Trust & Security
Last updated 2 September 2026. Everything on this page describes how MiniWebtool.com actually operates today. Where we do not have something, we say so.
Who runs MiniWebtool
Legal entityCosy Touch Limited
Registered inNew Zealand · NZBN 9429030636798
Operating the site since2010
Catalog1,920+ tools in 15 languages
Support[email protected]
Contact form/about/contact/
Payments and billing
- Checkout runs on Stripe's hosted page. When you subscribe to Pro or Premium you are redirected to a checkout page served by Stripe, Inc. (PCI-DSS Level 1). Card numbers are entered there and never reach MiniWebtool servers.
- What we store about a paid member: a Stripe customer and subscription reference, the email used at checkout, plan tier, status, price and billing interval, and timestamps. Nothing else.
- Statement descriptor: charges appear as MINIWEBTOOL.COM, billed by Cosy Touch Limited.
- Cancel and manage: the Stripe Customer Portal (via Manage subscription on the plans page) handles invoices, card changes, plan switches and cancellation. Cancelling stops all future charges; access continues to the end of the paid period.
- Refunds: there is no fixed refund window. If you cancelled and were still charged, or a charge looks wrong, email support before opening a dispute and we will locate the subscription and fix it.
- Legacy subscribers who signed up through PayPal or Patreon are still billed by those providers under their own terms, at their original rate.
No accounts, no passwords
MiniWebtool does not have user accounts. Paid access works through a signed membership cookie set on your browser after checkout, and free-tier usage is tracked through an anonymous visitor cookie. To use a subscription on another device, the Access Premium page emails a one-time restore link to the address you paid with.
- mwt_visitor_id
- Random identifier, 1 year. Used to count daily runs on metered tools and to attribute a purchase to the browser that made it.
- mwt_member
- Cryptographically signed membership payload, 1 year. Cannot be forged or edited client-side.
- Daily usage counters
- Kept in a cache keyed by visitor or member id and tool name, and expire automatically at midnight (America/Chicago). We do not keep a history of what you calculated.
- Device activations
- For paid members we record when a device is activated (visitor id, IP address, a hash of the browser user agent, timestamps) to detect account sharing, as described in the Personal Use clause.
What happens to what you type into a tool
- Most tools process your input on our servers to produce the result and do not store it. Standard web server logs (IP address, URL, user agent, timestamp) are kept for operations and abuse prevention, as described in the Privacy Policy.
- Tools labelled "AI" send the text you submit to Google's Gemini API to generate the result. That input is processed by Google under Google's API terms. Do not paste passwords, card numbers or other secrets into AI tools.
- Some media tools (for example the ffmpeg-based video tools) run entirely inside your browser using WebAssembly. Your files are never uploaded.
We only send transactional email: the one-time restore link from Access Premium, and replies to messages you send us. Receipts and invoices come from Stripe. We do not send newsletters or marketing email, and we do not sell or share email addresses.
Subprocessors and third-party services
| Provider | Purpose | Data involved |
|---|---|---|
| Stripe, Inc. | Subscription payments, invoices, Customer Portal | Payment details, email, subscription status |
| Hetzner Online GmbH | Server hosting | All request data in transit and server logs |
| Cloudflare, Inc. | DNS, CDN and edge proxy in front of the site; cdnjs for fonts and icons | IP address, request metadata |
| Google LLC | Google Analytics (usage statistics); AdSense and ad partners on free pages; Gemini API for AI-labelled tools | Analytics cookies and IP; ad cookies on free pages; text submitted to AI tools |
| Publift | Ad management on free pages | Ad cookies and page context |
| PayPal, Patreon | Billing for legacy subscribers only | Their own account data |
Ad scripts are not loaded for paying members, whose pages are served ad-free. Google Analytics runs on all pages. Google's Ads Settings lets you opt out of personalised ads.
Security practices
- All traffic is served over HTTPS; legacy hostnames redirect to the canonical https site in one hop.
- Membership cookies are signed with a server-side secret; forms are protected by CSRF checks; request parameters are size- and operator-limited to stop abuse.
- Browser-side media tools are isolated with cross-origin isolation headers (COOP/COEP).
- Stripe webhooks are signature-verified before any membership change is applied.
- For the developer API at api.miniwebtool.com, keys are stored only as a prefix plus cryptographic hash; see the API privacy addendum.
What we do not have
We are a small company and we would rather be precise than impressive:
- No SOC 2, ISO 27001 or similar third-party certification. We have not been audited.
- No public status page and no uptime SLA for consumer subscriptions.
- No bug-bounty programme. Security reports are welcome at [email protected] with "Security" in the subject and we will respond as quickly as we can.