Privacy

The short version

• No cookies and no tracking identifier until you accept analytics.
• Nothing you paste into the in-browser tools is ever sent anywhere — not to us, not to our analytics provider, not to anyone.
• Session recording and heatmaps are switched off on every page under /tools, whether or not you accepted.
• Analytics data is held in the EU.
• Declining removes every identifier we had set.

Analytics

We use PostHog, configured to store data in the European Union. It records which pages are viewed, what referred you, and coarse device and browser information. We do not run its automatic click capture, because that records the text of everything you interact with.

Before you answer the consent banner, analytics runs without cookies and without a stored identifier, so page views are counted but cannot be linked to you across visits. If you accept, we set one cookie holding a random identifier so repeat visits can be recognised. If you decline, capture stops and any identifier we previously set is deleted.

We also honour your browser's Do Not Track setting, which switches analytics off regardless of what the banner says.

Heatmaps and session recording

If you accept, we record anonymised interaction data — where people click and how far they scroll — so we can tell which parts of a page are working.

This is permanently disabled on every page under /tools. Several of those tools ask you to paste real material: API keys, access tokens, private keys, JSON Web Tokens, whole configuration files. Session recording captures the contents of a page, so recording those pages would mean shipping your credentials to a third party and would contradict what those pages tell you. The exclusion covers the whole section rather than a list of named pages, so it still holds for tools added later. All form inputs are masked everywhere else on the site as a second layer.

The free tools

There are two kinds, and the difference matters.

Tools that run entirely in your browser

The secret scanner, JWT decoder, JWT security checker, CSP generator and the paste mode of the SRI generator do all their work locally. What you paste is never transmitted. You can confirm this by opening your browser's network tab while using them, or by disconnecting from the internet — they still work.

Tools that check a URL you give us

The header, CSP, CORS, SSL, cookie, DNS, subdomain, robots.txt and security.txt checkers must contact the address you enter, so that address is sent to our server and our server makes a request to it. We keep a short-lived, in-memory count of requests per IP address to stop the tools being abused; it is not written to a database and does not survive a restart. We do not retain the URLs you check.

Running a free scan

Submitting a URL in the hero form sends you to platform.averto.dev with that address attached, so the scan can start. From that point the Averto application's own terms and privacy notice apply.

What we do not do

• No advertising networks and no advertising cookies.
• No selling or sharing of personal data.
• No accounts, sign-ups or email capture anywhere on this site.
• No recording of anything entered into the in-browser tools.

Changing your mind

Clear this site's data in your browser and the consent banner returns, letting you choose again. Declining deletes the analytics cookie and the matching local storage entry. You can also block analytics entirely with a tracker blocker or Do Not Track, and the site works normally either way.

Contact

Questions about this page, or a request relating to your data: security@averto.dev. For security vulnerabilities, see the disclosure policy.

Last updated 21 September 2026. This page is a factual description of what the site does, written alongside the code that does it. It is not legal advice and has not been reviewed by a lawyer.