The short version: the tools run inside your browser, we never see what you type into them, and we set no cookies. The detail is below.
Last updated: 29 August 2026
Who is responsible. This site is operated by Hagar Shaul, a sole proprietor registered in Israel as an Osek Patur, who is the data controller for the limited personal data described below. Contact: hello@cradrill.com.
The tools run locally. The drill and the security.txt generator execute entirely in your browser. Your answers and inputs are never transmitted to us and are not stored anywhere except your own device (if you download a report).
The reporting assistant at /app/ is different. It loads no analytics, no fonts and no third-party scripts of any kind, and its content security policy forbids them. Everything you enter there, live incident detail included, stays in your browser and is never transmitted. You can check this yourself rather than take our word for it: open your browser developer tools, switch to the Network tab, and use the tool. It stays empty.
Hosting. This site is served by GitHub Pages, which may log standard technical data (IP address, user agent) per GitHub's privacy statement. We use Cloudflare Web Analytics to count page views and drill completions. It is cookieless, does not fingerprint devices and does not track you across sites (see Cloudflare's description). We set no cookies.
Purchases. Checkout is handled by Paddle.com Market Ltd as our merchant of record. Paddle collects and processes your payment and billing details under its own privacy policy and acts as data controller for that payment data; we never see or store your card details. We receive only the order metadata needed to fulfil and support your purchase (product purchased, transaction reference, and the email address you gave at checkout).
Contact. hello@cradrill.com.