Last updated: September 2026.

The short version

Your controller’s data — every button, axis and reading — stays inside this tab on this device. GamepadTest is a static site: files are delivered to your browser and everything after that happens locally. There is no backend endpoint for pad data, so exfiltrating it isn’t merely disabled — there is nowhere to send it. You can load the page, go offline, and the tester still works completely.

What the page can see

Once you press a button, the browser exposes the pad’s ID string, layout, button and axis state, timestamp, and rumble capability to this page — the minimum the Gamepad API offers. Before your first press, browsers expose nothing (that’s deliberate on their part). Nothing the page reads is transmitted or persisted: no cookies, no localStorage, nothing to clear because nothing was written.

Server-side data

Cloudflare, the host, processes routine request metadata — IP address, user agent, timestamp — to deliver static files and resist abuse. That is the complete server-side trail.

Usage counting

A small cookieless ping (page address, referring site, country as reported by the CDN, time on page, and anonymous feature-use counts like “a drift check ran”) helps us see which parts get used. It carries no cookies, no identifiers, and never any input values.

Advertising

If ads are shown, partners such as Google AdSense may use cookies to serve and measure advertising; personalization can be disabled in your Google ad settings. Ad code has no access to your gamepad data.

Questions

hello@tolerence.net, or the contact page.