Privacy policy
What you check stays yours
PayOps Kit’s tool pages compute every result on your own device, and its REST API and MCP server keep nothing you send. This page lists everything the site’s server does receive.
Last updated October 29, 2026
On the tool pages
- Routing numbers, IBANs, BICs, dates, codes, identifiers and amounts you type or paste are checked by JavaScript on the page. They are not sent to our server or anyone else, and not stored.
- To name the bank behind a routing number, the routing number page downloads this site’s public bank list for the number’s first four digits (its Federal Reserve routing symbol, which many banks share), such as
/static/rtn/0210.json. Those files are the same for everyone; the full number never leaves your browser. - Nothing you type is written to browser storage. Close or reload the tab and it is gone.
- The pages’ security policy only allows connections back to this site (
connect-src 'self'), and the only requests a tool page makes are the anonymous counters below and, on the routing number page, those bank lists. To check, open your browser’s developer tools, choose the Network tab and use a tool. - The identifier tool can run a Luhn check on a card number. Please don’t paste live card numbers: there is no reason to, even though the page never sends or keeps them (results show the number masked).
The REST API and the MCP server
When your software calls the REST API (/api/v1/…) or an AI agent calls the MCP server (/mcp), the values it sends are processed in memory to produce that one response, then discarded.
- Inputs are never stored, and never written to logs.
- Cloudflare’s automatic per-request logs are switched off for this site, and our own code logs only short tags (such as “rate limited” or an error type), never a request’s URL, body or values.
- Rate limits use the caller’s IP address (an IPv6 address is cut to its /64 network) for a minute to stop abuse; it isn’t kept.
- No key and no account, so we hold no identity for API callers.
What our server receives
The site runs on Cloudflare. Like any website, Cloudflare handles the connection, including your IP address, to deliver the pages and block abuse, under Cloudflare’s privacy policy. Beyond API requests, our own code receives only the following.
Anonymous usage counters
When you open a page or use a tool, the page sends the name of the event, such as page:iban, and nothing else; the server counts successful API and MCP calls the same way. The server adds one to that counter and to the same counter for the current day. No cookie, IP address, browser details or input value is stored with it. These are all of the counters:
| Counted when | Counter names |
|---|---|
| Page views. A page is opened (one counter per page). | page:homepage:routing_numberpage:ibanpage:bicpage:business_dayspage:ach_datespage:codespage:identifierspage:check_amountpage:api_docspage:use_casespage:termspage:privacypage:donatepage:donation_successpage:analyticspage:not_found |
| Tools used. A tool page shows its first result for your own input, once per visit to the page. Only the count is sent, never what you typed. | use:routing_numberuse:ibanuse:bicuse:business_daysuse:ach_datesuse:codesuse:identifiersuse:check_amount |
| REST API calls. A call to a tool’s REST endpoint succeeds. Only the count, never the input. | api:routing_numberapi:ibanapi:bicapi:business_daysapi:ach_datesapi:codesapi:identifiersapi:check_amount |
| MCP tool calls. An AI agent’s call to a tool on the MCP server succeeds. Only the count, never the arguments. | mcp:routing_numbermcp:ibanmcp:bicmcp:business_daysmcp:ach_datesmcp:codesmcp:identifiersmcp:check_amount |
| Downloads. A holiday list is downloaded as an .ics calendar file. | export:business_days:ics |
The totals are public on the analytics page: you see the same numbers we do.
Donations
On the donate page, the amount you choose is sent to our server, which asks Stripe to create a payment for exactly that amount. Your card or bank details go from Stripe’s payment form straight to Stripe and never reach our server. Stripe processes the payment under the Stripe privacy policy. Stripe’s code loads only on the donate and thank-you pages.
Cookies and storage
- PayOps Kit sets no cookies.
- Display preferences, like your choice of light or dark theme, are saved in your browser’s local storage. They never leave your device.
- On the donate and thank-you pages, Stripe’s payment form may set its own cookies to prevent fraud, as its privacy policy describes.
Questions
Email davidkaylor95+payops@gmail.com. The terms and conditions cover the rest.