Privacy policy

Who we are and what this policy covers

MySmartCoPilot (mysmartcopilot.com) is operated by MySmartCoPilot Support Team. In these pages, “MySmartCoPilot”, “we”, “us” and “our” mean MySmartCoPilot Support Team.

This policy explains what information MySmartCoPilot handles when you use the website, its tools, the contact form, the newsletter, the Ask MySmartCoPilot tool finder and the Developer API, why we handle it and how long we keep it. For questions or requests, use the contact form (topic “Privacy or data request”) or email [email protected] .

The tools run in your browser

When you open a tool, your browser downloads the page and the tool’s code from MySmartCoPilot. From then on the work happens on your device: files you choose and text you type or paste are processed in your browser’s memory, and results are saved back to your device as downloads. MySmartCoPilot does not receive what you enter into a tool, so we cannot see, keep or share it, except in the tools listed next.

These tools are the exception: they send what you enter over the network, because they cannot do the job inside a browser alone:

• Abuse Contact Finder : Your browser asks IANA’s bootstrap service, the regional internet registries, the domain’s registry and registrar (RDAP) and Cloudflare’s DNS resolver directly. Only lookups a browser cannot make are relayed through MySmartCoPilot’s server. MySmartCoPilot never sends a report.
• APA Citation Generator (7th Edition) : Typing in the form works offline. Autofill sends only what you put in the autofill box: a DOI to doi.org (which forwards to Crossref, DataCite or another registration agency), an ISBN to Open Library, or a web address to MySmartCoPilot’s server, which reads that page.
• Broken Link Checker : In “Page URL” mode the address is sent to MySmartCoPilot’s server, which fetches the page; the links found on it are then sent to the server in groups of ten, and it requests each one from its website and returns the status. With pasted HTML only the link addresses are sent.
• Business Name Generator : The names are generated in your browser. Only if you press Check on a name are its domain names (such as brewcrew.com) sent to the domain registries’ public RDAP services — straight from your browser, not through MySmartCoPilot.
• Chicago Citation Generator (18th Edition) : Typing in the form works offline. Autofill sends only what you put in the autofill box: a DOI to doi.org (which forwards to Crossref, DataCite or another registration agency), an ISBN to Open Library, or a web address to MySmartCoPilot’s server, which reads that page.
• Citation Generator : The form works offline. Autofill sends only what you type into the autofill box: a DOI to doi.org (which forwards to Crossref, DataCite or another registration agency) or an ISBN to Open Library. Your bibliography stays in this browser.
• DKIM Record Checker : Your browser asks Cloudflare’s DNS-over-HTTPS resolver for the key records (Google’s if Cloudflare cannot be reached); keys are decoded in your browser.
• DMARC Record Checker : Your browser asks Cloudflare’s DNS-over-HTTPS resolver for the DMARC records (Google’s if Cloudflare cannot be reached); MySmartCoPilot’s servers are not involved.
• DNS Lookup : Your browser sends each query straight to Cloudflare’s or Google’s DNS-over-HTTPS service; MySmartCoPilot’s servers never see what you look up.
• DNS Propagation Checker : Your browser asks six public DNS-over-HTTPS resolvers directly (Cloudflare, Google, Quad9, AliDNS, Control D and CleanBrowsing); MySmartCoPilot’s servers are not involved.
• Domain Availability Checker : Your browser asks Cloudflare’s DNS-over-HTTPS resolver, IANA and each registry’s RDAP service directly. Names under registries that block browser requests (such as .de) are asked through MySmartCoPilot’s server.
• Harvard Referencing Generator : Typing in the form works offline. Autofill sends only what you put in the autofill box: a DOI to doi.org (which forwards to Crossref, DataCite or another registration agency), an ISBN to Open Library, or a web address to MySmartCoPilot’s server, which reads that page.
• Historical Exchange Rates : Sends only the currencies and dates you choose to MySmartCoPilot’s server, which fetches the rates from the European Central Bank. The amount you type stays in your browser.
• HTML / Web Table to CSV & Excel : Pasted content and opened files never leave your device. The Wikipedia tab asks Wikipedia for the article you name, straight from your browser. The Web page tab sends only the address to MySmartCoPilot, which fetches that page and returns the text of its tables.
• HTTP Header Checker : In “Fetch a URL” mode the address you enter is sent to MySmartCoPilot’s server, which requests it from the website and returns the status and headers. In “Paste headers” mode nothing leaves your browser.
• Indexability Checker : The URL you enter is sent to MySmartCoPilot’s server, which requests the page (following its redirects) and the robots.txt file of each host, and returns what the websites answered. The analysis runs in your browser.
• Internet Speed Test : Runs the test against Cloudflare’s speed test servers (speed.cloudflare.com), which see your IP address and the test traffic. The results go to Cloudflare only if you tick “Share results with Cloudflare”; MySmartCoPilot receives nothing.
• IP Address Lookup : Your browser asks the regional internet registry (RDAP), Cloudflare’s DNS-over-HTTPS resolver (for reverse DNS and Team Cymru’s routing data) and the Tor Project’s relay list about the address you enter. The country comes from a DB-IP data file on MySmartCoPilot itself.
• Link Extractor : In “From a URL” mode the address is sent to MySmartCoPilot’s server, which fetches that one page and returns only its links. Pasted HTML is read in your browser and never uploaded.
• MLA Citation Generator (9th Edition) : Typing in the form works offline. Autofill sends only what you put in the autofill box: a DOI to doi.org (which forwards to Crossref, DataCite or another registration agency), an ISBN to Open Library, or a web address to MySmartCoPilot’s server, which reads that page.
• MX Lookup : Your browser asks Cloudflare’s DNS-over-HTTPS resolver for the MX, address and reverse-DNS records (Google’s if Cloudflare cannot be reached); MySmartCoPilot’s servers are not involved.
• On-Page SEO Checker : In “Page URL” mode the address you enter is sent to MySmartCoPilot’s server, which fetches the page once and returns its HTML; the audit itself runs in your browser. In “Paste HTML” mode nothing leaves your browser.
• Open Graph & Social Preview Checker : In “Page URL” mode the address is sent to MySmartCoPilot’s server, which fetches the page’s head and, if you leave it on, asks about the preview image (type, size, redirects). Your browser also loads the preview image from its own server to read its pixel size. In “Paste HTML” mode nothing is sent unless you tick the server image check.
• Page Speed Test (Lighthouse via PageSpeed Insights) : Sends the address you enter (and the API key in use) straight from your browser to Google’s PageSpeed Insights API, which loads the page with Lighthouse. MySmartCoPilot’s servers are not involved and nothing is stored.
• Pwned Password Checker : Your password never leaves your device. It is hashed with SHA-1 in your browser, and only the first 5 characters of that hash are sent to Have I Been Pwned’s Pwned Passwords API (api.pwnedpasswords.com), which returns every breached hash starting with them; the match is looked for on your device.
• Redirect Checker : The URL you enter is sent to MySmartCoPilot’s server, which requests it (and each redirect target) from the website and returns the status codes and headers.
• REST API Tester (Online API Client) : Your request goes directly from your browser to the API you enter — never through MySmartCoPilot. History and environments are kept only in this browser.
• Robots.txt URL Tester : In “Fetch from a website” mode the site address is sent to MySmartCoPilot’s server, which downloads that site’s robots.txt and returns it. Pasted rules are tested in your browser and never uploaded.
• Schema Markup Validator : In “Page URL” mode the address you enter is sent to MySmartCoPilot’s server, which fetches the page once and returns its HTML; the markup is read and checked in your browser. In “Paste code” mode nothing leaves your browser. The schema.org vocabulary the check uses is a file from MySmartCoPilot that loads the first time you check.
• Security Headers Checker : Pasted headers are analysed in your browser and never uploaded. A URL check sends only the address to MySmartCoPilot’s server, which requests the page from the website and returns its response headers.
• Speech to Text (Voice Typing) : Unless on-device recognition is available and in use (the page tells you), your browser sends your audio to its own speech service — Google in Chrome, Microsoft in Edge, Apple in Safari — to turn it into text. MySmartCoPilot never receives your audio or your text.
• SPF Record Checker : Your browser asks Cloudflare’s DNS-over-HTTPS resolver for the SPF records (Google’s if Cloudflare cannot be reached); MySmartCoPilot’s servers are not involved.
• SSL Certificate Checker : The host name is sent to MySmartCoPilot’s server, which connects to the site over HTTPS and HTTP and asks hstspreload.org for its preload status. Your browser searches crt.sh (Certificate Transparency) for the host name.
• Suspicious Link Checker : The link is analysed in your browser and is never opened or fetched. Only if you press Look up domain age is the domain name (not the link) sent from your browser to IANA’s RDAP directory and to that domain’s registry.
• URL Expander : The link is sent to MySmartCoPilot’s server, which follows its redirects with HEAD requests (GET only when a server refuses HEAD, without reading the page) and returns the addresses. Pages are never downloaded or shown.
• Website Down Checker : The address is sent to MySmartCoPilot’s server, which requests it from Cloudflare’s network. With the browser test on, your browser also contacts the site directly so the two results can be compared.
• Website Hosting Checker : Your browser asks Cloudflare’s DNS-over-HTTPS resolver (Google’s as a fallback) for the domain’s DNS records, and through it Team Cymru’s routing data for the site’s IP addresses. Countries come from a DB-IP data file on MySmartCoPilot itself.
• WebSocket & SSE Tester : The page connects directly from your browser to the address you enter — never through MySmartCoPilot. Messages, headers and tokens are not stored; only the address (without its query string) and your settings are remembered in this browser.
• What Is My IP Address : Reads your address from Cloudflare’s /cdn-cgi/trace on MySmartCoPilot’s own domain, checks the other IP version with icanhazip.com (run by Cloudflare) or ipify.org, and — only when you press the button — asks MySmartCoPilot’s server for the location details Cloudflare attaches to your request.
• WHOIS Lookup (RDAP) : Your browser asks IANA’s bootstrap service and the official registry (and registrar) RDAP servers directly, and Cloudflare’s DNS resolver when a TLD has no RDAP service. Only registries that do not accept browser requests are asked through MySmartCoPilot’s server.
• XML Sitemap Validator : With a URL, MySmartCoPilot’s server downloads the sitemap and your browser checks it. Uploaded or pasted sitemaps are checked in your browser and never sent — unless you press “Check status”, which sends up to 50 of the listed URLs to the server so it can request them.

When one of them sends its request to MySmartCoPilot’s own server, a licence key saved in this browser goes with it while its pass lasts, so that the pass’s higher limits apply (see Payments and licence keys).

A few tools also use the network to download what they need, never to send your input:

• AI Image Upscaler: The first AI upscale downloads the AI model for that scale (about 2.8 MB) and the engine code from this site. Classic mode needs no download. Your images are never uploaded.
• Audio Converter: The audio engine (and, when a file needs them, the MP3, AAC, FLAC, AC-3 and DTS codecs) downloads from MySmartCoPilot the first time you open a file. Your audio is never uploaded.
• Audio Joiner (Merge MP3): The audio engine (and, when you re-encode, the MP3 or AAC encoder) downloads from MySmartCoPilot the first time you use it. Your files are never uploaded.
• Audio to Text Transcriber: The first time you transcribe, the Whisper speech model and its engine (about 53 MB) are downloaded from this site; your browser keeps them for next time. Your recordings are never uploaded.
• Background Remover: The first cut-out downloads the AI engine and a model from this site (about 27 MB for people, 19 MB for objects; Tap to keep adds about 18 MB). Your photos are never uploaded.
• Barcode Scanner Online (Camera or Image): Browsers without a built-in barcode reader download the decoder (zxing-wasm, about 0.9 MB) from this site the first time it is needed, and a HEIC photo in a browser that cannot open HEIC needs the HEIC decoder (about 1.4 MB) from this site. Pictures, camera frames and numbers are never uploaded.
• Blur Background (Portrait Mode): The first blur downloads the AI engine and a model from this site (about 27 MB for people, 42 MB for scenes). Your photos are never uploaded.
• Blur Faces in Photos: The first time, the face detection engine (about 11 MB) and two face models (1.3 MB) are downloaded from this site; your photos are never sent anywhere.
• Blur, Pixelate & Redact Image: Detect faces downloads the face detector (about 11 MB) from this site the first time you use it; drawing, blurring and saving need no download.
• Bulk Background Remover (Batch, Full Resolution): The first run downloads the AI engine and a model from this site (about 19 MB for products, 27 MB with the people model); your photos are never uploaded.
• Business Card Maker (Print-Ready PDF): Downloads the card fonts from this site the first time you use them; your details never leave your device.
• Code Screenshot Generator: The syntax highlighter (Shiki, with a WebAssembly regex engine of about 470 KB) is downloaded from this site when the page opens, and each language grammar and theme the first time you pick it; your code is never uploaded.
• Cookie Consent Banner Generator: The live preview runs in an isolated frame loaded from mysmartcopilot-sandbox.pages.dev, a separate MySmartCoPilot address; your settings are handed to it inside your browser and never uploaded. Making and downloading the files works offline.
• cURL to Code Converter: The first conversion downloads the converter and its bash parser (about 360 KB compressed) from this site once; after that it works offline. Your command is never sent anywhere.
• Currency Converter: Downloads daily ECB reference exchange rates; the amounts you enter are never sent.
• Document to Text Converter: The converters (for ZIP, Word and Markdown) are downloaded from MySmartCoPilot the first time you convert a file; your documents never leave your device.
• Document Word Counter: PDF files need the PDF engine, downloaded from MySmartCoPilot once (about 0.5 MB); your documents are read on your device and never uploaded.
• Email Signature Generator: Only for your photo and logo: the preview loads them from the web addresses you enter, as your recipients’ email apps will. Nothing you type is sent to MySmartCoPilot.
• Extract Audio from Video: The audio engine (and, for MP3, the LAME encoder) downloads from MySmartCoPilot the first time you use it. Your videos are never uploaded.
• Food Nutrition Facts Lookup: Downloads the food tables from this site in small pieces as you search; what you type is matched on your device and never sent.
• Group Expense Splitter (Settle Up): Downloads the ECB reference exchange rates from this site when you add an amount in another currency. Your group, names and amounts are never sent.
• HSN & SAC Code Finder: The list of codes (about 260 KB) is downloaded from this site once the page has loaded. Your searches are matched on your device and never sent.
• HTML, CSS & JS Playground (Online Editor): The preview runs in an isolated frame loaded from mysmartcopilot-sandbox.pages.dev, a separate MySmartCoPilot address; your code is handed to it inside your browser and never uploaded. Libraries, images or APIs your own page loads come straight from the addresses it names.
• IFSC Code Finder & Validator: Downloads the branch list from this site in small parts as you search (one part per code you check, or the chosen bank’s branches). What you type is matched on your device and never sent.
• Image to Text (OCR): The first time you recognise text, the OCR engine and the data for the chosen language (about 7 MB for English; 5–7 MB for another language, or 8–10 MB together with English) are downloaded from this site. Your images are never uploaded.
• Inclusive Language Checker: Opening a PDF downloads the PDF engine and an English word list from MySmartCoPilot once; your text and files never leave your device.
• JavaScript & TypeScript Online Compiler: Your code runs in an isolated sandbox frame that is loaded from mysmartcopilot-sandbox.pages.dev, a separate MySmartCoPilot address; the code is handed to it inside your browser and never uploaded. Requests your own code makes (fetch) go straight from your browser to the addresses it uses.
• JSON to C# Class: The code generator (about 330 KB compressed) is downloaded from this site once, like the rest of the page; your JSON is never uploaded.
• JSON to Go Struct: The code generator (about 330 KB compressed) is downloaded from this site once, like the rest of the page; your JSON is never uploaded.
• JSON to Java Class (POJO): The code generator (about 330 KB compressed) is downloaded from this site once, like the rest of the page; your JSON is never uploaded.
• JSON to TypeScript: The code generator (about 330 KB compressed) is downloaded from this site once, like the rest of the page; your JSON is never uploaded.
• Life Expectancy Calculator (UN Life Tables): Downloads the UN life tables (about 170 KB) from MySmartCoPilot once; your age, sex and country stay in your browser.
• LLM Token Counter: The tokenizer you choose is downloaded once from MySmartCoPilot (0.4–3.3 MB); your text is never sent anywhere.
• Logo Maker: The font engine (about 320 KB) and each font you pick (up to about 45 KB) are downloaded from this site the first time they are needed, and the full icon list (about 150 KB) when you first search it. Your logo is made on your device; nothing is uploaded.
• M4A to MP3 Converter: The audio engine and the LAME MP3 encoder download from MySmartCoPilot the first time you use them (about 2.4 MB more for variable bitrate). Your files are never uploaded.
• MAC Address Lookup: Downloads the part of the IEEE registry a lookup needs from MySmartCoPilot’s own site; the addresses you enter never leave your browser.
• MP3 Cutter & Audio Trimmer: The audio engine (and, when you re-encode, the LAME MP3 or AAC encoder) downloads from MySmartCoPilot the first time you use it. Your audio is never uploaded.
• MP4 to MP3 Converter: The audio engine and the LAME MP3 encoder download from MySmartCoPilot the first time you use them (about 2.4 MB more for variable bitrate). Your videos are never uploaded.
• Object Remover (Magic Eraser): The first removal downloads the AI engine and the object-removal model (about 42 MB) from this site. Your photos are never uploaded.
• OCR PDF (Make Scanned PDFs Searchable): The first time you run OCR, the recognition engine and the data for the language you choose (about 5–7 MB, and 3 MB more to also recognise English) are downloaded from this site. Your files are never uploaded.
• Passive Voice & Writing Style Checker: Opening a PDF downloads the PDF engine and an English word list (for joining words hyphenated at line ends) once, about 0.7 MB; your files and text never leave your device.
• Passport & Exam Photo Studio (Batch for Studios and Cyber Cafés): The first photo downloads the face detector (about 16 MB) from this site, and a white background the portrait model (about 27 MB); customers’ photos are never uploaded.
• Passport & Visa Photo Maker: The first photo downloads the face detector (about 16 MB) from this site; replacing the background downloads a portrait model (about 27 MB) once. Your photos are never uploaded.
• Password Strength Checker: Only if you press Check breaches: the first 5 characters of the password’s SHA-1 hash — never the password — are sent to Have I Been Pwned’s Pwned Passwords API.
• PIN Code Finder (India Post): Downloads India Post’s directory from this site (about 1.1 MB in all) and keeps it, so searches also work offline afterwards. What you type is matched on your device and never sent.
• Python Online Compiler: The first time you press Run, Python itself (about 13.5 MB: the CPython interpreter and its standard library, compiled to WebAssembly) is downloaded from mysmartcopilot-sandbox.pages.dev, a separate MySmartCoPilot address; your browser keeps it for later visits. Your code, input and files are handed to it inside your browser and never uploaded.
• QR Code & Barcode Scanner: Browsers without a built-in barcode reader download the decoder (zxing-wasm, about 0.9 MB) from this site the first time it is needed. Pictures and camera frames are never uploaded.
• Redact PDF (Permanently Remove Sensitive Information): Only if you tick “Keep redacted pages searchable”: the text recognition engine and the language data (a few MB) are downloaded once from this site. Your file is never uploaded.
• Screen Recorder: The recording engine downloads from MySmartCoPilot when you start your first recording. Your recordings are never uploaded.
• Sentiment Analyzer: The VADER word list (about 140 KB) is downloaded from MySmartCoPilot the first time you analyse a text; opening a PDF downloads the PDF engine once. Your text never leaves your device.
• Signature Maker: Drawing works offline. The first time you use Type, the font engine (about 330 KB) and the five signature fonts (about 190 KB in all) are downloaded from this site. Your name and your signature never leave your device.
• Social Post Accessibility Checker: Downloads a dictionary (for hashtag suggestions) and emoji names from MySmartCoPilot the first time they are needed; your post is never sent anywhere.
• Spell Checker: The first time you check a language, its dictionary (0.2–1.4 MB) is downloaded from this site. Your text is never uploaded.
• SQLite Online (SQL Playground): The SQLite engine (about 650 KB of WebAssembly) is downloaded from this site the first time you open, import or run something; after that it also works offline. Your databases, files and queries are never uploaded.
• Syllable Counter & Haiku Checker: Downloads the pronunciation dictionary (about 340 KB, plus 500 KB for rare words) from MySmartCoPilot once; your text stays on your device.
• Text Behind Image: Finding the subject downloads an AI model from this site the first time (about 27 MB for people, 18 MB for tapped objects). Your photos are never uploaded.
• Text Similarity Checker: Opening a PDF downloads the PDF engine and an English word list from MySmartCoPilot once; your texts and files never leave your device.
• Text Splitter: Splitting by AI tokens downloads the tokenizer (about 1 MB) from this site once. Your text is never uploaded.
• Text Summarizer (Extractive): Opening a PDF downloads the PDF engine and an English word list from MySmartCoPilot once; your text and files never leave your device.
• TOTP / HOTP Code Generator: Codes, links and QR codes are made on your device. To read a QR image, browsers without a built-in QR reader download the decoder (zxing-wasm) from this site once. Secrets and pictures are never uploaded.
• Voice Recorder: Recording and WAV downloads work without a connection. The MP3, M4A and Opus encoders download from MySmartCoPilot the first time you export in those formats. Your recordings are never uploaded.
• Volume Booster (Audio & Video): The audio engine (and, when the file needs them, the MP3, AAC or FLAC encoder) downloads from MySmartCoPilot the first time you open a file. Your audio and video are never uploaded.
• WAV to MP3 Converter: The audio engine and the LAME MP3 encoder download from MySmartCoPilot the first time you use them (about 2.4 MB more for variable bitrate). Your recordings are never uploaded.
• Word Cloud Generator: The first time you use it, the stop-word lists (about 70 KB compressed) and the font you choose are downloaded from MySmartCoPilot. Your text, word lists and pictures never leave your device.
• World Clock: Only the optional “Is my clock right?” check uses the network: it sends six tiny header-only requests to this website and reads the time in the replies. They carry no cookies and nothing you typed.

Things you share with the installed MySmartCoPilot app from another app, and things you pass on to a tool from Smart paste on the home page, are handed over inside your browser. They are kept only until the page or tool you chose opens them: at most 60 seconds in the memory of the app’s service worker, and text or file names on their way to a tool until you close the tab at the latest. The tool then works with them like with anything you enter yourself. Only if the app’s service worker is not running when you share (for example right after you cleared this site’s data) does your browser send the share to our server, which neither reads nor keeps it (see Cookies & storage).

Two optional features send text to our server on purpose, because they cannot work otherwise: the AI helper of the Ask MySmartCoPilot tool finder and the Developer API. Both are described below.

What we collect

MySmartCoPilot has no visitor accounts and no sign-in. This is everything we collect.

Anonymous usage statistics

To learn which tools are useful and what people look for, your browser sends small batches of events to our server. An event contains only:

• its type: page viewed, tool started, result produced, tool error, search, search with no results, share, tool saved, app installed, click on an affiliate offer or click on another offer or a suggested link;
• the page or tool where it happened, for example json-formatter;
• for searches on MySmartCoPilot, including questions to Ask MySmartCoPilot, the search words; for clicks, the id of the offer or tool clicked.

Our server adds each event to a daily total, such as “json-formatter, page viewed, one day: 214”. It does not store individual events, IP addresses, browser or device details, cookies or any identifier, and never anything you entered into a tool. Search words are lower-cased and cut to 40 characters, and the server throws away any that look like an email address or contain a long number such as a phone number.

No events are sent at all if your browser sends a Global Privacy Control or Do Not Track signal, or while we have switched statistics off.

Messages you send us

When you use the contact form, we receive your email address, your name if you give one, the topic you choose and your message. They are stored in our database so that we can read your message in MySmartCoPilot’s private admin area, and we reply by email to the address you gave. Messages are deleted automatically 180 days after they were sent, or sooner if you ask. We never add your address to the newsletter or use it for anything else.

Newsletter sign-ups

If you subscribe, we store your email address, when you agreed, which form you used (for example the one at the bottom of every page) and which version of the sign-up wording you agreed to. We keep this until you unsubscribe. No newsletter emails are being sent yet. Before we start, we will name the email delivery provider in this policy, and every email will contain a link that removes your address straight away. You can also ask us to remove it at any time.

Protection against spam and abuse

The contact form and the newsletter form contain a hidden field that people never see (automated spam tools tend to fill it in), and the server rejects forms sent faster than a person could fill them in. Both are also limited per connection: 5 contact messages and 5 sign-up attempts an hour. The contact form also has a daily limit for the whole site.

To count per connection without keeping your IP address, our server calculates a keyed hash of the IP address together with the current date. The hash cannot be turned back into the IP address without our secret key, changes every day so it cannot connect your visits across days, and is deleted after 2 days. Other limits, for the statistics, the server-side tools and the Developer API, exist only briefly in server memory, apart from the monthly count of a Business licence key used with the Developer API (described below). MySmartCoPilot never stores your IP address.

Exchange rates

The currency converter asks our server for the euro reference rates published by the European Central Bank. Our server downloads them from the ECB and keeps a copy; your browser then does the conversion itself. The amounts and currencies you pick are never sent. The last rate table is kept in your browser so that the converter also works offline.

Your country

The country shown at the top of each page is worked out in your browser from your device’s time zone and language settings. Once, your browser also asks our server which country Cloudflare’s network sees your connection coming from; it does not ask if your browser does not let sites store data. Our server reads only that country and answers with its two-letter code; it keeps nothing and logs nothing. Your browser keeps the answer, your device’s time zone and any country you pick (tv-country-v1) until you clear it. You can change the country at any time, or let it be detected again with “Use my location”.

Ask MySmartCoPilot (tool finder)

Ask MySmartCoPilot suggests tools for a task you describe. When its AI helper is switched on, your browser sends the last few messages of the conversation (at most 6, each cut to 800 characters) to our server, which asks an AI model running on Cloudflare Workers AI to pick matching MySmartCoPilot tools. MySmartCoPilot does not store or log these messages, and Cloudflare says it does not use them to train AI models. Your IP address is used in server memory for rate limiting only. When the AI helper is off or unavailable, the finder works entirely in your browser. Please do not type personal or sensitive information into it.

The Developer API

Unlike the browser tools, requests to the public API at /tool-api/v1/ are processed on our server. The text you send is used only to produce the response and is neither stored nor logged. We keep daily request totals to watch our hosting limits, and your IP address is used in server memory for rate limiting only. If we issue you an API key, we store a hash of the key (never the whole key), its first few characters so that we can tell keys apart, the name it was issued under, its rate limit, when it was created and the last day it was used.

If you send the licence key of a Business pass as the API key, our server looks up the licence by the key’s hash, as described under Payments and licence keys, and counts the calls made with it per licence and calendar month: a number only, with nothing about the calls themselves. That count is deleted 2 days after the month ends.

Code playgrounds and runners

Code you write in the HTML playground, the JavaScript/TypeScript runner and the Python runner runs in your browser, on a separate MySmartCoPilot address (mysmartcopilot-sandbox.pages.dev, also hosted by Cloudflare Pages) that is isolated from the rest of the site. Your code and its input and output are not uploaded: they are passed to that frame inside your browser. Cloudflare serves the sandbox's files (the page, and the Python runtime of about 13.5 MB) and sees the usual request data (IP address, browser) as for any page. The sandbox sets no cookies and stores nothing. If your own code makes network requests, they go directly from your browser to the addresses your code uses.

Payments and licence keys

If you buy a pass, the payment is taken on the payment provider’s own page, under its own privacy policy: Razorpay for payments in rupees (privacy policy), Paddle or Dodo Payments for payments in US dollars (Paddle, Dodo Payments). The provider collects what it needs for the payment, such as your email address and payment details. MySmartCoPilot never sees or stores card numbers, UPI PINs or bank log-in details.

For each checkout you start, MySmartCoPilot stores an order record with:

• the order reference, the pass (plan and length), its price and currency;
• the payment provider and its references for this payment (for example a payment link, transaction, checkout or payment ID);
• the status (waiting, paid, being checked, refunded and so on) and when it was started, paid, collected and closed, a short note when a payment needs a manual check, and how often the payment status was checked;
• a hash of the one-time code your browser uses to collect the licence key, and a log of the provider’s notifications about the order (their type and what MySmartCoPilot did with them, not their content).

An order record holds no name, email address, postal address or IP address. The provider’s notifications and status answers can contain your email address and other details: MySmartCoPilot uses only what identifies the order and its payment (references, amount, currency, items and status) and does not store the rest. To limit abuse, the checkouts started from one connection are counted with the same keyed, daily-changing hash as the contact form, deleted after 2 days.

Your licence is stored as a hash of the key (never the whole key), its first 8 characters so that we can tell keys apart, its plan, when it was issued and when it ends, whether it was revoked, and the order it came from. A licence we issue by hand can also carry the email address it was issued to and a short private note. When you enter a licence key on this site, your browser checks it with our server then and about once a day afterwards, and again if a server-side tool reports that the key was not accepted; the server compares it with the stored hash and does not record the check.

Your browser also sends the key with each request to one of MySmartCoPilot’s server-side tools (such as the Redirect Checker), so that your pass’s higher limits apply. The server uses the key only to look up your plan: it keeps nothing about the check in its database or its logs, and never logs or stores the key. Only its memory holds, briefly, the plan it found (for a few minutes, under a hash of the key) and the count of your requests towards the pass’s hourly and daily limits (under an internal licence number). A Business key used with the Developer API is counted per month as described under The Developer API.

If MySmartCoPilot sells something through a hosted Razorpay payment page instead, Razorpay’s confirmation includes the email address you gave Razorpay, and we keep it with the payment ID, amount, currency, status and time.

We keep order, payment and licence records as long as accounting and tax rules require.

Voluntary contributions

When MySmartCoPilot accepts voluntary contributions, the support page shows a UPI ID with a QR code that your browser draws itself. A contribution goes from your UPI app straight to that account. MySmartCoPilot’s website takes no part in the payment and learns nothing about it; it only adds the use of the “Open in a UPI app” button to the anonymous daily totals. As with any UPI payment, the person who receives it can see the payer’s name and UPI ID, the amount and the payment note in their bank or UPI app. Other contribution links on that page lead to other websites, where their own privacy policies apply.

Storage in your browser

Some features remember things on your device using your browser’s local storage and session storage: your theme, saved and recently used tools, tool settings and what you build up in some tools (such as a calculator’s history), your privacy choices, a licence key, how often you used each Pro or Business tool free today, the currency you chose on the pricing page, a checkout you started in this tab until its licence key is collected, your Ask MySmartCoPilot conversation, what you pass on to a tool until it opens, the last exchange-rate table and a short-lived copy of the site settings.

Many tools also keep what you make in them, saved as you go, so that it is still there when you come back: for example invoice, quotation and other business document drafts with any payment details you typed, letters, payslips and certificates, rent receipts, a résumé or biodata, an email signature, an expense report, a budget or net-worth list, expense-splitting groups and bills, and, only if you choose to keep them, legal document drafts and a signature. A few tools keep larger things in your browser’s IndexedDB storage: Online Notepad notes, Voice Recorder recordings, the receipts attached to an expense report, a Period Tracker log, CSV Editor drafts, Graphic Design Editor designs, Pixel Art Maker drawings, a Labour Attendance Register, daily progress reports and site inspections.

What tools keep can include personal details, such as the tax and bank account numbers on a payslip or your health logs, and secrets, such as the tokens you save in the REST API Tester’s environments. None of it is encrypted, except a period log that you protect with a passphrase, so on a shared computer delete it when you are done. The Voice Recorder and the Online Notepad also ask your browser to keep this site’s data as persistent storage, so that recordings and notes are not deleted automatically when your device runs low on space. Your browser decides whether it agrees, and you can still delete everything yourself.

All of this is kept in your browser, and MySmartCoPilot’s code does not send it to us. The only exceptions are your licence key, which is checked with our server about once a day and sent with each request to a server-side tool so that your pass’s limits apply; the order reference and one-time code of a checkout you started, which your browser sends to our server, with any licence key it already holds, to collect your licence key after you pay; and the latest Ask MySmartCoPilot messages while its AI helper is on, as described above. Tools that work with other websites (listed above) use what you saved in them only with those websites, as their pages explain: for example, the PageSpeed Test sends a Google API key you chose to remember to Google with each test. When you save a tool, the statistics count that a tool was saved, not your list.

MySmartCoPilot itself sets no cookies. The Cookies & storage page lists every item and database we store, shows what your browser holds for MySmartCoPilot right now and lets you delete any of it, or all of it at once.

Other companies involved

Cloudflare (hosting)

MySmartCoPilot is hosted on Cloudflare Pages, and our database and server code also run on Cloudflare’s network. Like any web host, Cloudflare receives your IP address and technical details of each request, such as the address requested, your browser’s user agent and the time, so that it can deliver pages and protect the site from attacks. Cloudflare handles this data on our behalf as described in Cloudflare’s privacy policy. In rare cases Cloudflare may set a strictly necessary security cookie of its own, for example after checking that a visitor is not a bot (Cloudflare’s list of cookies).

Cloudflare Web Analytics (optional)

We may switch on Cloudflare Web Analytics to see page views and how quickly pages load. When it is on, your browser loads a small script from static.cloudflareinsights.com that reports to Cloudflare. It uses no cookies and no browser storage, and Cloudflare says it does not collect visitors’ personal data (about Web Analytics).

Google AdSense (advertising)

Some pages may show ads from Google AdSense; the advertising disclosure shows whether ads are on right now. If ads are switched on, Google and its partners may use cookies, web beacons and your IP address to show ads, limit how often you see the same ad, measure ad performance and detect fraud, and, where you allow it, to personalise ads based on your visits to this and other websites. Where the law requires consent (for example in the EEA, the UK and Switzerland), we will ask for it before advertising cookies are used, and you can change your choice at any time on the Cookies & storage page. A Global Privacy Control or Do Not Track signal from your browser counts as “reject” until you choose otherwise. You can turn off personalised ads in Google’s My Ad Center and read how Google uses information from sites that use its services. See also our advertising disclosure.

Affiliate partners

Affiliate links lead to other companies’ websites (see the affiliate disclosure). When you click one, our server adds one to that link’s anonymous daily click count and sends you on; it sets no cookie and records nothing about you. The company you visit may use cookies on its own site to note that you came from MySmartCoPilot, under its own privacy policy. Affiliate programs tell us how many clicks and orders came from MySmartCoPilot and what was earned, but not who you are.

Razorpay, Paddle and Dodo Payments (payments)

When you buy a pass, you pay on the provider’s own page. Razorpay processes payments in rupees for MySmartCoPilot. Paddle and Dodo Payments are merchants of record: they sell the pass to you, so they decide what they need to collect for the sale and for tax, under their own privacy policies (Paddle, Dodo Payments). MySmartCoPilot keeps only the order record described under Payments and licence keys.

Other websites

Tool pages link to official sources and other websites. When you visit them, their own privacy policies apply.

We do not sell or rent contact details, messages or newsletter addresses, and we do not share them with advertisers.

How we use information

• To answer you. Contact messages are used only to read and reply to them.
• To send the newsletter you asked for, once we start sending it.
• To improve MySmartCoPilot. Anonymous daily totals show which tools are used, where errors happen and which searches find nothing.
• To keep the site safe and within its free hosting limits. Spam protection, rate limits and daily request totals.
• To sell passes. Order and licence records are used to deliver your licence key, to apply your pass’s benefits and limits, to restore it if you lose it, to handle refunds and disputes, and for accounting and tax.

We do not build profiles of visitors or make automated decisions about you, and we never use what you enter into a tool, because we never receive it.

How long we keep it

Expired information is deleted by an automatic daily clean-up. After deletion, a copy can remain in our hosting provider’s automatic database history for up to 7 days before it is gone for good.

Your choices and rights

• See, correct or delete what we hold about you, such as your messages, newsletter subscription, licence or API key records: use the contact form with the topic “Privacy or data request” or email [email protected] . We may first reply to the address involved to confirm the request comes from you. We aim to complete requests within 30 days. Payment records may have to be kept for accounting and tax reasons; if so, we will tell you.
• Unsubscribe from the newsletter with the link in any newsletter email, or ask us to remove you.
• Change or withdraw consent to advertising cookies at any time on the Cookies & storage page.
• Stop usage statistics by turning on Global Privacy Control or Do Not Track in your browser.
• Delete browser storage on the Cookies & storage page or in your browser’s settings.

The anonymous statistics cannot be linked to you, so there is no “your data” in them to show or delete. Depending on where you live, you may also have the right to object to some uses of your data or to complain to a data protection authority. Please contact us first so that we can try to put things right.

Security

Every page is served over HTTPS with a strict Content-Security-Policy, and we keep as little information as possible. The admin area, where the operator reads messages, needs a secret token; the database can only be reached by our server code, and every query uses fixed statements with parameters. No system is perfectly secure, so please do not send passwords, card or bank numbers, ID numbers or other sensitive details through the contact form. To report a security problem, use the contact form with the topic “Privacy or data request” and please give us time to fix it before telling others.

Children

MySmartCoPilot is a general-audience website and is not directed at children under 13. We do not knowingly collect personal information from children. If you are under 18, please ask a parent or guardian before you send us your details. If you believe a child has sent us personal information, contact us and we will delete it. Passes are only for people aged 18 or over.

Where data is processed

Cloudflare runs MySmartCoPilot on its global network: your requests are handled by a data centre near you, and our database is kept in a Cloudflare location chosen by Cloudflare. This means information may be processed outside the country where you live.

Changes to this policy

We update this policy whenever what we do changes, for example before we start sending newsletters, show ads or accept payments. The “Last updated” date at the top shows the current version. If a change affects information we already hold, we will explain it clearly on this page.

Contact

For anything about privacy, use the contact form with the topic “Privacy or data request” or email [email protected] .