Privacy Policy (Data Protection and Cookies)

We collect only the personal data necessary to provide our services and ensure security:

• Account Information: Email address, chosen username, hashed password, country/region, city, and date/time of creation. We also record the user's IP address at signup (and each login) to prevent abuse or fraud.
• Contact/Support Data: If you use our contact form or email us, we collect your name and email address to respond.
• Usage and Analytics Data: We use Google Analytics to collect anonymized usage data (pages visited, session duration). Google Analytics sets first-party cookies to track usage, acting as a processor of this data.
• Payment Data: For paid subscriptions or donations, we collect data necessary to process your transaction via PayPal (email, transaction ID, amount). We do not store full credit card or bank details; these are handled securely by PayPal.
• Profile Images: If you upload a profile picture, it is stored via our ImageKit service. We collect no special category ("sensitive") personal data (no health, race, religion, etc.), and we never sell or trade your data.
• No Targeted Advertising (Internal): We do not use profiling for marketing. We only run Google AdSense for ads. Google may use cookies for ad personalization based on your browsing history.

We process your data only for legitimate purposes:

• To provide and improve services: Managing your account, delivering free tools, and sending transactional emails.
• To process payments: Necessary to fulfill any contract (service you purchase) and for fraud prevention. PayPal handles sensitive details under its own privacy terms.
• To prevent fraud and abuse: We use your IP address and location to enforce usage limits on free accounts. This is a legitimate interest to protect our service and users.
• To analyze and optimize our site: Via Google Analytics. We inform you of this and give you a chance to consent.
• To communicate policy changes: We notify users by email or site notification if terms change.

If you do not provide required data (e.g., account info), we may not be able to register your account or perform transactions.

We do not share your personal data with marketers. We only share data with service providers who process data on our behalf under strict agreements:

• Cloudflare: Provides CDN and DDoS protection (including Turnstile anti-bot). Cloudflare may log your IP to secure the service.
• PayPal (Business): Processes subscription payments. We only receive confirmation and data needed to manage your subscription.
• Google (Firebase, Analytics, AdSense): Firebase handles authentication and database storage. Analytics processes usage data. AdSense serves ads which may be personalized based on browsing history (opt-out available via Google's Ad Settings).
• GitHub: Allows "Log in with GitHub". Provides us basic profile info (username, email) for account creation.
• ImageKit: Stores user-uploaded profile images following GDPR guidelines.
• Render.com: Hosts our backend APIs. May process technical logs but does not use personal data beyond running services.
• IONOS: Our domain registrar. Holds our contact info but does not have access to your personal data.

As a general rule, when third parties process your data, they do so under our instructions and must provide adequate security. We do not sell data for commercial purposes.

Our site uses essential cookies (to keep you logged in) and Google Analytics/AdSense cookies.

• Analytics Cookies: First-party cookies to count visits and analyze usage. You can refuse these via your browser or Google's opt-out tool.
• Advertising Cookies: Google AdSense uses cookies to personalize ads. You can opt out via Google's Ad Settings.
• Other Cookies: We do not place tracking cookies from social networks (Facebook, Twitter, etc.). Cloudflare Turnstile uses strictly necessary cookies for security checks.

Under EU law, non-essential cookies require consent, which we manage via our cookie banner.

We keep personal data only as long as necessary. Account data is retained while your account exists. Logs (including IPs) are kept briefly for security, then purged. Analytics data is regularly purged per Google's settings.

We implement appropriate technical measures: all data transfers use HTTPS/SSL encryption, and sensitive info is encrypted at rest. We use Cloudflare's WAF and firewall to guard against attacks.

Under GDPR you have the right to access, rectify, erase, restrict, object to processing, and data portability.

• Access/Correction: Ask what data we hold and request corrections.
• Erasure ("Right to be forgotten"): Request deletion of your account and data via contact form. We delete data unless legally required to retain it (e.g., tax laws).
• Restriction/Objection: Ask us to stop using your data (e.g., opting out of analytics).
• Portability: Request a copy of your personal data in a portable format.
• Withdraw Consent: Withdraw consent for cookies or emails at any time.

We do not knowingly collect data from children under the age of 14 (Spain's minimum age for consent). If you are under 14, please do not use this site.

For any questions or requests regarding your privacy or this policy, you may contact us via the contact form on our website or by emailing us at [email protected]. Please include "Privacy" or "Data Request" in the subject line.

Thank you for trusting us with your data. We strive to be transparent and protect your privacy at all times.