MonkeeTools

Privacy, auditable

Most privacy pages ask you to trust them. This one is built so you don't have to: every claim below can be checked in your browser's developer tools in under a minute.

What is stored on this device

To make repeat invoices fast, the generator can remember things in this browser's localStorage, on this device only. Nothing here is sent to a server, ever.

• Your choice: nothing is stored until you pick "Yes, remember me" in the prompt that appears after your first download. If you decline, the tool still works for one-off invoices but remembers nothing. You can change your mind anytime in the History dialog; switching off clears everything already kept.
• What: your business profile (name, contact, payment details, payment link, currency, tax rate, logo if you add one, and whether you unlocked supporter logo branding), your saved clients (names and contact details), and your invoice history (up to 20 invoices, with paid/unpaid status).
• Where: localStorage in the browser you are using now, on this device only. It does not sync anywhere.
• When: after you opt in, as you use the tool. Your profile saves when you download a PDF; clients save when you invoice them; history grows with each download.
• Retention: it stays until you clear it. Clearing your browser's site data, or using a different browser or device, starts you fresh.
• Shared-device risk: anyone who opens this browser on this device can see your saved business details and invoice history. On a shared computer, use "Forget everything on this device" when you are done.
• How to erase: click "Forget everything on this device" in the History dialog. It removes your profile, clients, and history from this browser immediately.
• How to export: the History dialog also has "Download backup" (a JSON file with everything above) and "Export CSV" (your invoices in spreadsheet form). Take your data with you.

What stays in your browser

• Everything you type into the invoice editor: business and client details, line items, rates, notes, payment info.
• The PDF is generated locally on your device. Nothing is uploaded to render it.
• Sharing works through the URL fragment. When you send someone a link, the invoice data travels inside the link itself, from your browser to theirs; our servers never see it (we don't run an application server at all. The site is static files). One caveat: the link passes through whatever you share it with, your email or chat app, so send it only to the person it's for.

What leaves your browser: the complete list

Exactly three kinds of network requests:

• Sealed feedback / votes: when you use a feedback form or vote button. Payload: an encrypted envelope (see below). These are POSTs to our Cloudflare Worker, which stores the sealed envelope in our Cloudflare KV store. The Worker cannot read it; only ciphertext is stored.
• Sealed analytics events: anonymous events like page_viewed or pdf_downloaded, shaped {e, s, t} (event, random session id, timestamp). Page views also include pg, the page path (e.g. /freelancers/), so we can see which pages are useful. Our own team marks their devices with ?team=1, which adds a team:1 flag so we can separate our testing from real usage. Visitors are never flagged. No invoice content, ever. Also POSTs to our Cloudflare Worker, stored sealed in our KV store.
• Directory badge image: the homepage loads a static badge image from promptfrenzy.com, required for our listing in their AI directory. It is an image, not a script: it cannot read anything on the page, and it loads on the homepage only.
• Turnstile human check: the feedback form and tool suggestion form load one script from Cloudflare (challenges.cloudflare.com) to confirm you are human before your message sends, so spam bots cannot flood the board. Turnstile is used for abuse prevention only; it may process browser or device signals under Cloudflare’s privacy policy, and we do not use it for advertising.

There is nothing else. No page loads a third-party font; the invoice PDF embeds its own fonts. The only third-party script on the site is the Turnstile check on the two forms above.

How the sealing works

Before anything leaves your browser, it is encrypted with our public key using a hybrid scheme, all in native WebCrypto code you can read in the page source (search for sealPayload):

{
  "v": 1,
  "key": "<RSA-OAEP-SHA-256 sealed AES key>",
  "iv":  "<random 12-byte IV>",
  "data": "<AES-GCM-256 sealed payload>"
}

• A fresh 256-bit AES-GCM key is generated per submission; your message is sealed with it.
• That AES key is sealed with our 2048-bit RSA public key (OAEP, SHA-256).
• Our Worker only ever stores this ciphertext envelope. Only we hold the private key, which has never left our infrastructure.

Our RSA public key fingerprint (SHA-256 of the SPKI):
bc91:64b5:27d2:7b4d:a5a0:5d52:63cb:acde:cd2a:a14d:874b:971e:ebbe:4781:3b20:530a

Verify it yourself

• Open developer tools → Network, submit feedback, and inspect the request body: it is the ciphertext envelope above, not your message.
• View page source and read sealPayload. It's ~15 lines, no libraries, no obfuscation.
• Share an invoice link and watch the Network tab: the fragment (everything after #) never appears in any request.

Site security, honestly

• Every page ships a Content Security Policy (view source, it is the first meta tag): scripts and styles only from our own pages, plus the Turnstile script from Cloudflare on the feedback and tool suggestion forms; everything upgraded to HTTPS.
• No cookies. Check devtools → Application: there is nothing to steal.
• No third-party scripts, fonts, or trackers, except one: the feedback and tool suggestion forms use Cloudflare Turnstile to block spam bots. That is the only third-party script on the site. Turnstile is used for abuse prevention only and may process browser or device signals under Cloudflare’s privacy policy; we do not use it for advertising. The only other thing loaded from another server is a badge image on the homepage. Everything else comes from our own pages.
• One honest caveat: our static host does not let us set HTTP security headers (like HSTS, or frame-ancestors clickjacking protection), so automated header scanners grade us poorly. Those scanners grade server configuration. What protects you here is architectural: there is no server holding your data, so there is nothing to breach. Your invoices live in your browser's local storage, on your device, and nowhere else.

What we collect, and why

• Feedback: to decide what to build. Published on our feedback board only after human review, anonymously unless you ask to be named. An optional email is collected only if you want a reply; it is sealed like everything else and never published.
• Anonymous analytics: to measure whether the tool is useful (e.g. how many visits turn into downloaded PDFs). Random session ids, no identity.

History, honestly

Before 2026-09-12, submissions were sent as plaintext to a token-guarded inbox. That relied on the token staying secret, which is a weak guarantee once the token ships in public page source. So we moved to browser-sealed encryption and rotated every endpoint. The claims above describe the current behavior only.