shucky.io is a static, single-page collection of network and security utilities (IP lookup and IP intel, atomic time, DNS lookup, mail-posture analysis, a DMARC record builder, CISA KEV alerts, latency probes, a subnet calculator, password / passphrase / codename generators, a hash generator, a token decoder, a port registry, an HTTP/header probe, a password breach check, a DNS-leak test, a client fingerprint readout, a connection throughput test, and a visit counter). There are no user accounts and no user database. The only thing stored on our side is the two counters described in section 02 — a visit tally, and a 48-hour rate-limiting counter.
Very little, and what there is appears below in full. The rule we hold ourselves to: nothing leaves your browser unless a tool you asked for needs it, and anything kept on our side is listed on this page. We run no analytics, no advertising, and no fingerprinting-for-tracking, and we do not ask for, store, or sell personal information. The “Client Fingerprint” tool only displays what your own browser already exposes to every site you visit — it is shown to you and never transmitted to us.
Rate limiting on the three edge tools. The header probe, the DNS-leak test and the throughput test do their work on our edge rather than in your browser, and each costs real resources, so each is capped per day. The cap is counted against a key containing your IP address, which expires after 48 hours. It is a counter and nothing more: no record of what you looked up, no history, nothing joined to anything else, and it is gone two days later whether you come back or not. Every other tool runs in your browser and writes no such key.
The visit count. The VISITOR COUNT module shows how busy the site is, and publishing that means counting it. The edge keeps a handful of plain numbers and two dates — visits today, visits counted so far, the day counting began, the day the site went live, and one estimate of the traffic from before the counter existed. That estimate is stored separately and never added into the measured number, so the site can always say which visits it actually counted. Nothing is attached to any of them: no IP, no cookie, no user-agent, no session identifier, and nothing derived from those — there is no record here that could be traced back to a person, including by us. Your own visitor number lives in this tab’s sessionStorage and is gone when you close it. With external lookups switched off, you are not counted at all.
The radio page. /radio plays recordings we made ourselves, streamed from this site and nowhere else — no embedded player, no third-party audio host, no cookie, and no count of who pressed play. The track list and the audio are fetched from our own edge exactly like any other page here; the only thing the page remembers is the shucky_theme key it shares with the terminal.
Why these and not more. Each of the three earns its place: rate limiting is what stops a handful of visitors making the edge tools unusable for everyone, and the visit count is a feature people can see and use. Where a privacy cost buys nothing, we do not pay it — the visit counter is deliberately not rate limited per IP, because a counter costs nothing to serve and guarding it would have stored more about you than the feature itself ever could.
We use your browser's localStorage for settings and one cache — never for tracking. The site also uses one sessionStorage entry, shucky_visit, holding today’s date and your visitor number so VISITOR COUNT neither counts you twice nor forgets your number when you refresh — sessionStorage is wiped when the tab closes, without anyone clearing anything. Neither is a cookie: a cookie is attached to every request you make and so is visible to the server, whereas nothing below is ever transmitted. It stays in this browser until you remove it. The keys are shucky_theme (which of the five themes you chose), shucky_privacy_ack (that you dismissed the privacy notice, so it stays dismissed), shucky_ext_lookups (your external-lookups on/off choice), and shucky_kev (a cached copy of the public CISA alert list, so it is not re-downloaded on every visit — the only stored item that is not a setting). The PRIVACY / COMSEC panel on the dashboard lists these live, showing which are set and what each holds, with a button to clear them. Clearing your browser storage does the same.
Several tools call external APIs directly from your browser, and the probe / SSL tools call a few from shucky.io's edge on your behalf. shucky.io does not control these providers; your request — which includes your IP address for browser-side calls, and for lookups the domain or URL you entered — is visible to them under their own policies:
The latency tool also makes timing requests to well-known hosts (Cloudflare, GitHub, Quad9). shucky.io neither logs nor stores any response from these services. The throughput test deliberately uses none of them — it measures against shucky.io’s own edge, because every hosted speed-test service would be handed your IP address and a profile of your connection in order to answer. That is a case where doing the work ourselves is the more private option, so we do.
The PRIVACY / COMSEC module on the dashboard has a master EXTERNAL LOOKUPS switch. Turn it off and nothing leaves your browser: the network tools pause, while the local-only ones keep working. Those are the WebRTC leak test, subnet calculator, the password / passphrase / codename forges, hash generator, token decoder, port registry, and the DMARC builder — the last of which composes a record purely from what you type and makes no queries at all, so it works even where DNS-over-HTTPS is blocked. Your choice is remembered locally.
The leak test uses your browser's WebRTC stack to reveal local network addresses your browser would otherwise expose to sites. This runs entirely on your device; the results are shown to you and are not sent anywhere.
Use the HTTP/header probe only against systems you own or are explicitly authorized to test. Probing systems without permission may be unlawful in your jurisdiction. shucky.io is provided as-is, without warranty, for informational and diagnostic use.
shucky.io holds no account, profile, email address, or history for you, so for almost every request there is simply nothing to produce. The one item that counts as personal data under GDPR is the 48-hour rate-limiting counter described in section 02, because it is keyed to an IP address. It is retained for two days, is not linked to an identity, and is not used to recognise you on a later visit; it deletes itself automatically, which is faster than any request could be processed. We keep no means of connecting it to a person, so we cannot look one up on your behalf. Preference data lives only in your own browser and is entirely under your control — the PRIVACY / COMSEC panel clears it, and so does clearing your browser storage. This summary is provided for transparency and is not legal advice.
If this policy changes, the "last updated" date above will change with it. Questions about privacy: [email protected].