Privacy Policy and KVKK Notice
Effective and last updated: August 22, 2026 · Version 2.1
This notice explains how DevTools processes personal data. It is intended to satisfy the transparency requirements of Türkiye's Personal Data Protection Law No. 6698 ("KVKK") and, where applicable, the GDPR and similar privacy laws. It is not a request for consent. Where consent is legally required, it will be requested separately.
1. Data controller
DevTools is operated from Türkiye by Göksel Yeşiller, an independent developer operating under the DevTools name. Göksel Yeşiller is the data controller for the processing described here. Privacy questions and data-subject requests may be sent to devtools@genithora.com.
2. Local processing
Most DevTools utilities perform their core transformation in your browser. For those tools, the text, code, files, images, keys, or other input you provide is not uploaded to DevTools. A local-processing statement applies only to the identified tool's core operation; it does not mean that the website makes no network requests at all.
Favorites, recently viewed tools, theme preferences, and inputs for tools that offer local auto-save may be stored in your browser's local storage. This information remains on your device and can be removed through the relevant tool controls or your browser's site-data settings. Do not use auto-save for secrets or confidential production data.
If you choose to enable the tool assistant, its model files — several hundred megabytes — are downloaded once and kept in your browser's cache storage, and the conversation is kept in local storage. Both stay on your device, are never uploaded, and can be deleted at any time from the assistant's settings or through your browser's site-data settings.
3. Data processed through network features
| Feature | Data and recipient | Purpose |
|---|---|---|
| Site delivery | IP address, request URL, time, browser/device and diagnostic data processed by Vercel | Deliver, secure, and troubleshoot the site |
| Usage and performance metrics | Anonymized page, device, approximate location, and performance measurements processed by Vercel Analytics and Speed Insights; tool input content is not intentionally included | Understand aggregate use and improve reliability |
| Contact and feedback | Category, summary, message, and optional email sent through Web3Forms and delivered to our email provider | Review and respond to feedback |
| IP Address Lookup | Your connection IP or the IP entered, sent over HTTPS to GeoJS | Return IP and network information |
| Password Breach Checker | Only the first five characters of a locally calculated SHA-1 password hash, sent to Have I Been Pwned | Perform a k-anonymity breach-range check; the password itself is not sent |
| Avatar and favicon generation | The selected style and seed or initials sent to DiceBear when a generated image is requested | Generate the requested image |
| DevTools Backend API (SSL/TLS, DNS propagation, subdomains, security headers, WHOIS/RDAP, IP intel) | Hostname, domain, URL, or IP you submit; masked client IP in server access logs | Sent to our backend at api.devtools.tools (or interim Railway host); targets processed to return results, not stored as profiles; access logs kept up to 7 days with last IP octet redacted |
| Client-side network tools (paste URL / browser fetch) | Domain, hostname, or URL entered | Processed in your browser or via limited DevTools routes; see each tool's disclosure banner |
| HTTP Request Builder | Target URL, method, headers, and body pass through a DevTools route hosted by Vercel and are forwarded to the target you choose | Execute a cross-origin HTTP request at your direction |
| Tool assistant (beta) | The language model runs entirely in your browser: your messages and its replies are not transmitted to DevTools or any third party, and the conversation is kept only in your browser's local storage until you clear it. Separately, anonymous usage events are processed by Vercel Analytics — that the assistant was opened, which model was chosen, a coarse band for message length, the tool identifier ranked first for a turn, and which suggested tool was opened. These events contain no message text or excerpt of it. | Run the assistant on your device, and measure which suggestions are useful so the beta can be improved |
Network-enabled tools identify their external behavior in the interface. Do not send secrets, credentials, personal data, or confidential material unless you are authorized and accept the target provider's processing.
4. Legal grounds
- Providing a requested feature: processing necessary to perform the service or take steps at your request (KVKK Article 5/2(c); GDPR Article 6(1)(b), where applicable).
- Security, analytics, and improvement: our legitimate interests in operating a secure, reliable, and useful free service, provided your fundamental rights do not override those interests (KVKK Article 5/2(f); GDPR Article 6(1)(f)).
- Legal compliance: processing necessary to meet a legal obligation or establish, exercise, or defend legal claims (KVKK Article 5/2(a), (e); GDPR Article 6(1)(c), (f)).
- Consent: used only where a particular optional technology or local law requires it. Consent can be withdrawn without affecting earlier lawful processing.
5. Sharing and international transfers
Data is shared only as needed with hosting, analytics, form-delivery, email, security, and lookup providers described above, a target selected by you, professional advisers, or authorities where legally required. Vercel, Web3Forms, and some user-selected recipients may process data outside Türkiye or your country. Provider account settings, retention periods, data-processing terms, and any required KVKK Article 9 transfer mechanism must also be completed operationally; this notice does not replace those measures or claim that an unverified safeguard is in place. Do not submit sensitive, confidential, or unnecessary personal data through feedback or network-enabled tools. We do not sell personal data, use it for cross-context behavioural advertising, or knowingly provide tool input content to train generative-AI models.
6. Retention
- Local storage remains on your device until you clear it.
- Feedback and related correspondence is normally deleted within 12 months after the conversation is closed, unless it is needed longer for security, abuse prevention, or a legal claim.
- DevTools does not create a separate long-term archive of ordinary hosting, analytics, or performance events. Vercel retains these records according to the account plan, configured settings, and its legal obligations.
- Backend API access logs (masked client IP, path, timestamp, error metadata) are retained for up to 7 days for security and abuse response.
- Temporary request data handled by other network tools is not intentionally persisted by DevTools, although the selected recipient, target server, hosting platform, and security logs may retain request records under their own policies.
7. Your rights and requests
Depending on applicable law, you may ask whether your data is processed; request access, correction, deletion, restriction, or portability; object to processing; withdraw consent; and complain to the competent authority. KVKK Article 11 rights include learning the purpose and recipients of processing, requesting correction or deletion, and seeking compensation where the statutory conditions are met.
Send a request to devtools@genithora.com with the subject “Privacy Request”, your request, and enough information to verify that it concerns you. Do not email a full identity document unless specifically and lawfully needed. We will respond within the period required by applicable law; KVKK requests are answered as soon as possible and no later than 30 days.
8. Cookies and browser storage
DevTools does not use Google Analytics or advertising cookies. Vercel Analytics is documented by Vercel as cookie-free, while Speed Insights reports anonymous performance measurements. Details about storage and browser controls are in our Cookie and Local Storage Notice.
9. Children
DevTools is a general developer service and is not directed to children under 16. We do not knowingly create profiles of children or collect their data for advertising. A parent or guardian who believes a child provided personal data may contact us for deletion.
10. Changes
We may update this notice when the service or law changes. Material changes will be identified by a new effective date and version on this page. Changes apply prospectively.