The tools in this catalog that transform text, JSON, tokens, times, and numbers do that work in the browser. The page you loaded came from the server. The paragraph you paste into a counter does not get posted back with the result.
What the server does store
The contact form stores the name, email, subject, and message so they can be read and deleted in the admin panel. A hash of the network address is kept with the message for rate limiting. Application logs record paths and errors. They are not a place for tool payloads, and the logger is written to drop fields whose names look like passwords, tokens, or message bodies.
Search queries are not added to the application log. Search result pages also ask crawlers not to index each query.
Optional services
Analytics and ads are off until an administrator saves a real measurement ID or AdSense publisher ID and turns the feature on. Even then, the scripts load only after the optional-cookie choice. Tool events, when enabled, send the tool name. They do not send the text box.
The consent banner is a basic gate. It is not a certified consent-management platform. If you operate the site for visitors in the EEA, the United Kingdom, or Switzerland, confirm the current Google requirements before you enable advertising.