Contact
Tool requests, tool questions, bug reports, privacy or legal questions, and other messages.
Privacy
Privacy policy
This policy explains how admintoolkit.io handles personal data, local tool processing, same-origin helper endpoints, external lookups, analytics, and future advertising.
Hosting, edge delivery and server logs
The origin website is hosted by an external hosting provider. Cloudflare acts as the site's always-on reverse proxy, content-delivery and security service; it is not limited to the optional DNS-over-HTTPS tool requests described below.
For delivery, protection, troubleshooting and abuse prevention, the involved services may process the visitor IP address, access time, requested URL, referrer, user agent, request and response headers, status information, and content required to deliver or protect the request. The operator remains responsible for the website; Cloudflare and the hosting provider process the relevant operational data for their respective delivery and security functions.
Cloudflare's current customer data-processing terms allow processing outside Switzerland, the EEA and the United Kingdom and provide the applicable EU Standard Contractual Clauses with Swiss adaptations and, where valid and applicable, the Data Privacy Framework as transfer mechanisms. This notice does not claim a specific processing country for an individual request.
No customer-configured Cloudflare Logpush job or Worker route is active for this site. Cloudflare's contract uses necessity and the end of the service relationship as deletion criteria, subject to legal obligations; a separate numeric visitor-log period was not available and is not asserted here. Hostpoint states that most operational log categories are retained for no more than six months and are otherwise deleted when operational necessity and applicable legal or contractual duties end.
Use of the tools
admintoolkit.io provides technical browser and diagnostic tools. Many functions process entered data directly in the browser. Depending on the tool, entered content may be technically sensitive, for example domains, DNS values, mail headers, certificates, EDID data or IP-related information.
admintoolkit.io does not use user accounts and does not permanently store entered tool content in an application database.
External requests and embeds
Some functions query external services only after an explicit user action. This includes DNS requests via Cloudflare DNS-over-HTTPS, live TLS and HTTP helper lookups, and the Google Maps embed after a separate map opt-in.
The public IP page uses the same-origin /api/ip.php endpoint on page load to show canonical IP, observed-peer, and trusted-proxy evidence. Geo-IP/ASN data from api.ip.sb requires a click, and the map requires a second separate click.
Contact form
The contact form sends the entered name, email address, selected topic, subject, message, captcha answer, locale, timestamp, IP address and user agent to the operator by email. The technical sender address is contact@admintoolkit.io; the entered email address is used as reply-to address.
The form uses a small same-origin PHP endpoint, server-side validation, a honeypot field, a timing check, and a simple rate limit for abuse prevention. Contact form contents are not sent to Google Analytics as event parameters.
Cookies, analytics and local storage
admintoolkit.io stores the interface theme in admintoolkit-theme-mode and the analytics choice in admintoolkit-analytics-consent. Both values stay in the browser until they are changed, cleared by the user, removed by the browser, or private browsing ends.
Google Analytics 4 is deployed for aggregated page and tool-usage measurement, but the site runtime initializes it only when the stored analytics choice is exactly granted. Before that choice, analytics storage remains off and the runtime does not load the Google Analytics script. Advertising storage, ad user data and ad personalization remain denied.
If the browser exposes navigator.globalPrivacyControl === true, the runtime records the analytics choice as denied, does not show the analytics opt-in prompt, and does not load Google Analytics. The older Do Not Track signal is not automatically treated as equivalent to GPC.
After consent, the site may send the events page_view, tool_loaded, tool_action, share and trace_mode_launch with a restricted set of page, language, tool and action identifiers. Pasted headers, certificates, EDID data, domains, IP addresses, URLs, subnet plans, DNS values, results and other user-entered tool content are not permitted event parameters.
Consent can be withdrawn by clearing the site's stored analytics choice or all site data, reloading the page, and choosing “Decline”. This prevents subsequent site-triggered Analytics initialization; it cannot recall data already transmitted before withdrawal.
Google Analytics
The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. The configured web stream uses measurement ID G-PBKEELNL9Q and timezone Europe/Zurich.
Google Signals is disabled. Enhanced Measurement is enabled. The linked Google Ads account has ads personalization disabled.
The property retains event-level data for 2 months and user-level data for 14 months; the user-data period resets on new activity. These settings describe the current Analytics property and do not extend the site's separate retention rules for hosting logs or contact messages.
Google AdSense
This website may use Google AdSense in the future to display advertising. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.
Google and other third-party providers may use cookies or similar technologies to serve ads. Users can disable personalized advertising in Google's ad settings.
Retention and deletion criteria
- Hostpoint operational logs: most categories are retained for no more than six months; other log data is deleted when operational necessity and applicable legal or contractual duties end.
- Cloudflare edge data: no customer Logpush archive is configured. Cloudflare applies the necessity, service-end and legal-obligation criteria in its current data-processing terms; no separate numeric visitor-log duration is asserted.
- Contact messages: the site keeps no application database or file copy after SMTP delivery. No fixed mailbox deletion period has been technically verified; mailbox retention therefore remains an operational policy to be defined by the owner rather than a duration asserted here.
- Contact rate-limit state: the temporary key is a hash derived from the IP address and UTC hour and stores only a counter. Cleanup of the hosting platform's temporary files is host-managed and was not independently verified.
- Consent state: the local browser value remains until changed or cleared by the user or browser.
- Google Analytics: event data is configured for two months; user data for 14 months with reset on new activity.
Rights of data subjects
Depending on applicable law, data subjects may request access, rectification, erasure, restriction, objection or data portability. Privacy enquiries can be sent to privacy@admintoolkit.io.
Data subjects may also contact a competent data protection supervisory authority. For Switzerland, the Federal Data Protection and Information Commissioner (FDPIC/EDÖB) is a relevant contact point.
Controller
admintoolkit.io
Operator: Philipp Hobi
c/o Verena und Bruno Ern
Oberdorfstrasse 17
CH-8820 Wädenswil
Switzerland
General enquiries: contact@admintoolkit.io
Privacy enquiries: privacy@admintoolkit.io
Security reports: security@admintoolkit.io