Privacy Policy

Overview

Payload Playground is a security-testing toolkit. The large majority of what we offer — every generator, encoder, hasher, and analysis tool — runs entirely in your browser and never transmits your input anywhere. A small number of features are different by necessity and are described plainly below: optional sign-in, optional AI assistance, and optional cloud features (saving, sharing, and community submissions). This policy explains exactly what leaves your device, when, and to whom — and your rights over any data we store. It covers the website at payloadplayground.com and the payload-playground CLI package on npm.

Client-Side Tools — Your Input Stays on Your Device

All payload generators, the encoding pipeline, and the analysis and conversion tools run entirely in your browser using client-side JavaScript. The payloads, tokens, hashes, code, and any other input or output you work with are processed locally and are never automatically transmitted to our servers or any third party. There is no background syncing and no input telemetry — you can verify this with your browser's network tab open.

A few tools must make a network request to do their job, and these are clearly labeled in the tool itself:

• DNS Lookup and Certificate Transparency Search query public third-party APIs for the domain you enter.
• Favicon Hash fetches the URL you supply to compute its hash.

These send only the domain/URL you explicitly provide — never your other tool inputs.

AI Features (DeepSeek)

The optional AI assistant and the AI-powered payload mutator are the one place your tool input is sent to a third party — and only when you explicitly invoke them. When you send an AI request, the prompt you submit (which may include a payload) is sent to our server, which forwards it to DeepSeek, a third-party large-language-model provider, to generate the response.

• We do not store your AI prompts or the AI's responses in our database — they are processed for the live response and discarded. We retain only a per-month count of how many AI queries you have made (to enforce free-tier limits).
• DeepSeek processes the request under its own privacy policy. This may involve transferring your prompt outside your country (a cross-border transfer). Do not submit real secrets, personal data, or client-confidential information to the AI features.
• The non-AI "Quick Mutations" in the payload mutator run entirely client-side and send nothing.

Optional Account & Cloud Features

All free tools work with no account. If you sign in (via Clerk) and use the optional cloud features, content is stored on our servers only when you explicitly choose to save or share it — there is no automatic upload. These features are:

• Save to Library — payloads you click to save are stored to your account so you can reuse them.
• Cloud History (Pro) — when enabled, payloads you generate are saved to your account history.
• Share links — when you create a share link, the payload is stored and becomes accessible to anyone who has the link. Do not share sensitive data this way.
• Community submissions — payloads (and any context/notes you add) that you submit to the community are visible to other users. Submit only what you intend to make public.
• Effectiveness & WAF fingerprints — when you vote on whether a payload worked, we store only a one-way cryptographic hash of the payload plus the outcome — never the raw payload.
• API keys — when you generate a programmatic API key, we store only a hash and a short prefix. The full key is shown once and never stored in readable form.

You can delete any of this at any time — see Your Privacy Rights.

What We Store, Why, and For How Long

What We Do Not Collect

• Tool input you do not explicitly save or share — generators, encoders, hashers, and analysis tools never transmit it
• Your AI prompts and responses are never stored in our database
• Payment card numbers — handled entirely by Stripe
• Passwords — authentication is managed by Clerk (we never see or store passwords)
• Raw payloads in effectiveness/WAF data — only one-way hashes

Analytics & Error Monitoring

• Google Analytics — collects anonymized pageview and engagement events (pages visited, which tool was used, copy and share actions) with IP anonymization. Analytics storage is denied by default until you accept cookies, and never includes the content of your payloads or tool input.
• Error monitoring — our self-hosted error monitor records stack traces and request metadata (such as the route and status) so we can fix crashes. It does not capture your tool input or request bodies.

Cookies & Local Storage

We use your browser's local storage to remember your theme, your last-used generator settings, and recent-tool history — this stays on your device and is never transmitted. Cookies that may be set:

No advertising or cross-site tracking cookies are used. You can block or delete cookies through your browser without affecting the free tools.

Your Privacy Rights

Wherever you live, and regardless of whether the GDPR (EU/UK) or CCPA/CPRA (California) applies to you, we honor the following rights over data tied to your account:

• Access & portability — export a machine- readable copy of everything we store for your account from your account page.
• Deletion — delete all of your stored content (saved payloads, history, shared links, community submissions, API keys) from the account page. Deleting your account via Clerk also purges this data automatically.
• Correction — update your email/display name through Clerk.
• Withdraw consent — decline or clear analytics cookies at any time via the cookie banner or your browser; the site works fully without them.
• No sale of personal information — we do not sell or share your personal information, and there is no targeted advertising.

To exercise any right you can't complete in-app, email [email protected] and we will respond within 30 days.

Sub-Processors & International Transfers

We rely on the following third-party processors. Some may process data outside your country:

• Clerk — authentication and account management
• Stripe — payment processing for Pro subscriptions
• Neon — PostgreSQL database hosting for the cloud features you opt into
• DeepSeek — AI responses, only when you use the AI features; may involve cross-border transfer of your prompt
• Google Analytics — anonymized, consent-gated usage statistics
• Cloudflare & Vercel — content delivery and hosting

See Clerk, Stripe, Neon, and Google for how each handles data.

CLI Package

The payload-playground CLI package (on npm) runs entirely on your local machine. It does not collect data, send analytics, or make network requests — all generation and utility functions execute locally.

Children's Privacy

Payload Playground is not directed at children under 13, and we do not knowingly collect information from children. The tools are intended for security professionals, researchers, and students engaged in authorized security testing and education.

Changes to This Policy

We may update this policy from time to time. Material changes will be reflected here with an updated "Last updated" date. We encourage you to review this page periodically.

Contact

Questions about this policy or your data? Email [email protected].