Privacy policy

Effective date: July 2, 2026.

tokensift is designed to prepare cleaner debugging prompts and, on the backend-hosted deployment, store submissions and bounded interaction metadata in a private first-party SQLite database for diagnostics.

What is collected by the backend

When a visitor clicks the Sift button on the backend-hosted deployment, tokensift stores the submitted raw input, generated output, user IP address, user agent, and KST timestamp in a private SQLite database controlled by tokensift.

Raw submissions can contain stack traces, pasted code, exact file paths, exact error messages, internal URLs, or secrets. Users should redact sensitive material before using the tool.

When a visitor selects a built-in sample, completes a Sift, or copies a result, tokensift also stores a separate first-party interaction record. Depending on the action, that record can include the KST timestamp, event name, sample type, linked Sift event ID, detected type, approximate input and output size buckets, reduction bucket, redaction count, folded-line count, copy format, and page path. Interaction records do not include raw input, generated output, or preview text.

This same-origin operational measurement is part of the backend-hosted service and is separate from the optional third-party analytics described below.

Retention and deletion

Backend-hosted raw submissions, first-party interaction records, and private operator JSONL preview logs are retained for up to 30 days by default for diagnostics, product measurement, and parser improvement. The hosted operator is responsible for running the retention cleanup process that removes rows from both SQLite event tables and JSONL preview events under that window.

To request deletion of a submitted sample sooner, email [email protected] with enough context to identify the submission.

What is not shared with third parties

tokensift does not sell raw logs or generated prompts, and it does not send raw logs, generated prompts, pasted code, exact file paths, exact error messages, credentials, or clipboard contents to analytics providers, advertising providers, LLM APIs, or other third-party APIs.

Local storage

The browser may store essential preferences such as theme and consent state. Raw logs and generated prompts are not stored in localStorage, sessionStorage, cookies, or URL parameters.

Optional analytics

Analytics are disabled by default. If analytics are enabled and a visitor consents, tokensift sends only aggregate events such as detected type, approximate size buckets, redaction count, and folded-line count. Raw text is not sent as an event property.

Ads and third-party vendors

tokensift includes Google AdSense site-verification code for the production domain. That code may load Google's advertising script on public pages so Google can verify the site and review it for ads.

Display ad slots in the app remain hidden unless a valid AdSense client ID is configured in the app settings and the visitor consents to ads. If display ads are enabled, Google and its partners may use cookies or similar technologies to serve ads, measure performance, prevent fraud, and support ad personalization according to visitor consent and Google settings.

tokensift does not send raw logs, generated prompts, pasted code, exact file paths, exact error messages, credentials, or clipboard contents to AdSense through custom app events.

Review Google's advertising technology policy, Google Ads Settings, and the AdSense third-party vendor list for vendor and opt-out details.

Contact

For privacy questions, email [email protected].