Privacy Notice

CyberRamen.com is committed to transparency. This page explains exactly what data is processed, where, and why. No legalese.

What We Do NOT Do

• No analytics tools or tracking (no Google Analytics, no Matomo, no tracking pixels, no analytics cookies) — the public visitor stats are counted from the standard server logs described below
• No advertising or ad networks
• No third-party scripts or CDNs — all JavaScript is served from this site
• No fingerprinting or user profiling
• No user accounts or registration
• No data sold or shared with third parties
• No font downloads at all — pages use your device’s own system fonts

Referral Links

One page — recommended services — carries referral links to a small number of third-party services we use. They are labelled as referral links, and each entry also offers a plain link with no referral code. There are no referral links inside the tools, and no ads anywhere.

What this means for your data:

• The referral code identifies CyberRamen, not you. We do not attach any identifier of our own to the link.
• We set no cookie and load no tracking pixel or script for this — the link is plain HTML, and we never learn whether you clicked it or signed up.
• Links open with rel="noopener noreferrer", so your browser does not pass the CyberRamen page you came from to the destination.
• Once you follow the link you are on the third party’s site, under their privacy policy — not ours. Read it before you create an account.
• If a signup earns us a credit or commission, the service tells us a referral converted. It does not tell us who you are, and we ask for no such data.

Client-Side Tools (Majority)

Most tools on CyberRamen.com run entirely in your browser. The data you enter never leaves your device. This includes all encoding/decoding tools, hash generators, JWT decoders, the phishing awareness simulator, and more.

These tools send nothing you enter to our server or anyone else: they load the page and, for a few, a reference file from this site (for example the vendor list of the MAC Lookup), and nothing more. You can verify this in your browser’s DevTools Network tab.

Tools That Query External Services

Some tools use our server and say so with a server-assisted or server-only label on their page and on every tool card. For most of them the data you submit (e.g., a domain name) is sent from our server to the external service — your IP address is not passed on, with two exceptions shown in the table: IP Geolocation’s reverse DNS lookup of the address being checked (yours by default), and its optional WebRTC check, which your browser runs itself. Tools that check a site or host you name contact that site directly. A few (the Password Hash Verifier and the bcrypt mode of the Password Security Suite, for example) talk to our server only: the input is processed in memory and returned.

Server-assisted — the tool runs in your browser, but the feature named in brackets calls our server (7 tools):

• Dependency Scanner (OSV vulnerability lookup)
• HTTP Security Headers Grader (URL scan)
• Page Content Audit & Link Extractor (URL mode and Extract links)
• Password Security Suite (bcrypt mode)
• PGP Key Lookup & Inspector (keyserver lookup)
• Phishing Checker (deep scan)
• SRI Hash Generator (URL mode)

Server-only — the tool needs our server to work (16 tools):

• Actionable CVEs Dashboard
• Bucket Exposure Checker
• CAA & HSTS Preload Checker
• DNS Mapper
• DNS Record Lookup
• Domain Availability
• Domain Security Posture Scanner
• Email Security Checker
• EPSS Score Lookup
• IP Geolocation & Privacy
• Password Hash Verifier
• PDF Scanner
• Security Feeds (RSS)
• SSL Certificate Checker
• Subdomain Takeover Checker
• WHOIS Lookup

IP-to-country and IP-to-network (ASN) lookups in our tools are done on our own server with the free DB-IP Lite databases, updated monthly: IP Geolocation by DB-IP, licensed under CC BY 4.0. No IP address is sent to a geolocation service.

Session Cookie

Most pages set one session cookie (PHPSESSID). It holds only a random ID; the matching server-side session keeps security tokens that protect the tools’ forms against cross-site request forgery, a few timestamps and request counters. It contains no personal data, ends after 30 minutes of inactivity, and the cookie is deleted when you close your browser. It is configured with:

• HttpOnly — not accessible to JavaScript
• Secure — only sent over HTTPS
• SameSite=Strict — never sent cross-site

Rate Limiting and Abuse Protection

To keep the server-side tools available for everyone, each tool limits how many requests one address can make in a short time. For this the server stores a salted hash of your IP address (not the address itself) with the times of your recent requests. These entries are removed by a clean-up that runs regularly while the site is in use, normally within a few hours after the limit period ends.

Addresses that probe the server for known weaknesses (for example requests for configuration or password files) or that repeatedly break the rules are blocked at the firewall by fail2ban, built from the access logs: usually for 24 hours, longer for repeat offenders (up to four weeks).

Client-Side Storage

Everything below stays in your browser, is never sent to us, and can be reviewed and deleted on the Your local data page (or with your browser’s “clear site data”).

• Preferences (localStorage): the names of tools you opened recently (opt-out on the homepage) and the tools you pinned, your light/dark choice, the language banner, which design you prefer (cr-ui: “Dashboard view” or “Classic view”), which sections you left open, and per-tool settings such as the Cipher Decoder’s options. No cookie is used for any of this.
• Work saved by a few tools (localStorage): some tools keep your answers or settings on this device so a reload does not lose them — for example the AI/ML Threat Model Builder, BIA / RTO-RPO Calculator, NIST CSF 2.0 Profile Builder and Tier Assessment, DORA Register of Information, NIST AI RMF Checker, OWASP LLM Top 10 Checker, MITRE ATLAS Search report, the GRC workspace and GRC tools such as the FADP Self-Assessment, Third-Party Risk register, Policy Document Generator and Incident Report Generator save as you work; the Regex Tester keeps its pattern boxes, the RSS Hub your hashtags and My feed sources (only if you allow it), the certification quiz your last scores and the Privacy Guides your checklist progress; the HTTP Request Builder and Sigma Rule Builder save only when you click save. Each tool has a clear or reset control.
• Drafts: text you type into tools is kept for the current tab only (sessionStorage, encrypted) so an accidental reload does not lose it; it disappears when you close the tab. Keeping drafts across visits is off by default: if you turn it on, drafts are encrypted (AES-256-GCM, key kept in this browser’s IndexedDB) and deleted after 7 days. Password fields and text that looks like a password, key or token are left out.
• Hand-offs (sessionStorage): tool-to-tool “Send →” and pre-filled forms pass through it; they are deleted as soon as the receiving tool reads them, or when you close the tab.
• Offline copy: a service worker keeps copies of the site’s style sheets, scripts, images and data files so they load faster, plus a simple offline notice page. Pages themselves are not stored. It contains only what our server sent, nothing you typed.

Workflows and the GRC trackers (DORA Compliance Checker, NIS2 Self-Assessment, ISO 27001 SoA Builder, the CSF snapshot in the Compliance Reference Database) can additionally keep a case in your browser (IndexedDB; small completion flags such as lab progress use a cr.flags.* entry in localStorage instead) so it survives a reload. This is off by default, starts only after you tick the toggle and accept a one-time visible prompt, is stored unencrypted on this device only, never syncs, and is never sent to us. Turning it off asks whether to keep or delete what is already there. To carry compliance progress to another machine, each tracker can export it as a single AES-256-GCM encrypted file protected by a passphrase you choose — the file is created and opened in your browser and is never uploaded.

Server Access Logs

Standard web server logs (Apache) record IP addresses, timestamps, requested URLs (including any query string), the browser name and the referring page. They are kept on our server in Germany (Hetzner) for about two weeks, then deleted. They are used for security monitoring (including the blocking described above) and, once a day, to count the public visitor stats. When a server-side tool sends your input in the address, that input is part of the logged URL; beyond these logs, no application-level logging of user input is performed.

Two small records come from the same traffic: for pages that do not exist we keep the address (without its query string) and the referring page, with a count — no IP address — so broken links can be fixed. There is no time limit: the list holds at most 3,000 addresses, and when it is full the least requested one is dropped to make room. And when you search certificate logs (DNS Mapper, Phishing Checker), crt.sh’s answer is cached under the domain name you searched for, so repeat searches do not hit crt.sh again; copies older than a day are deleted the next time anyone runs a new certificate search.

Counting the stats keeps only daily totals: numbers of visitors and page views, the most viewed pages (addresses without their query string, so nothing typed into a tool is kept) and grouped traffic sources (named search engines, AI assistants and social sites; everything else is “Other websites”). No IP address, browser string or full referrer is stored in the totals. No script, cookie or pixel is added for this — it uses nothing beyond the logs the server already keeps.

Security Headers

Every page is served with strict security headers including:

• Content-Security-Policy — restricts all resources to same-origin only
• Strict-Transport-Security — enforces HTTPS
• Referrer-Policy: no-referrer — no URL data leaked to other sites
• X-Frame-Options: DENY — prevents embedding in iframes
• Permissions-Policy — disables camera, microphone, geolocation, payment APIs

Legal Basis

CyberRamen.com is operated by johlem.net and hosted in Germany (Hetzner, inside the EU). We process the minimal data described above under the GDPR, Article 6(1)(f) — legitimate interest in keeping the site secure and running — and, for visitors in Switzerland, the revised Swiss Federal Act on Data Protection (FADP / nLPD, in force since 1 September 2023; its obligations are catalogued in our Compliance Reference Database with their GDPR counterparts, and you can self-assess against them with the FADP Self-Assessment). There is no consent banner because we use no tracking cookies, analytics or advertising.

Your Rights

Under the GDPR you can ask for access to the personal data we hold about you (Article 15), its correction (16) or deletion (17), or restriction of its processing (18), and you can object to processing based on legitimate interest (21). In practice the only personal data we hold is your IP address in the access logs (about two weeks) and, if a request of yours matched the blocking rules, in the firewall’s ban list and log (about five weeks); to find it we need the address and the approximate time of your visit. Contact us as described below. You also have the right to lodge a complaint with a data protection supervisory authority (Article 77), in particular in the EU country where you live or work or where you believe the infringement took place (in Switzerland: the Federal Data Protection and Information Commissioner, FDPIC).

Verify It Yourself

We encourage you to verify our claims:

• Open DevTools → Network tab — watch for external requests (there should be none on client-side tools)
• Open DevTools → Application → Cookies — only PHPSESSID should be present (Local and Session Storage hold the items listed above)
• Check Response Headers — verify CSP and security headers

Contact

Questions about privacy? Contact us via johlem.net.