Privacy policy

The short version

nestoo has no user accounts and doesn’t keep a database of what you enter. Tools that can run in your browser never send your input to us. Lookups that need a server are processed only to show you the result.

Tools that run in your browser

The subnet calculator, password generator, password strength checker, hash generator, JSON formatter, Base64 and URL encoders, JWT decoder, UUID generator, the timestamp and binary converters, the text tools (word counter, case converter and diff checker), the QR code generator and the percentage and unit tools work entirely on your device. Their input is never transmitted to nestoo.

The image tools (compressor, resizer, converter, cropper, EXIF remover, favicon generator and image to Base64) process your pictures in your browser too: images are never uploaded. To open HEIC photos in browsers that can’t read them, the page downloads an image decoder from nestoo; the photo itself stays on your device.

The password strength checker can also check whether a password appears in known data breaches, but only when you click the button. It then sends the first five characters of the password’s SHA-1 hash to the Have I Been Pwned service and compares the answer on your device, so neither the password nor its full hash leaves your browser.

Tools that run on our server

IP lookup, DNS lookup, WHOIS, prefix lookup, ASN lookup, the port checker, HTTP header checker, SSL checker and the SPF, DKIM and DMARC checker send the domain, IP address, prefix, AS number or URL you enter to our server, which performs the lookup and returns the result. We don’t keep a record of these queries. Results stay in our server’s memory, and may be cached by Cloudflare, for up to an hour so that a repeated lookup is fast; these caches aren’t linked to you. To prevent abuse, your IP address is kept in memory for about a minute to enforce request limits.

Linked values in the results work the same way: when you point at or tap an IP address, domain, prefix or AS number, your browser asks our server for a short summary of it.

To answer DNS queries our server uses the public DNS over HTTPS resolvers of Cloudflare (1.1.1.1) and, when you choose it in DNS lookup, Google (8.8.8.8). The SPF, DKIM and DMARC checker only queries DNS and never contacts the domain’s mail servers. WHOIS and RDAP queries go to the registry responsible for the domain, IP address or AS number. Prefix lookup and ASN lookup send the prefix or AS number to RIPEstat (RIPE NCC); prefix lookup also sends the prefix to IRRexplorer (NLNOG) and an IP address you enter to bgp.tools. The summaries behind linked values use the same sources.

The port checker, HTTP header checker and SSL checker connect from our server to the host you enter, so that host sees our server’s address, not yours. They refuse private and local addresses.

Requests for new tools

When you ask for a new tool from the search, what you searched for, the description you write, the page language, the tools the search showed and, only if you enter it, your email address are sent to our mailbox through Cloudflare’s email service. Nothing is sent until you press “Send request”. We use requests to decide which tools to build and, if you left an email address, to reply. To prevent abuse, your IP address is kept in memory for up to ten minutes.

What is my IP

To show both your IPv4 and IPv6 address, your browser contacts Cloudflare’s public 1.1.1.1 service, which answers with the address it sees. Your approximate location is looked up in a database stored on our server. The speed test measures directly between your browser and Cloudflare’s network (speed.cloudflare.com); its results aren’t sent to nestoo.

Hosting and logs

nestoo runs on Railway and may be delivered through Cloudflare’s network. Like any web server, they can record technical request data (IP address, requested page, browser type and time) in short-lived logs used for security and troubleshooting. Lookups are sent as web addresses that contain what you entered (for example ?q=example.com), so these logs can include it.

Analytics

We may measure visits with privacy-friendly analytics that doesn’t use cookies and only reports aggregated numbers, such as how often each tool is used. This helps decide which tools to improve. Usage events say which tool was used and how (for example “compress” or “download”), never what you entered.

Ads and affiliate links

Some pages may show ads from Google. Google and its partners can use cookies or similar technologies to serve and measure ads; in the European Economic Area, the UK and Switzerland they ask for your consent first, and you can change your choice at any time via the privacy settings link shown with the consent message. See how Google uses information from sites that use its services at policies.google.com/technologies/partner-sites.

Recommendations labelled as sponsored are affiliate links: if you buy something after clicking one, nestoo may earn a commission. The partner’s site may set its own cookies.

Cookies and local storage

nestoo itself stores only three things in your browser: your language, your colour theme and, for the “Recently opened” list on the homepage, which tools you opened last (never what you entered in them). You can clear that list on the homepage. When you switch the language, the text you’re working on in the JSON formatter, diff checker and word counter is carried over in the open page’s memory; it isn’t saved anywhere. Everything else depends on the ads and analytics described above.

Your rights and contact

Under the GDPR you have the right to access, correct and delete your personal data and to object to its processing. Since we don’t keep personal data beyond the short-lived logs described above, there’s usually nothing stored about you. For any privacy question write to hello@nestoo.io.