Utility Matrix is a collection of free, browser-based DevSecOps tools. We take privacy seriously.
Tool calculations run locally in your browser. Input data you enter into tools — CVE IDs, code, manifest content, domains, or other data — is not sent to Utility Matrix during normal calculation. If you explicitly create a share-result link, we store the displayed result and limited numeric/boolean fields for up to 30 days so that link can load; free-text inputs are not stored.
Utility Matrix also exposes server-side MCP tools for agents. Inputs sent to an MCP tool are transmitted to and processed by the Utility Matrix edge runtime; they do not stay in your browser. MCP telemetry records aggregate operational metadata such as the tool name, vertical, event type, surface, tier, chain depth, basis, and a random event identifier, but does not log the tool input itself. Do not send live passwords, API keys, private keys, tokens, or other active production secrets to MCP endpoints. MCP input schemas impose bounded field lengths to reduce accidental oversized submissions.
MCP operational event metadata sent to Cloudflare Workers Analytics Engine is retained for three months under Cloudflare's published retention policy; these telemetry records do not contain tool inputs. You can stop future MCP processing by removing or disabling the connector in your assistant, refrain from sending sensitive inputs, and contact us through the contact page with privacy questions.
We may use privacy-respecting, cookieless analytics to understand aggregate page traffic (page views, referral sources). Analytics does not receive tool inputs, and we do not maintain first-party user profiles; the explicit share-result storage described above is a separate, user-requested feature. Cloudflare, our infrastructure provider, processes standard request metadata such as IP address, country, user agent, request path, and timestamps for routing, security, and reliability.
Some pages contain affiliate links to third-party services. Clicking these links may set cookies on third-party sites. We have no control over third-party data practices. Affiliate links are marked with rel="sponsored nofollow noopener noreferrer" where required.
Utility Matrix may set signed first-party attribution cookies named __Host-um_acq and __Host-um_pump after an attributed continuation or an arrival from an embedded Utility Matrix widget link (a registered embed, or a WordPress site whose administrator turned on the optional link back). Each expires after seven days and carries limited source and owned-asset attribution so a later outbound action can be measured accurately. It does not contain tool inputs, account identifiers, names, email addresses, or a cross-site advertising profile. The cookie is not set when signed attribution is unavailable. Cloudflare may separately set operational or security cookies at the edge.
If you have questions about this privacy policy, please use the contact page.