Privacy Policy

What goes in the address bar

Most calculators put what you typed into the page’s own web address, so that a result can be bookmarked or sent to somebody. That is the point of it — a link to a mortgage at your numbers rather than at ours — but it means those values are part of a URL, and a URL travels further than the page it belongs to.

• While you type, nothing is sent. The address is rewritten in your browser only. No request goes anywhere, and the page-view counter is given the path without the values — it could not record them even if it wanted to.
• If you reload the page, or open a link somebody sent you, the whole address is part of that request, including the values in it. Our hosting provider records the addresses it serves, as every web host does, so a figure carried in a link can appear in those records.
• Anywhere you paste the link. A chat app, an email, a bug tracker — the numbers travel with it, and whoever receives it can read them.

Which is why the tools handling anything genuinely sensitive are deliberately built the other way. A generated password, a passphrase, a secret key, a TOTP secret, an HMAC key, the contents of a QR code, and text pasted into the counters, formatters and converters are never put in the address bar under any circumstance. They exist in the page and nowhere else, and closing the tab discards them.

If you would rather a figure did not travel at all, clear the values before you share the link, or use the tool and copy the answer instead of the address.

The short version

• Nothing you type is sent to us — there is no server here to receive it. Every calculation runs in your own browser, with one exception:
  • The Product Ingredient Checker sends the barcode you type to Open Food Facts, to look the product up, only when you press Look up.
• We count page views ourselves, in totals per day. Nothing profiles or follows visitors, and nothing is stored on your device to do it.
• Five settings you chose are remembered on your device — light or dark, 1 or 0, simple or advanced, a three-letter currency code such as USD or EUR, km or mi. None of it is ever sent anywhere.
• Our hosting provider keeps ordinary server request logs, as every web host does.
• Advertising is served by Google AdSense, which uses cookies and similar technologies. The advertising section below explains it and how to opt out.

Who is responsible

Free Handy Tools at https://www.freehandytools.com is published by Free Handy Tools and operated from the United States. That is the operator and the data controller for the limited processing described here: a personal project run under a trading name rather than a company, which is why there is a trading name here and not a registration number. For any question about this policy, or to exercise a right under it, use the contact form. It is the only route in, it reaches the one person who runs the site, and there is no separate data protection officer because the same person reads everything.

What you type into a tool

We do not collect it. Not in a reduced form, not in aggregate, not temporarily. The calculators are client-side code: the numbers, dates and text you enter are processed by JavaScript in the page and are never sent to a server of ours, because there is no application server here to send them to.

That is a statement about Free Handy Tools and not about the whole internet. The next section is the edge of it.

Concretely, that means:

• Passwords produced by the Password Generator are generated locally using your browser’s cryptographic random number generator. They are never transmitted, never logged and never seen by us.
• Text and JSON pasted into the Character & Word Counter, the JSON Formatter or the Text Case Converter stays in the page. Closing the tab discards it.
• Salaries, loan balances, debts, dates of birth and retirement ages entered into the financial and date tools are used to draw the result on screen and nothing else.
• QR codes are drawn in the browser from the text you supply. The content is not sent to any QR service.

Two mechanics are worth knowing about. The Countdown Timer keeps its target date in the page URL so a countdown can be bookmarked or shared, which means anything encoded in that link travels with it if you paste it into a chat or a document. And several tools offer a copy button, which writes to your device’s clipboard and nowhere else. Neither sends anything to us.

The one tool that asks somebody else

Some data is not ours to hold. Where a tool needs a fact this site has no business keeping a copy of, it asks the organisation that publishes it, and your browser makes that request directly rather than routing it through us. There is one such tool, out of 175:

• Product Ingredient Checker sends the barcode you type to Open Food Facts, to look the product up, only when you press Look up. What undefined does with it is governed by their privacy policy, not by this one.

We never see what you typed into it, the answer that came back, or the fact that you asked. Nothing about the lookup is stored or counted anywhere on this site, and opening the page sends nothing at all — the request happens when you ask for it and not before.

What is stored on your device

Five items, all in your browser’s local storage and all settings you chose yourself:

• theme holds light or dark, so the site does not flash the wrong colour scheme at you on every visit.
• fht:menu-folded holds 1 or 0, so the menu does not spring back open on every page after you fold it.
• tool-mode holds simple or advanced, so a tool you switched to the advanced view opens that way next time.
• tool-currency holds a three-letter currency code such as USD or EUR, so the money tools do not open in the wrong currency every time.
• tool-distance-unit holds km or mi, so the pace and distance tools do not open in the wrong unit every time.

None is a cookie, none is ever transmitted to us or to anyone else, and none contains anything that identifies you — between them they hold a handful of possible values, every one of which you set. They are not used for analytics: the counters described above run whether these exist or not, and cannot read them.

You can remove them at any time by clearing site data for this domain in your browser settings. The site will fall back to your operating system’s light or dark preference, with the menu open and every tool on its default units.

What our host records

The site is served as static files by a hosting provider. Like any web server, it records the ordinary details of each request: IP address, user agent string, the URL requested, a timestamp and a referrer if your browser sent one. Those logs exist to deliver the site, keep it up and defend it against abuse — the lawful basis is our legitimate interest in operating a working, secure website — and they are retained by the provider under its own policy. We do not run any product on top of them that builds visitor profiles.

Analytics

We count page views ourselves, and nothing else. There is no Google Analytics, no Plausible, no Fathom, no heatmap tool and no session-recording script, and no third party receives anything.

When a page loads, your browser sends us the path you opened, whether it was the first page of your visit, and the host of the site you came from — never the full referring URL, so a search you typed never reaches us. On the first page of a visit it also sends which of five width bands the window falls into, such as “up to 640 pixels”, and never its exact size.

On that first page only, we also record three things from the request your browser already sends and one from our host: whether you are on a phone, a tablet or a desktop; the browser family (Chrome, Safari, Firefox, Edge, Samsung Internet or other); the operating system family (iOS, Android, Windows, macOS, Linux or other); and a two-letter country code, and the city that country code came with. Your browser’s user-agent string is reduced to those three families as the request arrives and is never written down. The country and the city are both attached by our host, which derives them at its own edge, so no part of this counter reads, stores, logs or hashes your IP address to produce either. We do not record a region, coordinates or a timezone, and we do not record any version number. Anything we do not recognise is counted as “other” rather than stored as it was sent.

Every city is named on our dashboard, including one that a single visit came from. There used to be a threshold — a place had to be shared by twenty-five visits before we saw its name — and it has been removed deliberately, so this paragraph has been rewritten to say what is now true rather than what was.

That is worth stating plainly rather than burying. A country is a population of millions and hides everyone inside it. A town with one visit does not: on a quiet day, a single named place can be a single person. What has not changed is that the city is not joined to anything else — not to the page you opened, the browser you used, the device you were on or the time you arrived. Those remain separate daily totals with nothing connecting them, so what we hold is “one visit from Heidelberg” and never “the person from Heidelberg who read this page”.

If you would rather not be counted at all, any content blocker that stops requests to /api/hit will do it, and nothing on the site behaves differently when it is blocked. We would rather tell you that than have you find out.

We also record how long a page was open, as one of six bands — under ten seconds, up to thirty, up to a minute, up to three, up to ten, or longer. Your browser works out which band applies and sends only that word; the actual number of seconds never leaves your device. Time is counted only while the page is actually visible, so a tab left open in the background is not counted as reading. This is recorded against the page, not against you: it is a tally of how many page views fell into each band, with nothing recording which views were yours or that any two of them were the same person.

Each of those is a separate daily total, and they are never combined. We hold “Chrome: 412” and “phone: 380” as unrelated numbers — not “a Chrome visitor on a phone with a 640-pixel window in Germany”, which would be a description of a person rather than a shape of an audience. There is no way to put them back together, because nothing that connects them was ever written down.

No cookie is set, nothing is stored on your device, no identifier or fingerprint is created, and your IP address is neither stored nor read by the counter. The figures are totals per day: two visits are indistinguishable from one person visiting twice. Since city names are no longer withheld, we will not claim that nothing here could ever be traced back to anyone — on a quiet day a single named town is a smaller hiding place than a country. What we can say is that nothing identifies you, nothing follows you to another site, and nothing joins one of these figures to another. Totals are deleted after 400 days.

Advertising

This site is funded by advertising served through Google AdSense. The rest of this section describes how that works and what you can do about it.

Google, as a third-party vendor, uses cookies to serve ads on this site. Google’s use of advertising cookies — including the DoubleClick cookie and equivalent device identifiers — enables it and its partners to serve ads to you based on your visit to this site and other sites on the internet.

Third-party vendors and ad networks may also serve ads here. Where they do, they may use cookies, web beacons and similar technologies to measure the effectiveness of an advertisement and, subject to your choices, to personalise what you are shown. We do not receive the data they collect and we do not have access to their cookies.

We do not pass anything you type into a tool to Google or to any other advertising system. No tool value is put into an ad request, a targeting parameter, a page title, an analytics event or a URL that advertising reads — and nothing in this site’s code is built to do any of those things.

It is worth being exact about how far that goes, because the comfortable version of this sentence would be a false one. Google’s advertising tag is ordinary JavaScript loaded into this page, the way every advertising tag on every site is; it is not sealed off in a frame, even though the advertisements it eventually draws are. So the honest claim is about intent and design rather than about impossibility: we do not send your inputs to advertising, we have written nothing that could, and we would have to add code on purpose for that to change. If you would rather no third-party advertising code ran at all, a content blocker stops it, and every tool on this site works exactly the same without it.

Opting out of personalised advertising

• Google Ads Settings turns off personalised advertising from Google across the sites you visit.
• optout.aboutads.info and optout.networkadvertising.org cover many US vendors at once.
• youronlinechoices.eu is the equivalent for the EU and UK.
• Google explains what it collects across the sites that use its services in How Google uses information from sites that use its services, and describes its advertising technologies in its advertising policy.
• Blocking third-party cookies in your browser, or using a content blocker, also works. Nothing on this site depends on advertising being allowed to run — if the ad code is blocked, the space it would have occupied is removed and every tool continues to work normally.

If you are in the EEA, the UK or Switzerland

Non-essential cookies are only set with your consent. A consent notice built on a Google-certified consent management platform asks for that consent before any advertising cookie is used to personalise what you are shown, records your answer and passes it to Google under its EU user consent policy. You can refuse, and you can change or withdraw an answer later through the same notice; refusing means you may still see advertisements, but they will not be personalised.

The legal bases we rely on are consent for advertising and any non-essential storage, and legitimate interests for the security and delivery logs described above.

If you are in California

We do not sell personal information for money and never have. Serving personalised advertising can nonetheless amount to “sharing” personal information for cross-context behavioural advertising under the CCPA as amended by the CPRA. A “Do Not Sell or Share My Personal Information” control is offered through the same consent notice, Google is instructed to apply restricted data processing for visitors who opt out, and the Global Privacy Control signal sent by your browser is honoured as an opt-out request in its own right. You can also ask through the contact form; we will not discriminate against you for exercising any of these rights.

Your rights

Depending on where you live, you may have the right to access a copy of your personal data, to have it corrected or erased, to restrict or object to its processing, to receive it in a portable form, and to complain to your national supervisory authority.

In practice we hold almost nothing to which those rights can attach, and we cannot identify you from a server log entry without more information than we would ever ask you for. Where the data you care about is held by Google as an advertising vendor, the request has to go to Google — the opt-out links above are the fastest route. Ask through the contact form and you will get a straight answer about what does and does not exist.

Children

This site is not directed to children under 13 and we do not knowingly collect personal information from them. Advertising served here is configured as non-personalised for users identified as children where the ad platform provides that control. If you believe a child has provided personal information through this site, say so through the contact form and it will be dealt with.

International transfers

Our hosting provider and Google are both US-based companies operating global infrastructure. Requests to this site and the advertising data described above are therefore processed outside the EEA and the UK, under the transfer mechanisms those providers publish in their own terms.

Other sites

Advertisements and occasional reference links lead to sites we do not run. This policy does not cover them, and we have no control over what they collect. Read their policies before giving them anything.

Changes to this policy

This policy changes when the site does, and the sections above are written to change with it rather than to be corrected afterwards: what they say about advertising is decided by whether advertising is actually being served here, not by what was true on the day they were typed. The date at the top is the date of the current version. Material changes are reflected here before they take effect, not after.

Questions go through the contact form. See also the terms of use and about page.