Decision inputs and results
Your question, situation and options are sent over HTTPS to Ask To It’s Cloudflare Worker and then to TypeSafe for a Jev evaluation. A stress test sends several variants of the same input (options reversed, one fact left out at a time). The structured result returns to your browser or API client.
Ask To It keeps a copy of each decision that passes the browser check or API key check in a private log for up to 30 days, so errors can be traced and fixed. An entry holds the question, situation, options or levels, the result or error, the processing time, whether it came from the web, the API or MCP, and for API calls the first 12 characters of the API key’s fingerprint. It never holds your IP address, pass key or API key. Only the operator can read the log, after signing in through Cloudflare Access; it is never published or shared. Entries are deleted automatically after 30 days, or sooner once the log reaches 20,000 entries. To have an entry removed earlier, email hello@emreisik.dev with the question and roughly when you asked it.
A draft you start on the home page, or leave on the desk while you check out, is kept in this tab’s session storage and removed when the desk opens it again. The desk keeps the current input and result in page memory until you refresh or close it.
Browser verification and free limits
Before a decision request, Cloudflare Turnstile checks the browser for abuse. Its script runs on the desk; the Worker sends the short-lived verification token and your IP address to Cloudflare for validation. Ask To It does not store the token.
To keep 100 free decisions a day available, the Worker turns your IP address into a keyed one-way hash for the current UTC day. A Cloudflare Durable Object stores that hash and a count for the day. The raw IP address is not stored in Ask To It’s usage database. Standard Cloudflare infrastructure and security logs may still process request metadata such as IP address and timing.
Developer API
If you create an API key, this browser stores the random key in local storage. The Worker stores its one-way fingerprint, whether it is active, and the fingerprint of its linked pass; it cannot recover the key. API requests use the key for authentication without a browser challenge. The daily quota stores keyed IP and API key fingerprints with counts. You can revoke a key from the developer page or API. Revocation does not erase a linked pass balance.
The Worker records aggregate counts and total processing milliseconds for successful decisions, split between website and API. The public daily average is calculated from those totals. No question, result, key or raw IP is included in the public metrics.
Passes and payments
When you buy a pass, your browser creates a random pass key and saves it in local storage, with a cached balance and the IDs of checkouts still being confirmed. The Worker receives the key only to compute its SHA-256 fingerprint. Ask To It’s ledger stores that fingerprint, the credit balance and the Stripe Checkout Session IDs that funded it. It never stores the key itself.
Payments are handled on Stripe’s hosted checkout. Stripe receives your payment details and email under its own policy; Ask To It never receives your card number. The checkout record includes the pass fingerprint and the pass you chose, so credits can be added to the right key.
Providers
Cloudflare hosts the site and Worker. TypeSafe processes decision inputs and outputs. Stripe processes payments. PostHog, on its EU cloud, processes usage analytics. Read TypeSafe’s privacy policy, Cloudflare’s privacy policy, Stripe’s privacy policy and PostHog’s privacy policy for their practices.
Cookies and analytics
Ask To It sets no cookies and runs no ads. To learn which pages lead to real use, it counts page views and five actions with PostHog in cookieless mode: a completed decision, a started checkout, a completed pass purchase, a created API key and a shared result link. Nothing is stored in your browser for this, and it loads only after the page has finished loading.
The desk keeps your last 30 questions, their top result and any outcome you mark in this browser’s local storage, so you can reopen them. Your situation text is not kept there. This history never leaves your device, and Clear history removes it. A shared result link carries the result inside the link itself; nothing is stored on our servers, and your situation is included only if you tick Include my context.
Each event carries the page address without its query string, plus the decision format, whether it was a stress test, the pass size and the page language. It never includes your question, options, context, pass key or API key. The events travel through askto.it, which forwards your IP address and browser details to PostHog so it can count unique visitors with a hash whose salt changes every day, instead of a cookie. Analytics does not load when your browser sends Global Privacy Control or Do Not Track.
Stripe’s checkout pages, on Stripe’s domain, use their own cookies. Copying a result or a pass key places text on your clipboard only when you ask.
Contact
For privacy questions, email hello@emreisik.dev.