Subprocessors & Third-Party Services

Last updated: September 12, 2026

Summary

Under the EU General Data Protection Regulation (GDPR) Article 28, when we engage a third party to process personal data on our behalf, we must publish a list of those subprocessors. This page lists every third-party service that receives, processes, or stores data on behalf of DevTools Hub users, including its purpose, processing location, and a link to its privacy policy.

DevTools Hub is privacy-first: the vast majority of tool processing happens entirely in your browser, and your inputs never leave your device for those tools. The services listed below are engaged only when you actively use a tool whose description explicitly requires remote processing (for example, an AI assistant that submits your text to an inference provider).

Subprocessors (handle user data)

Each row below is a subprocessor in the GDPR Art. 28 sense: it receives user-submitted data from DevTools Hub for the stated purpose only.

  • Cloudflare, Inc. — Hosting, serverless Functions, KV storage, and anonymous Web Analytics. Processes server logs (IP, User-Agent, request path) for abuse prevention; processes anonymous page-view analytics without cookies. Location: global edge network, US-headquartered. Privacy policy.
  • Groq, Inc. — AI inference for chat, detection, paraphrasing, grammar, summarization, transcription (Whisper), translation, and code tasks. When you use those tools, your text prompt and the relevant tool input are submitted to Groq's LPU endpoints. No DevTools Hub identifier is attached. Location: United States. Privacy policy.
  • NVIDIA Corporation — AI inference fallback (NVIDIA NIM endpoints) when Groq is unavailable, used by the same AI tools. Receives the same prompt/input content. Location: United States. Privacy policy.
  • SiliconFlow — AI inference secondary fallback for chat and content-generation tools (e.g., story-animator, social-media-post-generator). Receives the same prompt/input content. Location: China. Privacy policy.
  • Google LLC (Gemini API) — AI inference for the translator and ai-detector tools only. Receives the text being translated or classified. Location: United States. Privacy policy.
  • CoinGecko — Public cryptocurrency market data (prices, market cap, 24-hour volume). The request originates from the DevTools Hub edge, so CoinGecko may see the edge egress IP. No user identifier is sent. Location: Singapore. Privacy policy.
  • Yahoo! Inc. (Yahoo Finance) — Public stock and commodity historical price data. No user identifier is sent. Location: United States. Privacy policy.
  • goldprice.org — Public precious-metal spot price data. No user identifier is sent. Location: United States. Privacy policy.
  • Alpha Vantage — Public stock quote data fallback. No user identifier is sent. Location: United States. Privacy policy.

Content Delivery Networks (no personal data)

These services serve static assets (JavaScript libraries, fonts, CSS). They log requests at the edge and may therefore see your IP and User-Agent as part of normal CDN operation. They receive no DevTools Hub identifiers and no tool input.

  • jsDelivr — Public CDN for open-source libraries (Tesseract.js, SheetJS, marked.js, etc.). Location: Sweden-headquartered, global edge. Privacy policy.
  • Cloudflare cdnjs — Public CDN for open-source libraries. Location: United States, global edge. Privacy policy.
  • Google Fonts — Public web font CDN (IBM Plex Sans, JetBrains Mono, Inter). Location: United States, global edge. Privacy policy.

Feedback storage

When you submit the feedback form on any tool, your message text, the tool URL, and a timestamp are written to a Cloudflare KV namespace served by Cloudflare (already listed above). Your email is optional and stored only if you provide it. The submission is publicly visible on the /tools/feedback/ page so that other visitors can see open issues and their resolution status.

What we do not engage

  • No advertising networks, no Google Ads, no Meta Pixel, no TikTok Pixel.
  • No cross-site tracking, no fingerprinting libraries, no session-replay services.
  • No data brokers, no marketing automation platforms.
  • No third-party authentication providers (no Google/Facebook/Apple sign-in).

Changes to this list

We will update this page at least 30 days before adding a new subprocessor that handles user-submitted content. Material changes to existing subprocessors (new purpose, new data category, new geographic region) will also be announced on this page with a revised "Last updated" date. For routine changes to CDNs or anonymous-only processors, we update this page promptly without prior notice.

How to verify

You can independently confirm the data flow for any AI tool by opening the browser DevTools Network tab before you click "Run" and watching the request go to the relevant provider (Groq, NVIDIA, SiliconFlow, or Google). The request URL and method are visible in plaintext. The same applies to the market-data endpoints — the request URL is fully visible.

Related pages