privacy - ttykit is a small independent project. It has no accounts, no ads and no cookies. This page says what is collected and who receives what when you use it. Questions: support@ttykit.com.

WHAT IS LOGGED
ttykit runs on Cloudflare. Cloudflare logs each request for ttykit (Workers Logs) and states that it keeps these logs for up to 7 days. A log entry has the method, the full URL (path and query string), the response status, the request headers (these include your IP address and browser or curl user agent) and location and network details Cloudflare derives from the request. ttykit does not log request bodies.

Because the URL is logged, anything you put in a URL is logged too: /jwt/<token>, /base64/<text>, /qr/<text>, /cve/<id>, a domain, an IP. For anything sensitive, send it in the request body (curl --data-binary, or use the web form, which does that) or do not send it. Even then, treat the service as something that can see what you send.

Cloudflare also provides ttykit's DNS and network proxy, and processes traffic as described in its own privacy policy.

ANALYTICS AND COOKIES
ttykit sets no cookies and uses no local storage for tracking. Cloudflare Web Analytics is switched on for this site: web pages load a small Cloudflare script that reports page-load performance and the page path to Cloudflare. Cloudflare says it uses no cookies or client-side storage, does not store your IP address from these reports and does not fingerprint visitors. Curl output contains no script.

The /qr/scan phone scanner caches its own files in your browser so it works offline. The camera image is processed in your browser and is not uploaded.

WHO RECEIVES WHAT
Some tools look things up on your behalf. The value you ask about is sent to the service named here, and to nobody else:

  - dns: the domain and record type, to Cloudflare DNS over HTTPS (cloudflare-dns.com).
  - whois: the domain, to the registry RDAP server for its top-level domain. The list of RDAP servers comes from data.iana.org and contains nothing about you.
  - cve: the CVE ID, to the U.S. National Vulnerability Database (services.nvd.nist.gov).
  - thisip: the IP address or AS number you ask about, to the Cloudflare Radar API (api.cloudflare.com).
  - qr with resolve=1 (off unless you ask): ttykit requests the link in the QR code from its own servers and follows redirects, and looks up the link's hostname through cloudflare-dns.com. The destination site receives a request from ttykit, identified as ttykit-qr-check, not from your device.

myip and headers only echo back what your own request contained. The other tools (uuid, key, keypair, unixtime, datediff, jwt, base64, urlencode, cron, subnet, qr generation) do not contact anyone.

ttykit does not sell or share data for advertising. The "Buy me a coffee" link in the footer goes to a third-party site and only matters if you click it.

GENERATED KEYS
key and keypair generate their output on the server and print it to you. ttykit does not store or log the keys. They cross the network and ttykit's servers, so use them for development and testing, not for anything you would call a production credential.

ABUSE LIMITS
To stop abuse, ttykit counts some requests per client: RSA keypair requests (per IPv4 address or IPv6 /64) for about a minute, and QR redirect lookups per client and per destination host. These counters expire on their own.

YOUR QUESTIONS
Logs expire within days and are not tied to an account, so there is usually nothing to look up or delete. If you have a question or a request about data connected to you, write to support@ttykit.com.

Last updated 4 November 2026. Changes are published on this page.