Privacy Policy

What Gampangin collects — advertising, analytics, stateless network lookups, and the optional server-backed utilities (accounts, URL tracker, webhook receiver, submissions) — and the choices available to visitors.

This policy describes the limited data Gampangin processes when you visit a page, including the advertising and analytics described below. Primary content is delivered as static HTML and does not require client-side JavaScript.

Advertising

Gampangin is funded by advertising provided by Google and its third-party advertising partners. When advertising is permitted, Google and those partners may set advertising cookies and process device data to show personalized or non-personalized advertising. Personalized advertising uses your activity to select ads; non-personalized advertising does not. You can change or withdraw your advertising consent at any time.

Analytics

We use first-party, non-identifying engagement analytics to understand which tools and pages are useful. Analytics runs only when your analytics consent allows it. We never collect the input you type or paste into a tool.

Server-backed lookups (DNS, WHOIS, ASN)

Most tools run entirely in your browser. A small number of network lookups — DNS record lookups, the DNS propagation checker, WHOIS and ASN — cannot run in a browser, so they are performed by the Gampangin API. When you run one of these tools, the hostname, IP address or AS number you enter is sent to our server, which forwards it to the deployment's configured lookup provider to return the result.

These lookups are stateless. Your query is used only for the requested operation: it is not stored, not written to our logs, and not used for advertising or analytics. The response is marked no-store and sets no cookie. The provider is selected and credentialed by the deployment; when no provider is configured the tool returns a clear error instead of a result. Internal, private, loopback and reserved targets are refused before any lookup.

AI website scanner

The AI Website Scanner fetches a public page so it can report AI-readiness signals. When you run it, the URL you enter is sent to the Gampangin API, which fetches the page and its robots.txt and llms.txt through an SSRF-safe fetcher and returns the analysis.

The scan is stateless: the URL, the resolved address and the fetched content are used only for that request, are not stored, are not written to our logs, and are not used for advertising or analytics. The response is marked no-store and sets no cookie. Internal, private, loopback, reserved, cloud-metadata and internal-DNS destinations are refused before any fetch, and every redirect is revalidated. When the URL-fetch capability is not configured the tool returns a clear error instead of a result.

Server-backed utilities and optional accounts

Gampangin is introducing optional server-backed utilities: anonymous accounts, a URL shortener/tracker, a webhook receiver, and tool and AI-directory submissions, together with the Pro limits that depend on them. Each is optional and fail-closed — until a deployment enables and configures a utility it is unavailable and processes nothing. Basic browser tools never require an account and are never paywalled.

Accounts are optional. When you create one, we store the account identifiers and the preferences you save (favorites, recent tools, saved configurations, history and dashboards). Account storage never receives the input you type or paste into a browser-local tool. You can export or delete your account data at any time, and deleting your account removes the stored records.

The URL shortener/tracker turns a URL you supply into a short link and records aggregate click analytics such as click count, timestamp, referrer, approximate location, device, browser, OS and campaign parameters. We minimize IP retention, disclose the analytics we record, filter bots, and apply a documented retention policy, with an abuse-reporting path. Password protection and link expiration are opt-in.

The webhook receiver gives you a unique, unguessable endpoint that records the requests sent to it (method, URL, headers, query parameters and body) so you can inspect them. Endpoints expire, retention is bounded, requests are size- and rate-limited, endpoints are isolated from one another, and the receiver never executes arbitrary server-side code.

Tool and AI-directory submissions you send are used only to review the listing. Submitted content is never auto-published: it passes automated validation, security and URL validation, editorial review and SEO review first. Sponsored listings are labeled and never influence rankings or tool output. We record each submission — including the contact details you supply — to review it and to keep an audit trail of the decision, and we do not use it for advertising. A submission that fails validation or review is held, not published, and an editor can see why. If you see an abusive listing, use the report form on the submission page and an editor will review it.

Outbound fetches performed by these utilities are SSRF-resistant: internal, private, loopback, reserved, cloud-metadata and internal-DNS destinations are refused, and every redirect is revalidated. Retention, rate-limiting, secret isolation and monitoring requirements are recorded in the deployment's security documentation.

Your choices and data storage

• Your consent choices are stored in this browser's local storage, not on our servers.
• You can change or withdraw advertising and analytics consent at any time from the consent controls or the Cookie and Tracking Policy.
• Clearing your browser data removes the stored consent decision.
• If you create an optional account, you can export or delete your account data at any time from /account/; deleting the account removes the stored records.
• A server-backed utility that is not configured on a deployment is unavailable and collects nothing.

Questions we are asked