Privacy Policy

This page explains what personal information the codeshack.io website collects, why we collect it, who it is shared with, and how long it is kept. A separate section near the end covers our browser extension.

Last updated: October 9, 2026.

Who we are

The codeshack.io website is run by CodeShack, which decides how and why the personal information described on this page is used. If you have a question about this policy or about your information, email support@codeshack.io.

Information Collection and Use

Most of the site can be used without giving us anything. The tutorials, tools, snippets and reference pages need no account, and we do not ask you to identify yourself to read or use them.

You give us personal information when you do one of the things below, and each one has its own section.

• Create an account or sign in.
• Buy a package or a Pro membership.
• Download a file, ask to hear about download updates, or join the newsletter.
• Save text with the Online Clipboard.
• Ask one of the HTML tools to fetch a web page.
• Post a comment.
• Send us a message with the contact form.

Every visit also involves some technical information, such as your IP address, which the Log Data section covers. The cookie, analytics and advertising sections describe what our partners collect.

If you create an account

We store your email address, a password that is hashed and never held in a form we can read, and a name if you give us one. The name is optional and is only used to say hello.

If you sign in with Google, X or Facebook instead, we store the identifier that provider gives us, along with the name and email address it hands over. We never see your password for those services. X does not give out email addresses at all, so accounts created that way get a reserved placeholder and we ask you for a real address in your account settings.

We record the time and IP address of your most recent sign-in. That IP address is cleared 30 days after the sign-in.

We record the packages you download as a member, along with the date and the IP address that made the request. This is how we spot an account being shared or used to bulk grab files.

To keep you signed in we store a token for each device you choose to be remembered on, along with that device's IP address and browser user agent. Signing out of a device removes its record.

If you buy something

Pro memberships are billed through Stripe. Packages can be paid for through Stripe or PayPal, and you do not need an account to buy one. Card and PayPal account details go straight to Stripe or PayPal and never reach our servers.

For every payment we keep a record of the transaction. It includes the item, the amount, the date, the name and email address of the person who paid, and their country. When you pay with PayPal, PayPal also sends us the postal address on your PayPal account, and we keep that with the record. For a package, we use your email address to send your receipt and your download link.

For a Pro membership we also store the customer and subscription identifiers Stripe gives us, the state of your membership, and a log of the billing events Stripe sends so we can keep your access in step with your payments.

When a package download link is used, we record the IP address that used it, so we can spot a link that is being shared. That IP address is cleared after 7 days.

We are required to keep payment records for tax, so they are not deleted when an account is.

If you download a file, ask about updates, or join the newsletter

Free downloads need no email address. When you download one, we record the IP address that made the request so we can stop one connection from taking hundreds of files an hour. The limit only looks at the last hour, and the IP address is cleared after 7 days.

On a download page you can leave your email address to hear when that download is updated. We store the address, which download it was for, and the IP address the request came from. The IP address is used only to limit repeated requests and is cleared after 7 days. This does not add you to the newsletter.

You can join the newsletter when you create an account, in your account settings, or with the sign-up form in the sidebar of some pages. We store your email address. If you opt out, we keep the address marked as unsubscribed so that it is never emailed unless you opt in again. The Marketing email section below explains how to opt out.

If you joined the waiting list before Pro launched, we still hold the email address you gave. Email us if you would like it removed.

If you use the Online Clipboard

The Online Clipboard stores the text you paste on our server, so you can open it on another device with a PIN. You can save up to 500,000 characters and choose to keep the text for 1 hour, 1 day, 7 days or 30 days. When that time runs out the text can no longer be opened, and it is deleted within a day. If you choose to have it deleted after reading, it is removed the first time it is opened. Anyone who has the PIN can read the text, so do not use it for passwords or other secrets.

To limit abuse we keep a small record of recent clipboard activity from your IP address. It is filed under a hashed form of the address, holds only times and counts, and is deleted after 2 days without activity.

If you fetch a page with the HTML tools

The HTML Viewer, HTML Formatter, HTML Minifier, HTML Validator and Source Code Viewer can load a page from a web address you enter. The address goes to our server and then to a separate server we use to fetch pages, which downloads the page and sends it back to your browser. The site you asked for sees that server's IP address, not yours. We use the address only to fetch the page. These tools set a session cookie so they can limit how often one browser fetches a page.

If you post a comment

Comments on tutorials are posted under a display name you type in, or as "Guest" if you leave it blank. We do not ask for your email address, and we do not store your IP address with a comment. We store the name, the comment and the date, and we receive each new comment by email so we can moderate it. Approved comments are public.

Comments are kept separately from site accounts, so deleting your account does not remove them. If you want a comment taken down, email us with the page and the comment.

If you contact us

The contact form sends us your name, your email address, the topic you picked, the page address if you add one, and your message, all by email. We use them only to reply to you. If your message is about a package, we look up your email address in our order records so we know which license you hold.

We also log the IP address the message came from, so we can limit how many messages one connection sends in an hour. That IP address is cleared after 30 days.

Security logging

We record failed and successful sign-in attempts with the email address used and the IP address they came from. This is how sign-in throttling works, and it is the only thing that stops someone guessing passwords in bulk.

Why we are allowed to use your information

UK data protection law requires a legal basis for each use of personal information. These are the ones we rely on.

• Contract: running your account and your Pro membership, processing purchases, delivering downloads, sending receipts and password reset emails, and providing features you choose to use, such as the Online Clipboard and page fetching.
• Legitimate interests: keeping the site secure and working, which covers sign-in throttling, rate limits, spotting shared download links and request logs. It also covers replying to your messages and moderating comments.
• Consent: advertising and analytics cookies, which you control in the consent banner, and the newsletter and download update emails. You can withdraw your consent at any time.
• Legal obligation: keeping payment records for tax.

How long we keep things

We keep personal information only as long as we need it for the reasons on this page. An automatic job runs every day and deletes or clears anything past these limits. Where a record is also used for counting, such as how often a file was downloaded, the record stays after its IP address is cleared.

• Sign-in attempts including their IP addresses, 2 days.
• Password reset links, 1 hour to use, deleted a day after they expire.
• Remembered devices including their IP and user agent, until you sign that device out, or 60 days without use.
• The IP address of your last sign-in, 30 days.
• Pro download records including their IP addresses, 90 days.
• IP addresses behind package downloads, free downloads and download update requests, 7 days.
• The IP address behind a contact form message, 30 days.
• Online Clipboard text, until the time you chose runs out, which is never more than 30 days, or until it is first read if you chose that.
• Clipboard abuse records, 2 days after the last activity.
• Billing event logs from Stripe, 12 months.
• Newsletter and download update sign-ups, until you opt out or ask us to remove them.
• Comments, until you ask us to remove them.
• Your account, until you delete it.
• Payment records, kept as long as tax law requires.

Deleting your account

You can delete your account yourself, from the settings page in your account. You do not have to email anyone or ask permission.

Nothing is erased straight away. There is a 30 day wait so that a deletion made by mistake, or by somebody who got into your account, can be undone. Sign in during those 30 days and you can stop it. After that your details, sign-in methods, remembered devices, download history, sign-in attempts, and any newsletter or download update sign-ups on that address are erased and cannot be recovered.

Records of payments are kept, as described above. Comments are not linked to your account, so they stay unless you ask us to remove them. Anything you downloaded before deleting stays licensed to you.

Marketing email

We only email you about new packages and tools if you ask us to, and the box is unticked by default. No newsletter has been sent from this site yet. If we send one, every email will include a link to unsubscribe. You can also opt out at any time by unticking the box in your account settings or by emailing support@codeshack.io. We do not sell or share your address.

Email about something you bought, a password reset, or the state of your membership is not marketing and is sent whether or not you opted in.

Advertising and Pro memberships

The free site is paid for by advertising, which is described further down this page.

If you have an active Pro membership, the advertising scripts are not loaded at all. Not hidden, not blocked, simply never requested. That means the ad network, its partners and the consent banner that loads with them receive nothing about your visits while your membership is active. Google Analytics, described under Cookies, still counts visits from Pro members.

Log Data

Every request to the site passes through Cloudflare, which delivers our pages and protects the site from attacks, before it reaches our web server. Both receive the details any browser sends with a request, such as your IP address, browser type, the page you asked for and the time, and they may keep them in logs. We use these logs to keep the site running and to protect it from abuse.

Some tool pages load open-source code or fonts from public services such as cdnjs, jsDelivr, unpkg and Google Fonts. Your browser requests those files directly, so those services receive your IP address and browser details in the same way.

Cookies

A cookie is a small text file that a website saves on your computer or phone. This section lists the cookies our own code sets, then explains the consent banner, analytics and advertising.

Cookies the site cannot work without

Most of these are set only when you use the feature they belong to.

• A session cookie, set when you open the sign-in, registration or password reset pages, when you sign in with Google, X or Facebook, and when you fetch a page with the HTML tools. It keeps you signed in, protects forms from forgery, and limits how often a page can be fetched. It goes when you close your browser.
• cs_remember, set only if you tick the box to stay signed in. It holds a random token, not your password, and lasts 60 days. Signing out deletes it.
• cs_in, set when you sign in. It tells the site to build pages for you instead of serving a stored copy. It holds no personal information and goes when you close your browser or sign out.
• cs_pro, a signed marker holding your account number, which tells ordinary pages that an active membership was found so they can skip the advertising scripts without a database lookup. It lasts 12 hours and is cleared as soon as a membership ends.
• cs_comments, a session cookie set when the comments on a tutorial load. It is used to slow down repeated posting and goes when you close your browser.
• hearted_ followed by a number, set when you heart a snippet so the same browser cannot heart it twice. It lasts 1 year.
• vote_ followed by a number, set when you vote on a comment so the same browser cannot vote on it twice. It lasts 10 years.

None of these are used for tracking or advertising, and none are shared with anyone.

Many tools also keep your settings, recent work and drafts in local storage on your device, and the site remembers your light or dark theme there too. That data stays on your device and is not sent to us.

The consent banner

Unless you have a Pro membership, the site loads a consent tool from consentmanager along with our advertising partner's script. Depending on where you are, it shows a banner that asks whether you agree to cookies and data processing for advertising and analytics, and its settings let you choose purpose by purpose and company by company. The tool follows the IAB Transparency and Consent Framework, which is how the ad network learns your choice, and the site passes your choice to Google Analytics through Google's consent mode. The tool stores your choice in its own cookies, whose names start with __cmp.

To change your choices later, use the Cookie settings link at the bottom of the page. Pro members do not see the banner, because the advertising scripts are not loaded for them.

You can also block or delete cookies in your browser settings. If you block the site's own cookies, you will not be able to stay signed in.

Analytics

We use Google Analytics 4 to count visits and see which pages are used. It runs through Zaraz, a Cloudflare service that sends the visit data to Google from Cloudflare's servers, so Google's own analytics script never loads on the page. Google Analytics receives details such as the pages you view, your browser and device type, and the site that sent you. It also runs for Pro members, who do not see the consent banner.

We use this information only in aggregate, to understand how the site is used and to improve it. We do not use it to identify you. Google explains what it does with this information on its page about how Google uses information from sites or apps that use its services.

Advertising

Ads are managed by Mediavine. Mediavine and its partners use cookies and similar technology to show ads and measure them, as described in the Mediavine section below. Mediavine's script also loads Grow, a Mediavine product, and Blockthrough. If you say no to personalized advertising in the consent banner, you still see ads, but they are not personalized.

Service Providers

These are the companies that process personal information for us, and what each one does.

• Stripe processes card payments and holds Pro subscriptions. Your card details go to Stripe directly and we never receive them.
• PayPal processes package payments when you choose to pay with PayPal, and sends us your name, email address, postal address and country with the payment.
• Google hosts our email, so messages you send us and every email the site sends you pass through Google's servers. Google also runs Google Analytics, provides sign-in with Google if you use it, and serves fonts on some tool pages.
• X and Facebook, but only if you choose to sign in with one of them. They tell us who you are, and we do not send them anything about what you do on the site.
• Cloudflare delivers the site, protects it from attacks, and runs Zaraz, which sends analytics data to Google. Every request to the site passes through Cloudflare.
• Mediavine manages the advertising together with its partners, as described below. Its script also loads Grow, Blockthrough and the consentmanager consent banner. None of these are loaded for members with an active Pro membership.
• YouTube hosts the videos on some tutorials and lessons. The player loads from YouTube only when you press play, and it uses YouTube's privacy-enhanced mode at youtube-nocookie.com. Until then we show a still image from our own server, or from YouTube's image server when we do not have our own copy.
• cdnjs, jsDelivr and unpkg serve open-source code that some tool pages and the comment section load.

We do not sell personal information, and we do not share it with anyone beyond what is needed to run the things listed above.

Information processed outside the UK

Some of these providers, including Stripe, PayPal, Google, Cloudflare and Mediavine, may process personal information in the United States or in other countries outside the UK. When they do, they rely on safeguards recognized under UK data protection law, such as the UK Extension to the EU-US Data Privacy Framework or standard contractual clauses.

Your rights

You can see and change your name, email address, password and newsletter choice yourself in your account settings, and you can delete the account outright from the same page.

Under UK data protection law you can also ask for a copy of the personal information we hold about you, and ask us to correct it, erase it, or limit how we use it. You can object to uses based on legitimate interests, ask for your information in a format you can take elsewhere, and withdraw consent at any time where we rely on it. Email support@codeshack.io from the address the request is about and we will deal with it.

If you are unhappy with how we have handled your information, you have the right to complain to the Information Commissioner's Office (ICO), the UK data protection regulator, through its complaints page. If you are in the EU, you can also complain to the data protection authority in your country.

Security

We protect personal information with measures such as encrypted connections and hashed passwords. No way of sending or storing information over the internet is completely secure, so we cannot guarantee its absolute security.

Links to Other Sites

This site contains links to other sites. If you click a link to a third-party site, you will be taken to that site. These external sites are not run by us, and we have no control over, and take no responsibility for, their content, privacy policies or practices.

Browser extension

This section covers our tools browser extension, which is distributed through the Chrome Web Store. The extension is separate software from the website, and this section applies to it in addition to the sections above.

What the extension can access

The extension reads a web page only at the moment you invoke it, which means opening its popup, pressing its keyboard shortcut, choosing one of its right-click menu items, or using its address bar keyword. It has no standing access to the pages you visit and cannot read them in the background. This is enforced by the browser through the activeTab permission, and the extension requests no broad access to third-party websites.

When you do invoke it on a page, it reads that page in order to report on what it contains. That can include the colors and fonts in use, SVG markup, image addresses along with their dimensions and file sizes, link addresses, meta tags, headings, word and element counts, and the response headers the page was served with. If you ask it for a screenshot, it captures the page as an image.

Reading your clipboard is an optional permission. It is not requested when you install the extension, it stays off until you turn it on in the extension's settings, and you can withdraw it at any time.

What we receive

Nothing the extension reads from a page is transmitted to us. The extension contains no analytics, no telemetry and no tracking of any kind, and there is no account to create.

When you choose to send something to one of our tools, the extension opens that tool page on codeshack.io and hands the data to it inside your own browser, using the browser's own extension storage. The extension does not upload it to our servers. The data itself is never put in the web address. A short random identifier is added to the address after a # so the tool page knows to look for it, and browsers do not send anything after a # to the server, so it does not appear in our logs.

Every tool the extension is able to hand data to then processes that data in your browser, so a payload it sends does not reach our server either. Not every tool on this website works that way. Some, the online clipboard being the clearest example, exist to store what you give them and do send it to us when you use them directly, and the sections above cover those. The extension cannot hand anything to those tools.

The extension does make the following network requests.

• It downloads the list of available tools from codeshack.io so that searching works. This is an ordinary request to our website and is covered by the Log Data section above.
• When you pick an image or an SVG out of a page, it downloads that file from wherever the page you were on hosts it, so that the file can be handed to a tool. That request goes to that site, not to us.
• When you open the page details panel, it requests the page you are on a second time in order to read its response headers. That request goes to that site, not to us.

What is stored, and where

Your settings, your recently opened tools and your starred favorites are stored on your own device in the browser's extension storage. Anything waiting to be handed to a tool is held in the browser's session storage only until that tool page collects it, and the browser clears it when you close it. None of this is sent to us or synced between your devices by the extension.

Removing the extension deletes everything it has stored.

Permissions and why each one is needed

• activeTab, to read the page you are on at the moment you invoke the extension, and only that page.
• scripting, to run the code that reads the page and the code that puts what it found into a tool.
• storage, to keep your settings, recent tools and favorites, and to pass data to a tool page.
• contextMenus, to add the right-click entries.
• Access to codeshack.io, because that is where the tools are and where a handed-over payload has to arrive. The extension has no access to any other website.
• clipboardRead, optional and off by default, to suggest a tool based on what you have copied.

The extension does not request the tabs permission and does not request access to all websites, so it cannot see what you have open or where you have been.

If you have questions about the extension specifically, contact us at support@codeshack.io.

Mediavine Programmatic Advertising (Ver 1.1)

The Website works with Mediavine to manage third-party interest-based advertising appearing on the Website. Mediavine serves content and advertisements when you visit the Website, which may use first and third-party cookies. A cookie is a small text file which is sent to your computer or mobile device (referred to in this policy as a “device”) by the web server so that a website can remember some information about your browsing activity on the Website.

First party cookies are created by the website that you are visiting. A third-party cookie is frequently used in behavioral advertising and analytics and is created by a domain other than the website you are visiting. Third-party cookies, tags, pixels, beacons and other similar technologies (collectively, “Tags”) may be placed on the Website to monitor interaction with advertising content and to target and optimize advertising. Each internet browser has functionality so that you can block both first and third-party cookies and clear your browser’s cache. The "help" feature of the menu bar on most browsers will tell you how to stop accepting new cookies, how to receive notification of new cookies, how to disable existing cookies and how to clear your browser’s cache. For more information about cookies and how to disable them, you can consult the information at All About Cookies.

Without cookies you may not be able to take full advantage of the Website content and features. Please note that rejecting cookies does not mean that you will no longer see ads when you visit our Site. In the event you opt-out, you will still see non-personalized advertisements on the Website.

The Website collects the following data using a cookie when serving personalized ads:

• IP Address
• Operating System type
• Operating System version
• Device Type
• Language of the website
• Web browser type
• Email (in hashed form)

Mediavine Partners (companies listed below with whom Mediavine shares data) may also use this data to link to other end user information the partner has independently collected to deliver targeted advertisements. Mediavine Partners may also separately collect data about end users from other sources, such as advertising IDs or pixels, and link that data to data collected from Mediavine publishers in order to provide interest-based advertising across your online experience, including devices, browsers and apps. This data includes usage data, cookie information, device information, information about interactions between users and advertisements and websites, geolocation data, traffic data, and information about a visitor’s referral source to a particular website. Mediavine Partners may also create unique IDs to create audience segments, which are used to provide targeted advertising.

If you would like more information about this practice and to know your choices to opt-in or opt-out of this data collection, please visit National Advertising Initiative opt out page. You may also visit Digital Advertising Alliance website and Network Advertising Initiative website to learn more information about interest-based advertising. You may download the AppChoices app at Digital Advertising Alliance’s AppChoices app to opt out in connection with mobile apps, or use the platform controls on your mobile device to opt out.

For specific information about Mediavine Partners, the data each collects and their data collection and privacy policies, please visit Mediavine Partners.

Children's Privacy

Our services are not aimed at anyone under the age of 13, and we do not knowingly collect personal information from children under 13. If we find out that a child under 13 has given us personal information, we delete it straight away. If you are a parent or guardian and you know that your child has given us personal information, contact us so we can remove it.

Changes to This Privacy Policy

We may update this policy from time to time. The version on this page is the one that applies, and the date at the top shows when it last changed.

Contact Us

If you have any questions or suggestions about this policy, contact us at support@codeshack.io.