Privacy

Usage analytics are a separate matter, and they are not anonymous. This page says exactly what is recorded, what is stored on your device, how long it is kept and how to have it deleted.

What is recorded

For each page you visit:

• The page address, page title and time on page
• The referrer (the page you arrived from) and any campaign parameters
• Your IP address, and the country, region and city derived from it
• Only if you accepted the notice: a device identifier, a session identifier, and your browser and device characteristics: browser, operating system, device type, screen and window size, timezone and language

This is used to understand which tools are used, how people find the site, and whether it works on the devices people actually have. It is never sold, and never shared for marketing.

Do Not Track is honoured. If your browser sends that signal, nothing is recorded and nothing is written to your device.

The choice you are given

The notice on your first visit is a real choice, not an acknowledgement. Nothing is stored on your device for analytics until you make it.

• Before you choose. We record the page, the referrer and the location from your IP address are recorded. No device identifier, no session identifier, and no browser or device characteristics are sent. Those page views carry nothing that links them to each other or to any later visit
• If you accept. A device identifier is stored in your browser and sent with each page view, which is what tells a return visit from a new one. Accepting also sends your browser and device characteristics
• If you decline. Nothing is sent at all, and any identifier already stored is deleted

You can change your mind at any time, from this page, under Your rights.

What is stored on your device

These are all of them. Nothing else is written.

el_tool_handoff is the only one that ever holds your content, and it is worth being precise about: sending a document from one tool to another needs it to survive one page load, so it is put in your browser's session storage and taken straight back out again. It is never transmitted, and closing the tab clears it regardless.

Share links work differently and are worth calling out: the content is encoded after the # in the URL, which browsers never send to a server. A shared link is readable by whoever you send it to, and by nobody else.

No cookies are set, for tracking or anything else, and there are no third-party analytics, advertising or tracking scripts, no external fonts and no CDNs.

How long it is kept

Analytics records are deleted after 90 days. A scheduled job removes page views older than that, and removes the device records they belonged to once no page view refers to them. Nothing is archived elsewhere first.

Who else processes it

Two service providers process the analytics data on our behalf, under contract and on our instructions only:

• A hosting provider, which serves the pages and receives the request (including your IP address, as any web host does) and keeps its own request logs under its own policy
• A managed database provider, which stores the analytics records described above

Neither ever receives the JSON, text or files you put into the tools, because that content is never sent anywhere. Neither may use the analytics data for its own purposes.

Both operate outside the European Economic Area, so analytics data is stored and processed outside the EEA. Those transfers rely on the standard contractual clauses in the providers' data processing terms. If you would rather your data were not transferred, decline the notice. Nothing is then sent at all.

Your rights

• Opt out. Decline the notice and nothing is sent. Do Not Track has the same effect, as does blocking the request or using private mode; nothing breaks if the count never arrives
• Withdraw consent. Use the control below. It is as easy to withdraw as it was to give
• Access and deletion. Records are keyed to the device identifier below. Send it to us and we will tell you what is held against it and delete it. We answer within one month; the button fills the identifier into an email for you

If you never accepted the notice there is no identifier to send, and nothing recorded can be traced back to you.

A note on compliance

This is a small independent site, not a company with a data protection officer. Rather than claim a certification, here is what is actually done, so you can judge it: the device identifier is stored only with your consent and is withdrawable here; the rest (page, referrer and IP-derived location) is collected as a legitimate interest and you can object by declining; records are deleted after 90 days automatically; you can ask what is held and have it removed; and your content is not part of any of it, because it never leaves your browser. Analytics is sent over HTTPS, limited to the categories above, size-limited and validated against this site's known pages. The endpoint is also rate limited so it cannot be flooded. That count is kept against a salted hash of your IP address, held only in memory and never written to the database.

If you think something here falls short, say so at the address below. We would rather fix it than argue about it.

Contact

Questions or corrections: scamplabs@gmail.com. Changes to this policy appear here with a new date, and anything significant is called out.