Menu

Privacy policy

Last reviewed

This website collects as little as possible: there are no accounts and no ads, analytics cookies are only set if you allow them, and the tools never send what you paste anywhere.

The short version

  • No accounts, no advertising, no tracking pixels and no social-media plugins.
  • Analytics only with your consent. If you click “Allow analytics”, we use Google Analytics to count visits. If you click “No thanks”, or do nothing, no analytics cookies are set and nothing is sent to Google. You can change your choice at any time with “Cookie settings” at the bottom of every page.
  • Apart from Google Analytics after your consent, no third-party scripts or fonts: everything is served from our own website.
  • Your light or dark theme choice is stored only in your own browser.
  • The tools run in your browser. Certificates and requests you paste are never sent to us or to anyone else.
  • Our hosting provider, Microsoft Azure, processes technical data such as your IP address to deliver the pages. We do not use it to track you.
  • If you email us or use the contact form, we use your details only to answer you.

Who is responsible for your data?

The controller is Duyutech BV, Slagmanstraat 26, 9080 Lochristi, Belgium, enterprise number 0762.516.604, VAT BE0762516604. Contact: info@pkizerotohero.com.

What happens when I visit the site?

Unless you allow analytics (see the next section), we do not collect personal data ourselves, set no cookies and load no scripts or fonts from other companies. We never use tracking pixels, advertising or social-media plugins.

To deliver the pages to you, our hosting provider Microsoft Azure necessarily processes technical data, such as your IP address, the page requested, the time and your browser’s user agent. Microsoft does this as our processor, on our behalf, and keeps this data according to Azure’s standard retention for running and securing the service. We do not use this data to track you, to build profiles or for analytics.

  • Why: to deliver the website and keep it secure and working.
  • Legal basis: our legitimate interest in running a secure website (Article 6(1)(f) GDPR).
  • Where: the site is hosted in Microsoft’s West Europe region.

When you first visit, a banner asks whether we may use Google Analytics to understand which pages help people. Nothing is loaded from Google before you answer, and nothing at all if you choose “No thanks”.

If you click Allow analytics:

  • What is collected: the pages you view (the address without anything after a “?”, so your site-search terms are never sent), how you arrived (for example a search engine or a link), your approximate location (country and city, derived from your IP address), your device type, browser and screen size, and the time of your visit. Google Analytics 4 does not log or store IP addresses.
  • Cookies: Google Analytics sets the cookies _ga and _ga_<ID> on pkizerotohero.com to recognise repeat visits. They expire after at most 2 years, or when you withdraw your consent.
  • What we switched off: advertising features, Google signals and ad personalisation. We do not use the data for advertising or to identify you.
  • Who processes it: Google Ireland Limited, as our processor under Google’s data processing terms. Google may transfer data to the United States; it is certified under the EU-U.S. Data Privacy Framework.
  • Why: to see which pages are useful and where visitors come from, so we can improve the content.
  • Legal basis: your consent (Article 6(1)(a) GDPR, and the Belgian rules on cookies). You can withdraw it at any time with “Cookie settings” at the bottom of every page; withdrawing removes the analytics cookies from your browser.
  • How long: Google keeps the analytics data for at most 14 months.

We ask again after 12 months, and whenever we change what we measure.

What is stored on my device?

Your theme preference (light or dark), if you choose one, and your analytics choice (allowed or not, and when). Both are kept in your browser’s local storage, never sent to us, and you can delete them at any time by clearing your browser’s site data. They are not cookies and are not used to recognise you. If you allow analytics, Google Analytics also sets the cookies described above.

When you send text from one tool to another (for example a certificate from the decoder to the chain checker), it is held for a moment in your browser tab’s session storage, so the other tool can open it. It is removed as soon as the other tool reads it, or when you close the tab, and it is never sent to us.

When you play the game, it saves your progress, your settings and your Royal Exam answers in your browser’s local storage and IndexedDB, so you can carry on where you stopped, plus a short log of what happened in the game (for example, that a level was finished). It all stays on your device and is never sent to us. Clearing your browser’s site data removes it, and with it your progress.

What happens to certificates I paste into the tools?

Nothing leaves your browser. The tools decode and check certificates, chains and certificate requests on your own device. We never receive what you paste.

Never paste a private key into any website, including this one. None of our tools needs one.

What happens when I email you?

If you write to info@pkizerotohero.com, for example to ask a question, report an error or ask to be notified about new levels of the game, we receive your email address, your name if you include it, and your message. Our email provider, Combell (a Belgian hosting company), handles these messages for us as our processor.

  • Why: only to answer you, to fix what you reported, or to send the notification you asked for.
  • Legal basis: our legitimate interest in answering messages sent to us, or steps you asked us to take (Article 6(1)(f) and (b) GDPR).
  • How long: only as long as needed for that purpose. Notification requests are kept until we have sent the notification, or until you ask us to remove them.

We never sell or share your email address, and we do not add you to a mailing list you did not ask for.

What happens when I use the contact form?

The contact form sends us an email. It holds what you enter: your name (if you give one), your email address, the topic you choose and your message, plus the page you came from when you use a “Report an error” link. Nothing else about you is added.

  • How it reaches us: Microsoft Azure Communication Services delivers it as an email to our mailbox at Combell. Microsoft does this as our processor, with the data location set to Europe (EU).
  • Why: only to answer you, or to fix what you reported.
  • Legal basis: as for emails: our legitimate interest in answering messages sent to us, or steps you asked us to take (Article 6(1)(f) and (b) GDPR).
  • How long: only as long as needed to answer you and deal with your message.
  • No IP addresses: we do not store your IP address, and it is not in the email. To stop the form being abused, the server counts recent messages per sender with a one-way hash of the IP address, held only in its memory for a short time and never written to disk or logs.

Children

Without consent to analytics, the site collects no personal data from visitors, whatever their age. Children under 13 should ask a parent or teacher before clicking “Allow analytics”; teachers using the site with a class can simply choose “No thanks”. If a child writes to us, by email or with the contact form, we use the message only to answer it. Accounts, when they arrive, will be for people aged 13 and over.

What are my rights?

Under the GDPR you have the right to:

  • access the personal data we hold about you;
  • have it corrected if it is wrong;
  • have it erased;
  • restrict how we use it;
  • object to processing based on our legitimate interests;
  • receive it in a portable format (data portability), where that applies.

To use any of these rights, email info@pkizerotohero.com. We will answer within one month. We may ask for information to confirm it is really you.

How can I complain?

You can complain to the Belgian Data Protection Authority (Gegevensbeschermingsautoriteit / Autorité de protection des données):

You can also complain to the data protection authority of the EU country where you live or work. We would appreciate the chance to fix the problem first, so please write to us too.

We link to primary sources such as the RFC Editor, the CA/Browser Forum, NIST and EUR-Lex. Those websites have their own privacy policies, which apply when you visit them.

What will change when accounts arrive?

Later, optional accounts, purchases and synced progress will be added. Those involve personal data, such as your email address and your progress. We will update this policy before any of that goes live, and explain exactly what is stored, why, for how long and who processes it.

Changes to this policy

We will publish any change on this page and update the date at the top. If a change is significant, we will say so on the site.