alpaca.tools is operated by Caravaca Labs, LLC(“we”). This policy explains what happens to the content you put into our tools, what the site stores, and which third-party services are involved. There are no accounts and no ads, and we do not sell personal information. Questions? Email hello@alpaca.tools.
Your tool content stays in your browser
The tools on this site — JSON, Base64, URL, text, number, slug, and password utilities — run entirely in your browser. The text you paste and the results you get are not uploaded to our servers. Passwords from the password generator are created on your device and never leave it. If we ever add a tool that needs server-side processing, that tool will say so on its own page before you submit anything.
What stays on your device
Favorites, recently used tools, recent searches, and your light/dark theme preference are saved with localStorage on your own device, not on our servers. You can clear them at any time from your browser settings. If localStorage is unavailable, the site skips those features or keeps changes temporary.
Usage counts and ratings
When you use a tool or rate it, your browser sends a small event to our server so we can show usage counts and average ratings. For each rating we also record coarse context: your country and the Cloudflare data center that served the request, your browser and operating system names with major version, device type, language, timezone, viewport size, color scheme preference, the page the rating came from, and a timestamp. We do not store your IP address, name, or any account identifier with these events, so we cannot tie a rating back to you. The published numbers are aggregates across all visitors.
Analytics: Google Analytics
We use Google Analytics 4 to understand which pages and tools are used. It collects the pages you visit, the site that referred you, your device and browser type, and an approximate location derived from your IP address, and it sets cookies (such as _ga) to recognize returning browsers. Our analytics layer rejects any event field that looks like raw tool input, output, passwords, file content, or private URLs, so your tool content is never sent to analytics. Google processes this data on our behalf; see the Google Privacy Policy. You can block it with the Google Analytics opt-out add-on or any content blocker — the tools work fine either way.
Session replay: Microsoft Clarity
We use Microsoft Clarity for heatmaps and session recordings that show how pages are used (clicks, scrolling, navigation). Areas where your content appears — tool input, tool output, search text, and form fields — are marked for masking so recordings do not capture what you type. We configure Clarity with advertising storage denied; it is used for product analytics only. Clarity sets cookies (such as _clck and _clsk) and is operated by Microsoft; see the Microsoft Privacy Statement. Content blockers stop Clarity too, without affecting the tools.
Hosting and server logs
The site runs on Cloudflare’s network. Like any web host, Cloudflare processes your IP address and request headers to deliver pages and protect against abuse, and we keep short-lived operational logs for debugging and security. We also use your IP address transiently in memory to rate-limit form submissions; it is not written to our database. See the Cloudflare Privacy Policy.
Forms and email
The tool-request, problem-report, newsletter, and contact forms send only what you type into them. An email address is optional on requests and reports — provide one only if you want a reply. Submissions are delivered to our inbox through a delivery provider and used solely to respond, fix the problem, or send the newsletter you asked for. We also use Cloudflare Turnstile on public forms to check for automated submissions. You can unsubscribe from the newsletter at any time, and you can ask us to delete a submission by emailing hello@alpaca.tools.
Who we share data with
We share data only with the service providers named above — Google (analytics), Microsoft (session replay), Cloudflare (hosting), and our form delivery provider — and only so they can provide those services to us. We do not sell personal information, we do not share it for advertising, and we would disclose it beyond this only if legally required to.
Data retention
Data in localStorage stays until you clear it. Aggregate usage counts and rating events are kept indefinitely because they do not identify you. Form submissions are kept as long as needed to handle them. Google Analytics and Clarity retain their data according to the retention settings in those products.
Your rights and choices
You can use every tool with cookies or JavaScript trackers blocked. Depending on where you live — including under the GDPR in Europe and the CCPA in California — you may have the right to access, correct, or delete personal information, to object to processing, or to complain to a data protection authority. Because we hold almost nothing that identifies you, the practical scope of a request is usually your form submissions. Email hello@alpaca.tools and we will handle it.
Children
The site is not directed to children under 13, and we do not knowingly collect personal information from them. If you believe a child has sent us personal information through a form, email us and we will delete it.
Where data is processed
We operate from the United States, and Cloudflare serves the site from data centers around the world. If you visit from outside the US, the limited data described in this policy may be processed in the US and other countries.
Changes to this policy
When we change how the site handles data — for example, by adding a server-side tool or a new provider — we will update this page and the “last updated” date above before the change takes effect.
Contact
To ask about this policy, exercise a privacy right, or report a concern, email hello@alpaca.tools or use the contact page.