The short version

1234.nu has no accounts, no advertising, no tracking cookies, and no behavioural profiling. It does not build a profile of you and shares nothing with third parties. There's no cookie-consent banner because the site sets no cookies. A few features do necessarily handle some data — webhook captures, the group date-picker, the feedback form, and a short security log — and this page sets out exactly what, why, and for how long.

Who runs this & how to reach us

1234.nu is an independent, self-hosted project operated by "Sparktime". In data-protection terms Sparktime is the data controller for this site. For any privacy, data, or security matter — including the rights listed below — contact security@1234.nu; full controller identification is available on request to that address.

Cookies

This site sets no cookies. None for tracking, none for advertising, and no third-party cookies (there are no third parties). Because of that, no EU/Dutch cookie-consent banner is required.

The only thing stored on your device is a small amount of local preference data in your browser's own storage — for example which theme (light/dark) you picked, and some tools remembering your last settings. This stays in your browser, is never transmitted to the server, and you can clear it any time through your browser. It exists purely to make the site work the way you left it, not to identify you.

Your data in the tools

• Client-side tools (most of them) process everything locally in your browser. The text, files, images, passwords and secrets you work with are never uploaded. See the about page for how that works.
• Share & store tools (paste, file share, notes, images, URL shortener) keep the content you submit so it can be shared by link. Each item has a delete link and an automatic expiry, and several support burn-after-read. We don't read it, index it, or attach your identity to it.
• Network and relay tools send the hostname or data they need to do their job (e.g. the domain you ping), but don't retain it as a profile. Live relays pass data between your own devices and store nothing.
• Webhook inspector exists to show you the requests sent to your test endpoint, so it stores each captured request in full — method, path, headers, body, and the sender's IP address — until the bin expires (you choose 1 hour, 24 hours, or 7 days; max 100 requests), after which it is deleted. Because headers can contain tokens or cookies, don't point live/production traffic with real secrets at a test bin.
• Group date-picker stores the name and chosen availability that each participant types in, so the organiser can see who can make it. This is kept until the event expires (the organiser picks up to 180 days) and is then deleted; entries can be edited or removed via their own link. No IP is stored. Please only enter a name others in the group will recognise.

Usage statistics — aggregate and anonymous

To know roughly how much the site is used, we keep aggregate counters only — total page views per day, and a rough count of unique and returning visitors. This is deliberately built to not track or identify anyone:

• No cookies and nothing stored on your device are used for this.
• For these statistics we never store your IP address or user-agent in any readable form. To estimate "unique visitors" without tracking, those values are combined with a random daily salt and one-way hashed; only the opaque hash is kept to de-duplicate within a single day. The salt changes every day, so the same person on two different days produces two unrelated hashes that cannot be linked together, and the hash can't be reversed back to an IP.
• A second, coarser hash under a salt that rotates every 30 days lets us estimate returning visitors within a month — and only within a month. Across that window the salt changes, so correlation is bounded to ≤30 days and never long-term.
• These per-visitor hashes are pruned automatically; the only thing kept long-term is the plain aggregate count (a few numbers per day).

Under the GDPR, an IP address can be personal data, which is why we hash it immediately, never store it raw, rely on legitimate interest for these privacy- preserving aggregate stats, and keep retention short and bounded. There is no consent prompt because nothing is stored on your device and no profile is built.

Security & abuse logging

To defend the site against hostile scanners and bots, requests that hit no valid page (the kind of automated probing real visitors never do — looking for /.env, /wp-admin and the like) are recorded with the IP address, the path requested, and the browser's user-agent. This log is admin-only, never shown publicly, and automatically deleted after 14 days. Normal browsing of the site's real pages is not recorded here. If an IP keeps probing it can be added to a blocklist so it is refused; automatically-added blocks are removed again after 90 days, while a small number of manual blocks may be kept as long as needed. The lawful basis is our legitimate interest in network and information security (GDPR art. 6(1)(f), recital 49).

The feedback form

When you send a bug report or feature request from the footer, we store your message and — only if you leave the box ticked — some diagnostics: screen size, viewport, browser/user-agent, language, theme, the site build, and any errors the page logged. We don't store your IP with it. It's used solely to fix bugs and act on requests (legitimate interest), and is deleted automatically — resolved reports within about 30 days, and everything within 180 days at the latest. Please don't include anything private in the message.

No third parties

There are no analytics services, ad networks, social widgets, external fonts, or CDNs. Every script, style, font and library is served from this site itself, and a strict Content-Security-Policy stops third-party code from loading. Nothing about your visit is shared with anyone. The only outbound link is the optional "buy me a kroket" donation button, which takes you to PayPal if you click it — at that point PayPal's own privacy terms apply.

Your rights

Because the site keeps no accounts and builds no profile, most data is either yours to manage directly or expires on its own. You have the right to access, rectify, erase, restrict, and port your personal data, and to object to the processing we base on legitimate interest (the usage statistics and security logging above). In practice:

• Erase / rectify it yourself: anything you create with the share/store tools, the date-picker or the webhook inspector has its own delete (or edit) link, or simply expires.
• Ask us: for anything you can't do yourself — for example to remove your IP from the blocklist, to delete a feedback report, or to make an access request — email security@1234.nu. We hold so little, and so briefly, that there is usually little to return.

A quick map of how long things are kept: usage-stat hashes up to ~90 days (aggregate counts indefinitely); security/probe logs 14 days; auto-added IP blocks 90 days; webhook captures up to 7 days; date-picker entries up to the event's expiry (≤180 days); feedback up to 180 days; share/store content until its delete link is used or its expiry passes.

Curious how the whole thing is built? See the about page.