Privacy

Nothing you type into a converter leaves your browser. There are no accounts here, no record of anything anyone has converted, and no way for us to read what's in your input box.

Two things on this site do talk to other companies. Page views are counted through Fathom, and the ads come from Google. Everything below is what that means in practice.

StringMash is run by Rorz Network LLC. It decides what data the site collects and how it's used, so it's the controller of that data. Questions go to hello@stringmash.com, or by post to the address below.

Rorz Network LLC, 2108 N St, Suite 11952, Sacramento, CA 95816, United States.

Every conversion here is JavaScript running on your own machine. Type into the Morse translator or paste a blob into the cipher identifier, and the letters are turned round by code that arrived with the page. No request goes out. There's nothing to send.

We test that rather than assert it. A script types the marker CANARY-7f3a9c into the converter on all 85 pages that have one, changes a setting, clicks copy, downloads the output, then reads every request the browser made, 2,741 of them on the last run, looking for that marker as plain text, Base64, hex or percent-encoded. The build fails if it ever turns up.

It also means we can't recover anything for you, because we never had it.

Page views and the referrer that sent you, through Fathom Analytics. Fathom sets no cookies and builds no profile of you, so there's no consent banner for this part and nothing to opt out of.

On StringMash Daily and the cryptogram pages, Fathom also counts each solved puzzle, as an event named "Daily solved" or "Cryptogram solved". Nothing goes with it: no letters, no answer, no time. Your streak and progress stay in your browser's own storage.

In The Keeper's Watch, Fathom counts the start of a game, each of its eight steps, each hint you ask for and which ending you reach, as events such as "Keeper's Watch step: chest". No answers and no times go with them.

Fathom also counts which tools get used, so we know what to improve: an event such as "Used: caesar" the first time you convert your own text on a page, and "Copied", "Downloaded", "Printed" or "Shared" with the tool's name when you press those buttons. The name comes from the site's own list of tools. What you typed, what came out, and any setting you chose never go with it.

Copy link puts your text and settings after the # in the link it copies. Browsers never send that part of an address to a server, so when someone opens your link, the text goes from the link into their browser and nowhere else.

Its script loads from cdn.usefathom.com, which means Fathom's servers see that request and the IP address it came from, the same as any other file your browser fetches. What you typed isn't in that stream. It never gets that far.

Two things are kept in your own browser and never sent anywhere. Your tools is the list of pages you starred, kept in local storage so the home page can show them. And once you've opened a page, or pressed Save for offline on the geocaching toolkit, your browser keeps its own copy of the page and its code, so it works with no connection. Clearing this site's data in your browser removes both.

The site is paid for by display ads from Google AdSense. Google and the vendors it works with may store and read cookies or device identifiers in your browser to pick which ads you see, to cap how often you see the same one, and to tell whether anyone clicked.

Google describes that in its own note on how it uses information from sites that use its services, and you can change what it personalizes for you at My Ad Center, which covers every site at once rather than this one.

The ad code loads after the converter is ready to use, and nothing from the converter is ever handed to it. It knows which page you're on. It doesn't know what's in the box.

You'll see a consent dialog before any ad loads. It comes from Google's certified consent platform and follows the IAB's Transparency and Consent Framework, which is what Google requires of every site showing its ads to you.

Say no and the ads go non-personalised. Every converter works the same either way. Your answer is kept in your own browser, so clearing site data for stringmash.com brings the dialog back if you want to change it.

The web server keeps one line per request: the IP address, the path asked for, the referrer and the browser's user-agent string. That's Caddy's standard access log, and it goes to the host's log stream, where it's read when a route breaks or 404s spike.

It isn't joined to the analytics and it isn't used to build a picture of anyone.

This page was last changed on 4 November 2026. If what the site does changes, this changes with it.

Anything you want to ask about the above goes to hello@stringmash.com.