Privacy policy

Who is responsible

The controller for the processing described here is coredump OÜ, a private limited company (osaühing) registered in Estonia under Estonian Business Register code 17488193.

Registered address: Sepapaja tn 6, 15551 Tallinn, Harju maakond, Estonia.

To reach us about anything on this page, use the contact form, email contact@codr.tools, or write to the address above. We have not appointed a data protection officer, as the law does not require one for processing of this kind.

The tools run in your browser

The tools work on your own device. What you type, paste or open in a tool stays there. It is not uploaded, not processed on a server and not kept anywhere. We never receive it, so there is nothing for us to store, log or pass on.

You do not have to take our word for it. Disconnect from the network once a page has loaded, and the tool on it keeps working.

The contact form is the one thing on the site that does send something, and only when you fill it in and send it yourself. It is covered below.

Hosting and server logs

The site is hosted by Cloudflare, Inc. (101 Townsend St., San Francisco, CA 94107, USA), which processes data on our behalf. Asking for a page sends the things any web request carries: your IP address, the time, the address you asked for, the answer the server gave, your browser's user agent and the page you came from. Cloudflare needs those to deliver the page and to keep the site up and protected against attack. The legal basis is our legitimate interest in running a secure, working website (Article 6(1)(f) GDPR).

We keep no server logs of our own, build no profiles from this and never connect it to anything you type into a tool. How Cloudflare handles and keeps it is set out in its privacy policy.

Cloudflare Web Analytics

We use Cloudflare Web Analytics to see which pages get visited and how quickly they load. What it collects is described in Cloudflare's own documentation, which we quote rather than paraphrase:

• "Cloudflare Web Analytics does not use any client-side state, such as cookies or localStorage, to collect usage metrics." (Cloudflare Web Analytics)
• "We also don't 'fingerprint' individuals via their IP address, User Agent string, or any other data for the purpose of displaying analytics." (same page)
• "Web Analytics collects the minimum amount of information - timing metrics - to show customers how their websites perform." and "Cloudflare does not track individual end users across our customers' Internet properties." (Data origin and collection)
• A repeat view counts as a new visit when the referring page is on another site, rather than by recognising you, and Cloudflare states that it does "not log query strings to avoid collecting potentially sensitive data". (Web Analytics FAQ)

We see aggregate counts: page views, visits, referrers, countries, browsers and load timings. We cannot identify you from them. The legal basis is our legitimate interest in knowing which tools are worth maintaining (Article 6(1)(f) GDPR).

Cookies and storage in your browser

We set no cookies of our own, and nothing on this site is stored to recognise you on a later visit.

One thing is saved on your device. If you switch the site between light and dark, that choice is kept in your browser's local storage so the site looks the same next time. It is not a cookie, it is never sent with a request, and it never reaches us. Clearing the site's data removes it, and the site goes back to following your system setting. Nothing else is stored.

Cloudflare may set cookies of its own for security and traffic management, such as its bot management cookie. Cloudflare lists each one, what it is for and how long it lasts, in Cloudflare cookies. Advertising cookies are covered further down.

The contact form

If you use the contact form, we collect your email address, your message, and your name if you choose to give one. Nothing else is taken from the page: not the address you came from, not your browser's user agent.

The message reaches us as an email, delivered through Cloudflare, our hosting provider, which handles it on our behalf. It is not saved on the website or in any database. The only copy is the email in our inbox.

We use it to read and answer you, and to fix whatever you reported. The legal basis is our legitimate interest, and yours, in dealing with the enquiry you sent (Article 6(1)(f) GDPR); where your message concerns your use of the site, the processing is also necessary to take steps at your request (Article 6(1)(b) GDPR). A name is optional. An email address is required, because without one we cannot reply.

We keep the email as long as the matter needs, including a record of what was asked and answered, and delete it at the latest 24 months after the exchange ends. You can ask us to delete it sooner.

The bot check

A bot check by Cloudflare Turnstile runs when you use the form. It replaces the usual image puzzles, and in most cases you will not have to do anything. The check runs on the contact page only, and only from the moment you start filling the form in. No other page on the site involves it, and if you never touch the form, it never runs.

Cloudflare describes what Turnstile collects in its Turnstile Privacy Addendum: "Turnstile processes a variety of client-side signals ('Signals') such as client IP address, TLS Fingerprint, User-Agent Header and Sitekey and associated origin." The same document states that "Cloudflare does not have the ability to directly identify any individuals from any of the Signals Turnstile collects, including IP addresses", and that "the purpose of collecting these Signals is not to identify, profile or target any individuals but solely to detect and block bots". Cloudflare's product documentation adds that "Turnstile does not access, store, or transmit user communications, form entries, or other page inputs" (Cloudflare Turnstile).

When you send the form, your IP address is passed to Cloudflare so it can confirm the check. We do not store it, and it is not part of the email we receive. How Cloudflare handles it is set out in its privacy policy and the addendum above. The legal basis is our legitimate interest in keeping the form from being used for spam and abuse (Article 6(1)(f) GDPR). The check is a condition of using the form, because without it the form could not stay open to everyone.

Advertising

The site is funded by advertising. Google AdSense is the network we use, and no ads are being served yet, so nothing in this section is happening on the site today. It describes what will happen from the day the first ad unit goes live, so that this page is accurate before and after that point.

Google's terms require us to tell you the following:

• Third party vendors, including Google, use cookies to serve ads based on a user's prior visits to this website or other websites.
• Google's use of advertising cookies enables it and its partners to serve ads to you based on your visit to this site and/or other sites on the Internet.
• You may opt out of personalised advertising by visiting Ads Settings. Alternatively, you can opt out of a third-party vendor's use of cookies for personalised advertising by visiting www.aboutads.info. Visitors in Europe can also use the Your Online Choices opt-out page.

How Google uses the data it collects from sites that use its services, including this one, is set out in How Google uses information from sites or apps that use our services.

Google AdSense is the only advertising network on this site. If we ever add another, this page will name it and link to its own opt-out before it starts serving.

If you are in the European Economic Area, the United Kingdom or Switzerland, you are asked for your choice before any personalised advertising happens, through Google's own certified consent tool, which appears the first time you visit. Ads still appear if you decline, but non-personalised ones. That choice is stored by the consent tool in your browser, and the same tool lets you change or withdraw it later. Where consent is the basis for advertising cookies, it is Article 6(1)(a) GDPR; withdrawing it does not affect what happened before.

Who your data is shared with

We do not sell data, and there is very little to share. The recipients are:

• Cloudflare, Inc. — hosting, analytics, the bot check, and email delivery.
• Google — advertising, once ads are live, and Google Search Console for the search terms that lead to the site, which Google reports to us in aggregate.

Transfers outside the EEA

Both companies are based in the United States and run global networks, so data may be processed outside the European Economic Area.

Cloudflare's data processing addendum applies the European Commission's standard contractual clauses to transfers of personal data protected by the EU GDPR, states that "the EU SCCs shall be deemed amended as specified by the UK Addendum" for data protected by the UK GDPR, and applies the same clauses to transfers of data protected by the Swiss FADP (Cloudflare Data Processing Addendum).

Google's ads processor terms provide that where Google has not adopted an alternative transfer solution for a restricted European transfer, the standard contractual clauses apply, and Google publishes which solution or certification is current at business.safety.google/adsdatatransfers.

Your rights

Under the GDPR and the UK GDPR you have the right to ask us for a copy of your personal data, to have it corrected or deleted, to have its processing restricted, to receive it in a portable form, and to object to processing we base on legitimate interests. Where processing rests on your consent, you can withdraw it at any time.

In practice this concerns messages sent through the contact form, since that is the only place we hold anything that identifies you. To exercise any of these rights, write to us through the contact form, by email at contact@codr.tools, or at the postal address above. We answer within one month. If we cannot tell which data is yours, we may have to ask you something that lets us find it.

You also have the right to complain to a data protection supervisory authority. Ours is the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon), www.aki.ee/en. You may also complain to the authority in the country where you live or work.

Children

The site is aimed at software developers and is not directed at children. We do not knowingly collect personal data from children. If you believe a child has sent us something through the contact form, tell us and we will delete it.

Changes to this policy

This policy will change when the site does, for example when advertising goes live or if a tool ever needs something new. The current version is always the one on this page, and the effective date at the top says when it last changed. Changes that affect you materially will be noted on this page.