EncryptCodecPrivacy Policy
Last updated: August 2026
1. Introduction
EncryptCodec ("we", "us", or "our") operates encryptcodec.com. The site has two parts: a free, browser-based security learning platform — interactive attack simulations, scored educational games, cryptography and developer tools, and a blog — and a small set of studio pages where you can read about our software work and contact us. The site is a static website. It has no user accounts, no login, and no application backend. Because of that, it collects very little data. This policy explains exactly what is involved and the choices you have. By using the site, you agree to the practices described here.
2. How the site works — and why it collects so little
No accounts. You do not sign up, log in, or give us a password to use anything on the site. Every simulation, game, and tool is free and open. Browser tools run entirely on your device. Tools like AES encryption, hashing, JWT decoding, key generation, TOTP, and the formatters use the Web Crypto API and JavaScript in your browser. Anything you type into a tool — plaintext, keys, passwords you are testing, tokens, JSON — is processed on your device and is never sent to us. We operate no server that could receive, read, or log it. Closing or refreshing the tab clears the tool's state, and you can verify this in your browser's developer tools (Network tab). Simulations and games run in your browser against fictional, locally generated data. Your scores, streaks, and progress are saved in your browser's local storage, on your device only — they are not sent to us. A few tools call third-party public APIs directly from your browser (never through a server of ours). Those requests go straight from you to the provider and are subject to the provider's own privacy policy: • Password Breach Checker — Have I Been Pwned (haveibeenpwned.com), using k-anonymity: only the first five characters of your password's SHA-1 hash are sent, so your full password never leaves your browser. • DNS Lookup — Google Public DNS (dns.google): the domain name you look up is sent. • WHOIS Lookup — RDAP servers (rdap.org): the domain name you look up is sent. • Site Auditor — Google PageSpeed Insights (googleapis.com): the URL you audit is sent.
3. Information we collect
Because there are no accounts, we do not collect names, passwords, or profiles in order to let you use the site. The only data involved is: • Analytics. If you consent, we use Google Analytics to understand aggregate, anonymous usage — which pages are viewed and general interactions. This uses cookies and collects standard analytics data (a random identifier, approximate location, and device/browser information). You can decline this in the cookie banner and through your browser settings. • Contact form. On our studio pages you can submit an enquiry form. The details you choose to provide — such as your name, company, email, phone number, and message — are emailed to us so that we can respond. We use this only to reply to and manage your enquiry. • Hosting logs. The site is served by our hosting and content-delivery provider (Amazon Web Services). Like any website host, it may record standard request logs (such as IP address, timestamp, and user agent) for security and reliability. We do not sell your data and we do not build advertising profiles.
4. How we use information
• To respond to and manage enquiries you send through the contact form. • To understand and improve the site in aggregate, through analytics. • To keep the site secure and reliable, through standard hosting logs. We do not use your information for any other purpose, and we do not share it except with the service providers named in this policy who help operate the site.
5. Cookies, consent, and local storage
Cookies. The only cookies of note are Google Analytics cookies, and they are set only if you consent through the banner shown on your first visit. If you decline, no analytics cookies are set. Local storage. We use your browser's local storage to remember your theme preference (light or dark) and your game and simulation progress. This stays on your device and is not transmitted to us. Clearing your browser's site data removes it.
6. Third-party services
We rely on a small number of third parties to operate the site. Each has its own privacy policy: • Google Analytics — anonymous, aggregate usage analytics (only with your consent). • Amazon Web Services (AWS) — static hosting and content delivery, and delivery of contact-form emails. • The tool APIs named in section 2 — Have I Been Pwned, Google Public DNS, RDAP, and Google PageSpeed Insights — which are called directly from your browser only when you use the corresponding tool. When one of the browser tools calls a third-party API, that request is between your browser and the provider; we neither proxy nor log it.
7. Data retention
• Contact-form emails are retained in our inbox for as long as needed to handle your enquiry and keep reasonable business records. • Analytics data is retained according to Google Analytics' configured retention settings. • Local storage on your device is retained until you clear it.
8. Data security
The site is served over HTTPS. Because there are no accounts and no stored passwords, there is no login or credential database that could be breached. Contact-form submissions are transmitted over encrypted connections and delivered to our email by our provider. No method of transmission or storage is perfectly secure, but the site is designed to hold as little of your data as possible.
9. Your rights and choices
• Analytics: decline through the cookie banner, or use your browser's or an extension's controls to opt out. • Local data: clear your browser's site data at any time to remove your saved progress and preferences. • Contact data: to access, correct, or delete an enquiry you sent us, email encrypt.codec@gmail.com and we will act on your request. Where the GDPR, UK GDPR, or similar laws apply to you, our lawful bases for the limited processing we do are: your consent, for analytics cookies; and our legitimate interests, in keeping the site secure (hosting logs) and in responding to enquiries you send us. You may have the right to access, correct, delete, port, or object to the processing of your personal data, to withdraw consent at any time, and to lodge a complaint with your local data-protection authority. To exercise any of these rights, or for any data-protection question, email encrypt.codec@gmail.com and we will respond.
10. Children's privacy
The site is intended for a general, developer audience and is not directed at children. We do not knowingly collect personal information from children. If you believe a child has provided us information through the contact form, contact us and we will delete it.
11. Links to other sites
The site and its blog link to third-party websites and resources. We are not responsible for the content or privacy practices of those sites; their own policies apply when you visit them.
12. International users
The site can be accessed from anywhere, and we operate from India. If you use the site from outside India, be aware that the limited data involved — analytics data, hosting logs, and contact-form emails — may be transferred to and processed in India, the United States (where our analytics and hosting providers operate), or other countries where those providers run infrastructure. Data-protection laws in those countries may differ from the laws where you live. Where such transfers require safeguards, we rely on the mechanisms our providers put in place — for example, the standard contractual clauses used by Google and Amazon Web Services. By using the site or contacting us, you understand that your information may be processed in these locations.
13. Changes to this policy
We may update this Privacy Policy as the site evolves or as legal requirements change. We will update the "Last updated" date at the top of this page. Continued use of the site after changes are posted constitutes acceptance of the revised policy.
14. Contact us
If you have any questions about this Privacy Policy or your data, email us at encrypt.codec@gmail.com.