Zero telemetry by architecture: how I built 25+ dev tools that can't track you

Most "free online tools" are ad-tech in disguise. You paste a JSON blob or an API key into some formatter site, and your data travels to a server you'll never audit, gets logged somewhere you'll never see, and funds itself with the 14 trackers loading in the background.

I built Tulyro as the opposite of that: 25+ free developer and utility tools where tracking isn't just disabled — it's architecturally impossible. Here's how.

The architecture: there is no server

Tulyro is a statically exported Next.js site. There are no API routes, no database, no sessions, no server-side rendering at request time. The entire site is pre-rendered HTML, CSS, and JS served from a CDN. When you open a tool, your browser downloads the page and then the "backend" is... your own device.

That single decision eliminates entire categories of privacy problems:

• No data transmission. A JSON formatter that runs JSON.parse in your tab has nothing to send anywhere. There is no endpoint to receive your paste.
• No analytics scripts. No Google Analytics, no Mixpanel, no fingerprinting SDKs. Nothing phones home because there's no home to phone.
• No cookies. No consent banner needed — there's nothing to consent to.
• Works offline after first load. Once the page is cached, most tools keep working with the network unplugged. Try that with a server-side tool.

Concrete examples

• UUID generator uses crypto.randomUUID() — the browser's own CSPRNG. The UUID never exists anywhere except your tab.
• Password generator uses crypto.getRandomValues(). A server-side password generator is an oxymoron; this one can't leak what it never sees.
• JSON formatter / Base64 / Epoch converter / Case converter are pure functions over your input string. Input in, output out, nothing in between.
• QR code generator draws to a <canvas> locally. Markdown editor renders preview via a client-side parser.

The tradeoffs (honestly)

Zero-telemetry architecture has real costs, and I'll name them:

1. No cross-device history. Your conversions live in your tab. If you want sync, you need accounts and servers — which is exactly what I refused to build.
2. Bundle size discipline. Everything ships to the client, so every dependency is a download tax. I keep dependencies near zero and lazy-load heavy tools.
3. No server-side secrets. Anything needing an API key or private computation simply can't be a Tulyro tool. That's a feature boundary, not a bug.

Why this matters beyond privacy

Client-side tools are also faster (no round trips), cheaper to run (static hosting costs almost nothing — which is why the tools can stay free forever), and more resilient (no backend to go down, no database to breach).

The privacy pitch writes itself, but the engineering pitch is the real one: the simplest system that can do the job is a page with no server.

Try it / break it

Everything's at tulyro.online — the dev tools live under the dev section. Open devtools, watch the network tab while you format JSON: silence. That's the whole point.

If you find a tool that leaks anything, that's a bug and I want to hear about it. Feedback welcome.