Privacy
Short version: there are no accounts and no ads, the site uses Google Analytics to count visits, most tools send nothing anywhere, and the few that do are named below along with what is kept.
Analytics
The main site uses Google Analytics 4 (tag G-HQZR36ZX84), the only
third-party script on the site. It reports to Google which pages are viewed, the referring
page, screen size, browser and language, and an approximate location that Google derives from
your IP address and, by its own account, does not store. It sets the _ga and
_ga_* cookies so that repeat visits can be counted as one visitor.
What you paste into a tool is never sent to Google — the analytics tag sees the
page address, not the page contents, and the tool pages carry nothing you enter in their
address.
If you are in the EU, EEA, UK or Switzerland you are asked first. Where
you are is taken from the country Cloudflare attaches to the request when the site is served
through it, and otherwise from your browser's time zone; nothing is sent to anyone else to find
out, and when in doubt you are asked. Until you click Allow no analytics script is loaded and no
analytics cookie is set — not a reduced,
"cookieless" version either; nothing. Your answer is kept in one first-party cookie,
nyaa_consent, for 180 days, and the Analytics link in the footer lets you change it.
Everyone else gets the tag on load, with Google's Consent Mode set to deny storage for those
regions anyway, so a visitor whose clock says otherwise is not tracked either.
Embedded tools (/embed/…, the version other sites frame) load no analytics at
all; their visitors did not come here. A content blocker or Google's opt-out extension stops
the script wherever you are, and nothing else on the site changes.
What this site does not do
- No cookies beyond the analytics ones and the consent cookie above. Nothing else of the site's own.
- No local storage. Nothing is written to localStorage, sessionStorage or IndexedDB either.
- No other third-party scripts. No tag manager, no session recording, no advertising, no embedded fonts or widgets from anyone else. Every file except the analytics tag comes from this domain.
- No accounts. Nothing to sign up for, so there is nothing to lose.
- Nothing is sold or shared. There is no business model to sell it to.
What each tool sends
44 of the 52 send nothing at all. They run in your tab. What you paste into them does not leave your machine, and you can confirm that in your browser's network panel rather than taking it on trust.
Six query public providers directly from your browser. DNS Lookup, DNS Propagation, Email DNS Check, WHOIS/RDAP and ASN Lookup send the name or address you enter to public services — Cloudflare, Google, DNS.SB and AliDNS for DNS-over-HTTPS, rdap.org for registration records, RIPEstat for announced prefixes, and Team Cymru for routing data. Those requests go from your browser straight to them, so nyaa.tools never sees them and has nothing to log. The API Tester sends a request to whatever URL you type, and nowhere else.
Two go through this site's API. IP Lookup and Currency Converter use providers whose licence keys cannot be published in a browser bundle, so those requests pass through nyaa.tools. That is the one case where this site sees what you looked up.
What the API stores
- IP addresses looked up with IP Lookup are cached for up to 90 days. The address is the key of a row holding the geolocation result, so a repeat lookup does not cost another metered query. It is stored on its own, not linked to you, your session or anything else — but it is stored, and this is the page that should say so.
- Exchange rates are cached for one hour. They are facts about the world and contain nothing about you.
- Requests to the API are rate-limited per IP address, which means the address is held in memory briefly for counting.
Server logs
The site runs on Google Cloud Run, which records an access log line for each request: the IP address, the URL, the user agent and the time. That is ordinary web-server logging and it is how anyone would notice the site being scanned or falling over. It is not joined to anything, not used to build a profile, and not passed to anybody.
Embedded tools
Tools embedded in another site under /embed/ behave exactly as they do here: the
same tools send the same things, and the page embedding them cannot see inside the frame.
Changes
If what the site does changes, this page changes with it. It describes the code as it stands on 23 September 2026.