Privacy, in plain words

Last updated: 2026-09-09

Who operates this site

The controller is the operator identified in the Imprint, reachable at hello@plainforge.com. plainforge.com is the hub of the plainforge tool network.

What we collect

Nothing that identifies you. The hub and its tools have no accounts, set no cookies, and run no advertising or fingerprinting scripts. What you type, paste or upload into a tool is processed in your browser and is never transmitted to us; we have no server that could receive it.

Check it yourself

Two ways to verify without trusting a word here. Open your browser's developer tools (F12, then the Network tab) on any page of this site and watch it load: every request stays on this domain. And every page ships a Content-Security-Policy that instructs your browser itself to block requests anywhere else, so even a bug could not phone home:

default-src 'none'; script-src 'self'; style-src 'self'; img-src 'self' data: blob:; connect-src 'self'; base-uri 'self'; form-action 'self' mailto:; frame-ancestors 'none'; object-src 'none'

What stays in your browser

A few conveniences live in your browser's storage, on your device only: your theme choice, your saved tools (hearts), your recently-used list, and per-tool settings such as your time-zone city list or today's pomodoro count. The ecosystem page may keep one technical flag in sessionStorage so a faulty graphics driver cannot cause a reload loop. None of it ever leaves your machine. Clear your browser data and it's gone, and we couldn't restore it if you asked. Storing these is strictly necessary for features you invoke, which is exempt from the EU/UK ePrivacy consent requirement; that is why there is no consent banner.

Hosting and server logs

The site is served as static files by our hosting provider and processor, HOSTINGER, UAB (company code 302710386, Švitrigailos str. 34, Vilnius, Lithuania; verified on its privacy policy on 9 September 2026). Because the processor is in Vilnius, no third-country transfer is made by us; Hostinger's own policy covers any transfer inside its group under the European Commission's standard contractual clauses. Like virtually every website, the provider's servers may keep standard technical access logs (IP address, requested file, timestamp) to deliver pages and maintain security. That is infrastructure, not analytics; we add nothing on top of it. Legal basis: our legitimate interest in running and securing the service (GDPR Art. 6(1)(f)). Retention: we keep no data; the host's access logs are held under the host's own retention policy. If we ever add measurement, it will be cookieless, aggregate-only, and this policy will be updated first.

Other domains in the network

Cards marked ↗ open apps that run on their own domains. Each is its own service with its own privacy policy, published on that site, and every one is held to this same standard. Outbound links carry no tracking parameters, and the hub sends Referrer-Policy: no-referrer, so destination sites aren't told what you were looking at here.

Sponsors

Sponsor slots are static placements: an image or text we host ourselves, always labelled Sponsored. No sponsor scripts, no pixels, no audience data, because there is none to give.

Your rights

Under the GDPR you have rights of access, correction, erasure, restriction, portability and objection, and the right to complain to a supervisory authority (in Lithuania: the State Data Protection Inspectorate, vdai.lrv.lt). Because this site holds no personal data about you, there is normally nothing to access or erase, but you can always write to the address below and we will respond within a month.

Questions

Write to hello@plainforge.com. Terms of use live on their own page; the operator record is the imprint.