Privacy Policy

Effective September 3, 2026 · Operator: Tuxxin LLC, State of Florida, USA.

The short version

Operator: Tuxxin LLC, State of Florida, USA. Questions or data requests: /contact.

curlhub is developer tools you run with curl. Most of them take your input, do one thing, and hand the result straight back — nothing saved. A few features (pastes, files, request hooks) hold your data on purpose, but only until they expire. Here's the honest one-liner for each part:

• Most tools keep nothing. uuid, hash, jwt-decode, json, ssl and the rest process your input inside the request and return it. It isn't stored.
• What you save on purpose is temporary. A /p paste, a /u file, or a /hook inbox lives until its TTL (a /u file also vanishes on first download), then it's purged. While it exists, it really is stored — we don't pretend otherwise. A purge job clears expired data every 5 minutes, so never make curlhub your only copy.
• No ad networks, no cross-site tracking, no data sale. Any advertising here is our own and sets no cookies — there is no ad network, no ad exchange, and no data broker. Analytics are cookieless and aggregate (Cloudflare Web Analytics, our self-hosted Umami, and — only if you accept it — Google Analytics 4, pinned to a cookieless mode). Command-line and API requests are counted too, but only the endpoint and a type tag — never your query string, body, or any paste/file/hook id. We don't claim "zero tracking" — cookieless analytics and ordinary server logs still exist.
• IPs are logged by infrastructure. Cloudflare and our web server keep standard access logs that record IPs, like any website. For rate limiting we store a salted hash of your IP, never the raw address.
• No account needed. An optional email-tier login exists only if you want to vote, comment, or edit the wiki from the CLI.

The rest of this page is the detail behind each line. By using curlhub you also agree to our Terms of Service.

Who we are and what this covers

curlhub.sh (the "Site") is built and operated by Tuxxin LLC ("we," "us"), a limited liability company organized in the State of Florida, USA (Tuxxin.com). This policy covers the Site, the tools, the optional CLI, and the optional email-tier account. It doesn't cover third-party sites we link to (for example GitHub, or other Tuxxin properties), which have their own policies. Anything about your data — a question or a request — goes through our contact form at /contact, which opens a helpdesk ticket.

The tools: what we process and what we keep

Most curlhub tools are pure transforms: you send input, the server computes an answer in the same request and returns it. Nothing is written to a database or log for later. This covers uuid, pass, hash, b64, md, json, jwt, ssl, cron, cidr, qr, status and the like.

A few tools work with your own request metadata:

• /ip, /headers, /ua exist to show you your own request — your public IP, the headers your client sent, your user-agent. That's computed during the request and reflected back to you; it isn't stored.
• /whois looks up a domain and caches the domain's public record server-side for a limited time (a TTL, then purged) so repeat lookups are fast. That cache holds domain data, not anything about you.

Things you save on purpose — and when they disappear

Some features exist to hold data briefly — but only if you create one; nothing is saved otherwise:

• /p (paste): the text you paste is stored until its time-to-live (TTL) expires, then purged.
• /u (file): the file you upload is stored until its TTL or its first download — whichever comes first — after which the file is unlinked and its database row deleted.
• /hook (webhook inbox): a hook captures the HTTP requests sent to it so you can inspect them — the request headers, the body, and the IP address of whoever calls it (for example via Cf-Connecting-Ip or X-Forwarded-For). That caller may be you, or a third party you point at it. Captured requests are held until the hook's TTL, then purged.

To be clear: while any of these exists, your data is genuinely stored — we won't tell you they keep "nothing." What we guarantee is that they're ephemeral. A purge job runs every 5 minutes and removes anything past its expiry, and data may be deleted at any time. So we make no durability promise: never let /p, /u, or /hook be your only copy. And if you use /hook, remember it records the IP addresses of the systems that call it.

Optional accounts (email tier)

You don't need an account to use the tools. If you log in from the CLI — to vote on, comment on, or edit the wiki — we process the minimum needed to verify you and attribute your contributions:

• email_verifications: your email address and a one-time token, kept up to 24 hours.
• api_tokens: the token that authenticates your CLI, kept until it expires or, if you revoke it, up to 30 days after revocation.
• sessions: cleared 1 day after revocation, 90 days after creation, or 14 days idle — whichever comes first.

We use this only to gate wiki write actions and attribute them to you. You can ask us to delete your account and its data at any time via /contact.

IP addresses and security logging (the honest version)

We won't claim your IP address is invisible to us. Here's exactly how it's handled:

• Infrastructure logs. Cloudflare sits in front of the Site as CDN and firewall, and our web server (Apache) keeps standard access logs. Both record IP addresses as normal infrastructure — the same as essentially every website. We do not and cannot claim your IP is never logged.
• Rate limiting. To curb abuse we bucket requests by an HMAC-SHA256 hash of your IP (ip_hash) computed with a secret salt. The raw IP is never stored for this, and the rate-limit rows expire after roughly one day.
• Security events. When a CSRF check fails, we log the event with the client IP as a security audit trail. Our application logs are otherwise operational and are designed not to record raw IPs or payloads in general — but security events are the deliberate exception.

We keep these logs to operate the Site, prevent abuse, and investigate incidents — our legitimate interest as the operator. For ordinary rate limiting we use a salted hash, not the raw address; raw IPs appear in infrastructure and specific security logs.

Cookies and local storage

We keep client-side storage to a functional minimum:

• PHPSESSID (session cookie): set on every request, including plain curl ones — the app opens a PHP session before it decides whether you're getting HTML or text, so CSRF-protected forms and the optional login work the moment you reach them. (Nothing in the CLI flow needs it; curl simply discards it unless you asked for a cookie jar.) Strictly functional: a random session ID used to protect forms and keep you signed in. It is not an advertising or tracking cookie, carries no profile, and expires when you close the browser.
• Theme preference: your light/dark choice is stored in your browser's localStorage and is never sent to our servers.
• Analytics beacons (Cloudflare Web Analytics, self-hosted Umami, Google Analytics 4): cookieless — none of the three sets a cookie. The first two never had one; GA4 normally does, so we deliberately run it with storage switched off (see Analytics).

None of this needs a cookie banner: the analytics are cookieless, our advertising sets no cookies, and functional cookies like PHPSESSID are exempt. There are no advertising or cross-site tracking cookies to consent to.

You will still see a short analytics prompt on your first visit. It is not a cookie notice — it asks before loading Google Analytics, because loading it sends your IP address to Google (see Analytics). Decline and it never loads. Your answer is remembered in your browser's localStorage, not in a cookie, and you can change it any time from the Analytics link in the site footer.

Analytics

We use three analytics tools, and all three run without cookies:

• Cloudflare Web Analytics — aggregate and cookieless, collected by a small beacon script Cloudflare adds to the browser page.
• Umami — self-hosted by Tuxxin at analytics.tuxxin.com; cookieless. Each page view sends the page URL (including any query string), the referrer, the page title, your screen size and browser language, and — as with any request — your IP address and user-agent reach the server. It stores no identifier in your browser and builds no cross-site profile. Note it runs on a separate domain, so your browser treats it as a cross-site request; it goes to the same operator as curlhub, not to another company, but calling it "first-party" would be wrong.
• Google Analytics 4 — added September 2026, and opt-in: it does not load at all unless you accept the analytics prompt. GA4 ordinarily sets _ga cookies; ours does not. We load it with Google Consent Mode v2 defaulting to denied for every storage category, and with client storage set to none, so it saves no identifier in your browser and falls back to cookieless pings. Google Signals and ad personalization are both off.

Because GA4 is the piece that changed, here are its trade-offs plainly:

• It is a third party. Unlike Umami, the ping goes to Google, and Google sees your IP address, the page URL, the referrer, and your user-agent for that request — the same things any server you connect to sees. That disclosure to Google is precisely what we ask consent for, and it is why GA4 stays off until you say yes. Being cookieless does not make it exempt.
• It cannot recognise you again. With no stored identifier, GA4 can't tell a returning visitor from a new one. Page views and traffic sources are real counts; "users" and "sessions" in our reports are modelled estimates. We took the worse numbers to keep the no-cookie promise.

Only GA4 is gated. Cloudflare Web Analytics and Umami are not: they are cookieless, and they report to us or to the CDN already delivering the page rather than to another company, so we run them as a legitimate interest in operating the Site. GA4 is the one that hands data to an outside company, so it is the one that waits for your permission. If you decline, Google receives nothing from your visit.

All three of those are page scripts, so they run only on the browser pages and never see a curl request. Command-line and API usage is measured separately, and much more narrowly — see Command-line and API usage below. We use no ad networks, no cross-site trackers, and we do not sell or share your personal data for advertising. We're deliberate about the wording: no ad networks, no cross-site tracking, and no data sale — not "no tracking at all," because these cookieless analytics and ordinary server logs do exist (see above).

Command-line and API usage

From September 2026 we also count curl, CLI and API requests. A browser page script cannot see those, so this one happens on our server: when a non-browser request finishes, we send a small event to our own Umami — the same self-hosted instance, but a separate site, so command-line numbers never mix into the browser ones.

What the event contains:

• The endpoint you hit — /uuid, /hash, /mcp — and nothing deeper.
• A coarse type tag: json, cli, mcp, or text.
• The HTTP method, your IP address, and your user-agent.

What it never contains. This is the half that matters:

• No query string. On this Site the query string is usually your data — /hash?text=..., /json?data=... — so it is dropped entirely rather than trimmed.
• No request body. Nothing you POST, pipe, or upload is included.
• No paste, file, or hook ids. The ids in /p/..., /u/... and /hook/... are the secret — anyone holding one can read that paste or download that file — so they are replaced with a placeholder before the event is built.

It sets no cookie and stores no identifier: there is no browser involved to store one in. It is sent after your response has already gone out, so it cannot slow a request down or cause one to fail.

Opting out. We can't show a consent prompt to curl, so unlike Google Analytics this runs on our legitimate interest in knowing which tools people actually use — with an opt-out any script can set. Send DNT: 1 or X-Curlhub-No-Track: 1 with your request (for example, curl -H 'DNT: 1' curlhub.sh/uuid) and nothing is recorded for it. The tool answers exactly the same either way.

Advertising

Any advertising on curlhub is our own: served by us, from our own servers. It sets no cookies, and there is no third-party ad network, ad exchange, or data broker involved — no outside party is invited onto the page to watch you.

Ads appear only on the browser pages. They never appear in curl, CLI, or API output, so a piped or scripted response stays exactly as documented. Nothing you send a tool is used to target it. Your requests, pastes, files, hook payloads, and account details play no part in what an ad says, and we build no advertising profile of you. We do not process your personal data for cross-context behavioral advertising, and we do not sell it.

The contact form

When you write to us through /contact, you submit your name, email address, and message. That becomes a support ticket in HESK, a helpdesk system operated by Tuxxin.

To help us answer and to spot abuse, each ticket gets a "Sender details" footer: your IP address is looked up through worldip.io (Tuxxin's own, keyless IP-intelligence service) to add country, network, PTR, and CIDR context, along with the request headers you sent. curlhub itself doesn't keep the raw IP from this form — but it lives inside the resulting HESK ticket, which is a Tuxxin system. Use /contact for support and requests; don't send sensitive personal data you wouldn't want in a support ticket.

Sub-processors and third parties

We share data with a small set of providers, only as needed to run the Site:

We do not sell personal data to anyone.

Your rights and how to use them

You can ask us to access, correct, or delete the personal data we hold about you. Because most curlhub data is ephemeral and self-expiring, there's usually little to act on — but email-tier accounts can be deleted on request, and we'll handle other requests in line with applicable law.

We aim to honor the rights granted by laws such as the Florida Digital Bill of Rights, the EU/UK GDPR, and the California Consumer Privacy Act (CCPA), to the extent they apply to you. In particular, we do not sell your personal data and do not process it for cross-context behavioral advertising. To make a request, use /contact and tell us what you need. We don't yet publish a dedicated privacy email address — the contact form is the right route for now (see Changes and contact).

Where data is processed

Tuxxin LLC operates from the United States, and our providers (including Cloudflare's global edge) may process data in the US and other countries. If you access the Site from outside the US, your data may be processed in the US and elsewhere by the providers listed above.

Children

curlhub is a developer tool and isn't directed at children. It isn't intended for anyone under 13, and we don't knowingly collect personal data from children under 13. If you believe a child has given us personal data, contact us via /contact and we'll delete it.

Changes and contact

If we change this policy, we'll update the effective date at the top of this page and describe material changes in plain language here rather than burying them. Continuing to use the Site after a change means you accept the updated policy.

September 3, 2026 — what changed. We began counting command-line and API requests (see Command-line and API usage), which browser analytics never saw. It records the endpoint and a type tag only — never your query string, request body, or any paste/file/hook id — sets no cookie, and can be switched off per request with DNT: 1. We also began showing our own ads on the browser pages; they never appear in curl or API output. /terms gained a matching advertising clause.

September 2, 2026 — what changed. We added Google Analytics 4 and disclosed Google as a sub-processor. It is configured cookieless (Consent Mode v2 denied across the board, no client-side storage), so no cookie was added. Because loading it still sends your IP to Google, GA4 is opt-in: a short analytics prompt now appears on a first visit, GA4 loads only if you accept, and you can change your answer from the Analytics link in the footer. Cloudflare Web Analytics and Umami are unaffected and continue to run. We also replaced the blanket phrase "no ads" with the accurate one: curlhub may show our own cookieless ads, and still uses no ad network and no cross-site tracking.

For anything on this page — a question, a correction, or a data request — reach us through /contact, which opens a helpdesk ticket. Operator: Tuxxin LLC, State of Florida, USA.