What we know about you. Spoiler: nothing

1The tests stay in your browser

Every tool is a page that does its job on your device. Camera images, microphone recordings, sensor readings, coordinates and key presses are not sent anywhere and disappear when you leave the page. The browser asks for the camera, microphone, location or motion sensors only when you start the test that needs them, and you can withdraw that permission in its settings at any time.

We have no accounts, so there is no password database that could leak. The most secure password is the one nobody stores.

Files in DropBench travel encrypted straight from one browser to another and never land on fof.lol. Photos in PhotoBench and documents in PDFBench are processed right on your device; only the code of the tools is downloaded, never your files uploaded.

2History and settings live with you

Saved results, history, places, theme and language are kept only in your browser’s storage on this device. Tools that keep a history let you delete entries right there, and clearing the site data in the browser removes everything at once. Another browser or another phone won’t see any of it: we have nowhere to sync it from.

For offline work the browser also keeps a copy of the site’s own files: pages, scripts, fonts and pictures. There is nothing about you in it.

3Shared links carry the result after “#”

When you share a result, the whole result is packed into the link itself, in the part after #. Browsers never send that part to the server: the result is unpacked right in the browser of whoever opens the link. So there is no copy of it with us, and nothing to delete either.

The flip side: anyone who has the link sees what’s in it. So WhereBench lets you round the coordinates before sharing, and PrivacyBench links never include your IP address, provider or city. A RandomBench giveaway link holds the whole list of participants, so that anyone can repeat the draw: use nicknames rather than full names.

4Statistics without cookies

We do count visits, otherwise we wouldn’t know whether anyone needs a tuner shaped like a pear. We use Cloudflare Web Analytics, and it sees only this: which page was opened, which site you came from, the country, the type of device and browser, and how fast the page loaded.

• It sets no cookies and doesn’t follow you across sites or from one visit to the next.
• It receives page addresses without the parts after # and ?, so results, shared links, coordinates and saved data never reach it.
• That is why there is no cookie banner here: there is nothing to agree to.
• Block it with any browser extension and every tool works exactly the same.

5Who else sees your requests

Honesty corner: some jobs can’t be done without the outside world. In those cases your browser talks to another service directly, and that service sees ordinary request data, such as your IP address:

• SpeedBench and MeetBench send test traffic to Cloudflare; in SpeedBench the provider and city come from an IP lookup service.
• WhereBench loads maps from OpenStreetMap and Esri and looks up addresses with OpenStreetMap Nominatim.
• DropBench and DrawBench find each other through a public PeerJS server; the files and drawings then go encrypted between the browsers.
• PassBench sends only the first 5 characters of the password’s hash to Have I Been Pwned, never the password: about a million passwords share each such beginning.
• Some tools load libraries from cdnjs and jsDelivr. That’s code coming to you, not data going out.

The full list, with every address, is in the Terms of use.

6Guard rails nobody sees

Every page arrives with a few security headers, instructions for your browser. Readers who are not into acronyms can skip straight to the comic.

• Content-Security-Policy: a guest list of every outside address the tools may use. Anything not on the list, the browser simply won’t load, even by accident.
• Permissions-Policy: the camera, microphone, location and sensors may be used only by fof.lol itself. The payment API and Topics, the browser’s ad-interest guessing, are switched off entirely.
• Referrer-Policy: when you follow a link from us to another site, it learns only that you came from fof.lol, not from which page.
• X-Frame-Options: other sites can’t wrap our pages in a frame to trick you into clicking.
• HSTS: the browser always opens the site over HTTPS only.

Don’t take our word for it

Open PrivacyBench: it shows what any site, including this one, can see about you. Look at the Network tab in the browser’s developer tools while you use a tool, or check our headers on securityheaders.com.

Found something that doesn’t match this post? Write to . The onion will investigate. Again.