Privacy
Last updated: 4 September 2026.
Your drafts stay in the tab
Nothing typed into a tool on OnPageKit is uploaded, and the reason is architectural rather than a promise. This domain serves pre-built files, and no tool on it has any counterpart running elsewhere. When you fill in a meta tag form or paste a block of markup for checking, the whole operation — parsing, counting, assembling the output — happens in that tab. A URL you enter is not fetched from our end either, so an unlaunched or password-protected site can be worked on here safely.
One endpoint on this domain does run server-side, and it is set out in full immediately below. It belongs to the two feedback forms, it is idle unless you press one of their send buttons, and no tool touches it.
The two forms
The bug report at Report a bug and the request at Suggest a tool are the sole route by which anything leaves your browser here. They fire once, on submission. Typing in them sends nothing; abandoning them sends nothing.
Submitted, they carry:
- whatever you wrote in the fields — a bug carries the tool you picked, the steps, the expected result and the actual one; a request carries the missing tool, the problem behind it and a link if you added one;
- an email address if, and only if, you decided to enter one. It is optional throughout, and omitting it costs you nothing except the possibility of a reply;
- the URL of the page the form was opened from, plus the user agent string your browser hands to every server it speaks to. The form displays both to you before submission, since a defect report missing the browser is usually impossible to reproduce, and asking outright beats collecting in the background.
From the endpoint the submission becomes an email to whoever maintains OnPageKit, routed through an Amazon Web Services queue and a mail provider. No database records it; the queue keeps it only long enough to hand it over. Afterwards it exists as one message in a mailbox, treated like any other letter. Any address you supplied serves to reply to you — it joins no list and is disclosed to nobody.
Storage on your device
A couple of preferences are kept in localStorage, which belongs to your browser rather than to us. Nothing there is sent anywhere, and wiping site data in your browser settings deletes it for good.
theme— whether you picked the light or dark palette, read before the first paint so the page does not flash the wrong colours at you.analytics-consent— what you told the measurement banner, kept so it is not shown again. Remove the value and you will be asked afresh.
Our promos are drawn at random each time a page loads, so nothing about them is written to your device.
Cookies are not used anywhere on this site, with one exception: Google Analytics writes its own once you have allowed it.
Share buttons
Each generator ends with a row of share controls: copy the address, or hand it to LinkedIn, X, WhatsApp or Facebook. These are plain links to the networks’ own share pages, opened in a new tab only when pressed. We embed none of their scripts, so no network is told you were here until you finish the share yourself. Copying the link touches your clipboard and nothing further.
About the panels promoting our own work
OnPageKit carries no third-party advertising. The panels you see are ours, and they lead to Revin, the consultancy that pays for this site to exist. We label them with rel="sponsored" — declaring a commercial link is exactly the sort of on-page detail this kit is about, and it would be a poor look to skip it here. The creative is a static file served from this domain: no ad network, no tracking pixel, no cookie, no audience segment.
Each of those links ends in UTM parameters — utm_source, utm_medium and utm_campaign. Their entire job is to tell Revin which site the visit came from, at the level of a total. They contain no identifier for you, and deleting them from the URL takes you to the same page.
Where this site is hosted
Vercel serves these files. Any host sees the requests it answers, and Vercel may keep ordinary access logs containing things like an IP address and a browser user agent, used for delivering the site, protecting it from abuse and producing aggregate traffic counts. We do not receive per-visitor logs and cannot tie a request to a person. For retention periods and the legal detail, Vercel publishes its own privacy notice.
On top of those logs, Vercel Web Analytics tallies page views for this site. The measurement script loads from our own address, never sets a cookie or a stored identifier, and reports totals rather than people: pages, countries, device types. That is why it is not behind the analytics banner, and it has no access to the text inside any generator or checker.
Google Analytics
Page views are measured with Google Analytics on this site. Because it writes cookies and passes data to Google, UK PECR rules mean it may only load after you have agreed to it, and until then the script does not run. The measurement covers which pages were opened. The content of a form or a text area on this site is never included in it, and consent can be taken back by clearing the data this site holds in your browser.
The banner sits at the foot of the screen with two buttons of the same size, one to allow and one to decline, and it never blocks the tool behind it. Decline, and no request to Google is ever made from this site. Allow, and the events sent describe which generator was used, which promo was clicked or which share button was pressed — the contents of what you typed stay out of them.
UK GDPR and what you can ask for
The law gives you the right to request a copy of your personal data, to correct it and to have it deleted. For ordinary use of this site the request resolves to an empty set: no accounts, no analytics profile and no server-side storage, so there is no file bearing your name to produce or to erase. The exception is a form you chose to submit with your address on it. That message lives in a mailbox and can be deleted on request — submit the request through the bug form, mentioning the address you wrote from so the message can be located. Anything you have sent to Revin through their own channels falls under the notice published there.
Getting in touch
No email address appears anywhere on this site, and that is a decision rather than an oversight: a published address is a scraped address. Anything you want to raise about this policy can travel through the bug form, which lands with the same person, or via Revin.