{
    "title": "Free Online Tools Privacy and Signup Audit",
    "updated": "2026-08-06",
    "methodology": "This is a manual inspection checklist. A reviewer records visible workflow, notices, permissions, network behavior where authorized, and retention statements for each check.",
    "limitations": "The framework does not replace a legal, security, or privacy assessment and cannot confirm undisclosed server behavior.",
    "columns": [
        "Check",
        "Lower-risk implementation",
        "Higher-risk signal",
        "Reviewer question"
    ],
    "rows": [
        [
            "Account requirement",
            "No login for a one-time utility",
            "Forced signup before basic use",
            "Is identity necessary to complete this task?"
        ],
        [
            "Input processing",
            "Local browser processing where practical",
            "Unclear upload destination",
            "Where does the input go?"
        ],
        [
            "Retention",
            "Inputs clear after task completion",
            "Indefinite storage with no purpose",
            "How long is input retained?"
        ],
        [
            "Third-party scripts",
            "Minimized and documented",
            "Unknown trackers on sensitive forms",
            "Who else receives metadata?"
        ],
        [
            "Permissions",
            "No unrelated device permissions",
            "Requests camera, location, or contacts without need",
            "Does the feature require this permission?"
        ],
        [
            "Result export",
            "User chooses copy or download",
            "Automatic public sharing",
            "Who controls distribution?"
        ],
        [
            "Transport",
            "HTTPS",
            "Plain HTTP",
            "Is transport encrypted?"
        ],
        [
            "Privacy notice",
            "Tool-specific plain-language explanation",
            "Generic policy only",
            "Can a user understand the workflow?"
        ],
        [
            "Deletion",
            "Clear deletion or no storage",
            "No deletion route",
            "Can retained data be removed?"
        ],
        [
            "Ads",
            "Separated from controls",
            "Deceptive buttons or forced redirects",
            "Can users identify the real action?"
        ],
        [
            "Error handling",
            "Validation without exposing input",
            "Raw server errors with data",
            "Could errors leak user input?"
        ],
        [
            "Business model",
            "Clear limits and sponsorship",
            "Hidden data resale or dark patterns",
            "How is the tool funded?"
        ]
    ]
}