Security

How KORIXA protects the site and your data, in plain language.

Local processing: every tool on this site runs entirely inside your web browser. The numbers, text and files you enter are processed on your device and are never uploaded to or stored on our servers. There are no user accounts and no database of user data.

Third-party requests: a small number of tools fetch public data over HTTPS while you use them — currency exchange rates (open.er-api.com), IP address lookups (ipapi.co, which necessarily sees the IP being looked up) and Quran verse text (api.alquran.cloud). No other tool sends your input anywhere.

Analytics and logs: we use Google Analytics and Cloudflare Web Analytics to measure page views in aggregate, and our hosting provider (Cloudflare) keeps standard technical request logs for security and performance. These flows are described in the Privacy Policy.

Site protection: the site is served exclusively over HTTPS with HSTS and carries hardened browser headers — Content-Security-Policy, X-Frame-Options, X-Content-Type-Options, Referrer-Policy and Permissions-Policy. The private admin area is protected by a password, signed session cookies (HttpOnly, Secure, SameSite=Strict), per-request CSRF tokens and login rate limiting.

Responsible disclosure: found a security issue? Please tell us before publishing it. Email roplizeramr@gmail.com — see /.well-known/security.txt. We read every report and respond to most within a few days.

This page describes only what the site actually does, and we update it whenever the architecture changes. Last reviewed: 2026-10-04.