processing: transformations happen in your browser session.
  • Accounts are optional: every tool works without signing in. An account never receives what you put into a tool.
  • Static deployment: this site is built as static pages, not a server app handling tool data.
  • Plain summary: Device Drop lets you move a file to another device with a 12-character code.
  • How transfer works now: your browser encrypts the file before upload. Our Worker stores only encrypted data for retrieval.
  • What we can and cannot see: we do not have the key to decrypt your file. Without your code (and optional passcode), the stored data is unreadable.
  • Access controls: upload and metadata retrieval require Turnstile verification. You can optionally add a passcode for extra protection.
  • Expiry and deletion: drops expire after 15 minutes. Expired drops are blocked and removed by cleanup.
  • No code in URL: drop codes are sent in request bodies, not URL paths or query strings.
  • Data use limits: drop data is used only to complete the transfer flow.
  • Plain summary: an account is optional. It holds your name, email address and a hashed password on my server.
  • What is stored: your name, email, whether the email is confirmed, a password hash, and sign-in sessions. Sessions don't record your IP address or browser.
  • What is not stored: tool input and output. Tools still run in your browser whether or not you are signed in.
  • Email: I only email you to confirm your address or reset your password, sent through Cloudflare. No newsletters.
  • Cookies: signing in sets one session cookie on api.lunarturtle.com, and this site keeps a logged-in flag in your browser so the header can show your profile link. Neither is used for tracking.
  • Abuse protection: sign-up, sign-in and password reset use Turnstile verification and are rate limited by IP address. Rate limit counters are short-lived.
  • Deleting your account: you can delete it from the account page. That removes your profile, password and sessions.