Privacy policy

This website

neatcodelabs.com is a set of static files. It sets no cookies, runs no analytics, and loads nothing from a third-party host — the fonts, images and stylesheets all come from this domain.

There is exactly one piece of JavaScript, /theme.js, and it does one thing: the light/dark switch in the header. If you use it, your choice is saved in your browser's own local storage under the key theme, so the site looks the same on your next visit. That value never leaves your device, is not a cookie, is not sent with any request, and identifies nothing — clearing your browser data removes it, and if you never touch the switch, nothing is stored at all and the site simply follows your operating system.

Cloudflare Web Analytics was previously enabled on this site and injected a tracking script into every page. It was removed on 25 August 2026.

The site is hosted on Cloudflare Pages. Serving a page necessarily means Cloudflare sees the request — your IP address, the URL, your user agent — and it processes that as our hosting provider under its own privacy policy. We do not have access to per-visitor logs, do not run any server-side code, and do not build any profile of visitors.

The contact form

The contact form posts to Web3Forms, which turns the submission into an e-mail and delivers it to us. It is used so that no e-mail address of ours appears in the page source for scrapers to harvest.

It fires only when you press Send — nothing is contacted when the page merely loads. Submitting passes the name, e-mail address, message and IP address you sent to Web3Forms, and then to us as e-mail. We use the address to reply and for nothing else: it goes on no list, and is shared with nobody.

Web3Forms' own retention terms are theirs, and are set out in their privacy policy rather than ours. If you would rather not involve a third party at all, open an issue on the relevant GitHub repository instead — that reaches us just as well.

TabGreater

TabGreater has no account, no backend and no analytics. Your phone connects directly to the exchanges' own public APIs, so the exchanges you use see your IP address and the pairs you watch. At most once a day it also fetches CoinGecko's public market-cap ranking, and that request carries your IP address too. Nothing is proxied through a server of ours, because there is no server of ours.

TabGreater is documented on its own site, and its full privacy policy lives there: tabgreater.com/privacy.

FixupXer privacy policy

FixupXer also has its own website, fixupxer.com; this section is the policy its Google Play listing links to.

FixupXer processes URLs entirely on your device. The app declares no Android permissions and makes no network requests of its own. It collects no personal information, no usage statistics, no analytics, no device information, no location and no identifiers of any kind.

What is stored, and where

All of it is local to your device, and none of it is uploaded or synchronised by the app:

• Preferences — cleaning and conversion choices, selected embed or reader frontends and any custom frontend domains you add, Browser Mode settings and action order, your preferred browser, remembered after-clean destinations (host to app choice only), theme, layout and history settings. Stored in Android's SharedPreferences.
• Conversion history — optional, on by default, and clearable at any time: the original URL, the cleaned URL, a timestamp and the kind of change made. Stored in a local database.
• Custom URL rules — optional: names, domains, patterns, replacements, templates, test URLs, ordering and local rollback snapshots.

When the Private Link Guard spots sensitive data in a link you enter — a token, an e-mail address, precise coordinates — the original URL is never written to history. If cleaning removes all of it, only the safe result is kept, marked "Input redacted for privacy". If any of it survives cleaning, nothing is saved at all.

Depending on your device and Google account settings, Android may include the preferences file in its own OS-managed cloud backup or device-to-device transfer. The local database — history, custom rules and rollback snapshots — is excluded from Android's automatic backup.

Files you export yourself

Rule bundles and settings backups are written only when you pick a destination through Android's own file picker. A settings backup is an unencrypted JSON file holding your settings, custom rules, frontend choices and the websites you saved an app choice for, but never your history or rule rollback snapshots. Either file can reveal private domains, patterns, test URLs or remembered hosts, so store and share it carefully. FixupXer never uploads them.

What happens after processing

Link conversions are plain text replacements — the app rewrites the address and never contacts the frontend itself. When you then choose to open or share the result, Android hands the URL to the browser, app or share target you chose, either for that link or in your after-clean settings, and any network request happens there, under that recipient's privacy policy. Copying places the URL on the Android clipboard. Help in the app's menu, and the links marked "Opens in browser" beside individual features, open FixupXer's online guide on GitHub in a separate browser, and only when you tap one. The app's problem-report option likewise hands off to another app, and only when you use it; FixupXer itself sends nothing.

Browser Mode is optional. If you turn it on and choose FixupXer as Android's default browser, the links Android routes to it are processed on the device and then passed on; FixupXer never loads the page itself. Where they go follows your after-clean settings: a preferred browser you set, or an app you saved for that exact website host, is used automatically for later links without asking again.

The canonical text is PRIVACY_POLICY.md in the app's repository, alongside the source that implements it.

FixupXer Telegram Bot

This is the one project that is not purely on-device, so it deserves the plainest description on this page.

• When the bot is in a group, Telegram delivers the group's messages to it so it can find links. To see ordinary messages at all, it has to be a group admin or have Telegram's privacy mode switched off by its operator, and either way it then receives every message in the group, not only those with links. Group members can see a bot's privacy setting in the member list. To remove an original it also needs the admin "Delete Messages" permission; without it, the bot only replies.
• When it changes a link, it posts its own message for each link, names the original poster, and carries the rest of the original text in the first of them to go through. It deletes the original only when every repost went through in full and it has permission to delete; otherwise, or when a message has too many links or is too long to repost whole, the original stays in the chat. For Facebook and YouTube links, which it cleans but does not rewrite, the reply carries both the cleaned and the original URL.
• Unless its operator switches statistics off, it keeps a local SQLite database on the machine it runs on. It holds Telegram user IDs, usernames and first and last names; chat IDs, titles and types; and the time of each conversion. It does not store message text or media. New records leave the link itself out, but rows written by older versions may still contain URLs, and upgrading does not erase them. There is no automatic retention period: the data stays until the operator removes it. Through the bot, only the Telegram accounts the operator names can see it, with the /stats command, as totals and rankings of the most active users and groups.
• So that /delete still works after a restart, it also records, for each repost, the chat, the repost's message ID, the original poster's user ID and a time. Records older than 24 hours are removed whenever a new one is saved.
• The operator can set FIXUPXER_DISABLE_STATS=1 to stop the database being created or written to; /delete then works from memory and forgets ownership on a restart. Switching it off does not delete anything already stored.
• To make the "Try another proxy" button work, the bot keeps recent reposts' text and links in memory only, for no longer than the button lasts: at most 24 hours, and never across a restart. None of it is written to the statistics database.
• The bot's own log messages leave out URLs, message text and usernames. Logs written by earlier versions are not cleaned retroactively.
• To make X/Twitter, Instagram and TikTok links preview, it rewrites them to third-party frontends, which are named in the project's README and are not run by NeatCode Labs. With health checks on, which is the default, the bot itself requests Instagram and TikTok links from those services and may follow their redirects. Telegram and each reader's app may then fetch the rewritten link to draw the preview. Those services can see the link's path and functional parameters, so a better embed does not mean more privacy.
• Captions, polls and edited messages are ignored. At most three links that need work are handled per message; past that, the original stays in the chat.
• Links under a spoiler, in a code block or behind a text label are skipped, so a repost cannot expose hidden content.

The bot is MIT-licensed and its whole source is public, so anyone can read exactly what it stores. The canonical description is the data section of the project's README, alongside the source that implements it.

If you would rather your group's messages did not reach a bot someone else operates, host your own instance. The Docker setup in the repository is for that, and it is the only way to be certain who runs the machine they reach. Telegram and the frontend services stay in the loop either way.

Internet Connectivity Checker

The checker stores nothing and has no configuration file. By default it requests https://www.google.com about every five seconds, and again whenever you choose "Check Now" from its tray menu. A failed request is retried a few times before the icon switches to disconnected and starts blinking.

That means Google sees a request from your IP address every few seconds while the tool is running, exactly as it would if you had that page open. Nothing is sent to us — we run no server for this — but this is worth knowing before you leave it running, and the address is a single constant near the top of the script if you would rather point it somewhere else.

Children

FixupXer, the Telegram bot and the connectivity checker are not directed at children under 13, and are intended for users aged 13 and over. FixupXer and the checker collect nothing about who you are. The bot does: its statistics database, described above, keeps the Telegram IDs and names of the people whose links it converts, unless whoever runs it has switched statistics off. TabGreater is covered by its own policy at tabgreater.com/privacy.

Changes to this policy

When an app changes what it stores, this page changes with it, and the date at the top moves. FixupXer and TabGreater keep their own policies beside their source, so those repositories' public commit histories record every change to them. The Telegram bot and the connectivity checker document their behaviour in their READMEs.

Questions

Anything unclear or wrong on this page is worth telling us about: use the contact form, the report option inside FixupXer, or open an issue on the relevant GitHub repository.