Tools that stay on your device

• Cipher and code tools run entirely in your browser. Plaintext, ciphertext, and keys are not transmitted to a server.
• The Multi Decoder runs every decoder locally, including syllable counts, which use a CMU Pronouncing Dictionary bundle loaded from this site on first use. No input is transmitted. Share links (e.g. #md= hashes) are only created when you click the Share button, and the encoded payload stays in the URL fragment.
• The Coordinate Converter and Frequency Analyzer compute results locally.

Tools that call out to a service

• Map tiles are loaded from third-party providers (Mapbox, OpenStreetMap, Esri, OpenTopoMap) on the site's mapping pages. Their privacy policies apply when their tiles are requested. The Wherigo Player is the exception and uses a different, more private map path, described on the Waypost page.
• Coordinate decoding for Mapcode and reverse-geocoding call out to public APIs (mapcode.com, nominatim.openstreetmap.org) only when you submit a coordinate to those features.
• The ISBN tool looks up book details by sending the ISBN you submit to Open Library (openlibrary.org/api/books). Only the ISBN is sent; their privacy terms apply. Amazon and Google fallback links are constructed locally, no request is made to those services unless you click the link.
• Elevation lookups call out to cachesleuth.opentopodata.org, a third-party endpoint operated by OpenTopoData on a CacheSleuth-branded hostname. Despite the cachesleuth in the URL, the request leaves CacheSleuth's infrastructure and is served by OpenTopoData; their privacy and usage terms apply. Only the coordinate you submit is sent; no other input from the page is included.
• The Wherigo Solver uploads cartridges to api.cachesleuth.com for parsing. Cartridges are processed in memory and are not stored long-term. After parsing, the solver may also fetch the public cartridge-details page on wherigo.com and any referenced geocache pages on geocaching.com through a CORS-bypass proxy at proxy.cachesleuth.com in order to enrich the displayed result with author and cache-title info. The proxy only fetches the public URLs the cartridge already references; it does not see anything you typed.
• Translation. When you pick a language from the footer dropdown, CacheSleuth sends the static UI strings on the current page (button labels, headings, descriptions, tool names) to CacheSleuth's translation service at cs-translate.cachesleuth.com for translation. Your tool input is not included. The translator only sees the same text the page would show to a guest browsing in English: nothing you typed into a textarea, dropped into a file input, pasted into the coordinate box, or entered into the contact form. Form fields, your chosen text, your uploaded cartridges, and anything else you enter into a tool stay in your browser. Translated results are cached on the translation service and in your browser's localStorage so the same string is not re-sent across visits or across visitors.
• Donations route through PayPal; CacheSleuth does not receive your payment details.

Cache checkers and game pages intentionally log the answer you submit. That is covered in detail on the Cache Checkers page.

What is never sent

Anything you type, paste, or drop into a tool (puzzle clues, cipher text, plaintext you're encoding, coordinates, keywords, pad characters, cache pages, notes) stays in your browser. CacheSleuth runs the decoders, encoders, coordinate parsers, and analyzers locally using JavaScript on the page you have open. The site has no server-side database for puzzle inputs and never sends them to a logging endpoint. The exceptions are the ones listed above, and no other tool transmits what you type.