Privacy

• Tool inputs are processed to compute your result and are not stored, except where a tool says so (e.g. DataFresh monitors you create, HeaderLens hostnames).
• Uploaded files are processed in memory or in a private temporary folder that is deleted right after processing. Files a tool creates for you (e.g. a compressed image) are kept on our server for about 2 hours under a link derived from the file content (not guessable without the file) so you can download them, then deleted automatically.
• Your IP address is used in memory for rate limiting only.
• No tracking cookies and no third-party trackers without your consent (see the consent, advertising and analytics sections below). If you pick a language manually, a single preference cookie (uw_lang) stores that choice; choose "Automatic" to delete it.

Feedback form

If you use the feedback form, we store the feedback type, the selected tool and page, your message, the page language and host, and — only if you enter them — your name and email address. Purpose: answering your question or idea and improving or correcting our tools (legal basis: your request / our legitimate interest in running useful tools). The submission is forwarded by email to the operator's mailbox; your email address is used only to reply. Your IP address is not stored (it is used briefly in memory, as a salted hash, to limit abuse). Feedback entries are deleted automatically after 365 days; ask us any time to delete them earlier.

Accounts and Google Drive (optional)

You can use every tool and app without an account. If you sign in with Google, we receive and store your Google account id (“sub”), email address and name, the time the account was created and your last sign-in, your settings, and sessions (only a hash of the session token; the cookie “uw_account” is HttpOnly and expires after 30 days or when you sign out). Purpose: providing the account you asked for (legal basis: contract / your request).

Google Drive is connected separately and only if you choose to. We ask for the narrowest permission (“drive.file”): we can only see and change files this site created in your Drive. The Google refresh token is stored encrypted (AES-256-GCM) on our server and never sent to your browser; Drive requests are made from our server. Files you save — tool inputs (never passwords or keys), results, generated files and, only if you tick it, your uploaded files; premium-app projects — are written to the folder “usefulweb” in your own Google Drive, not to our server. We keep a list of what you saved (names, Drive file ids, sizes, dates) so your account page can show it.

On your account page you can download all data we store about you as JSON, disconnect Google Drive (we revoke the access at Google) and delete your account (all account data is deleted immediately; files in your Drive stay yours). Google processes the sign-in and Drive data under its own privacy policy.

Partner links (referral measurement)

Some partners (blogs, websites, people) link to this site with a partner code in the address, for example ?ref=example-blog. When a page is opened through such a link, the server adds one to an anonymous daily counter for that code, site and page area. To avoid counting reloads twice, a salted hash of your IP address and the code is kept in memory for the current day only (the salt changes daily and is never stored); nothing is stored on your device and no IP address, browser data or visitor ID is saved. The code is removed from the address bar after the page loaded, so links you copy do not carry it.

Only if you allowed statistics in the consent settings, this site also sets the first-party cookie uw_ref (contains only the partner code, kept for 30 days, shared across the usefulweb.site sub-sites). Its purpose is to attribute your further page views, tool runs, app opens and displayed ad units to the partner link — again only as anonymous daily totals per code. Ad clicks are never tracked. If you withdraw or refuse statistics consent, the cookie is deleted and nothing further is counted.

Partners receive at most aggregated numbers (for example “120 visits in October”); no personal data is shared with them.

Consent management (CMP / IAB TCF)

Visitors from the EEA, the UK and Switzerland are asked for consent through Google Privacy & Messaging, a Google-certified consent management platform (CMP) that implements the IAB Europe Transparency & Consent Framework (TCF). You can accept all, reject all non-essential processing, or manage individual purposes and vendors. Until you decide, no advertising or analytics scripts are loaded.

If the Google message is not available (for example because it is blocked by your browser or not shown in your region), this site shows its own consent banner with the same choices: “Accept all”, “Reject non-essential” and “Manage options” (strictly necessary, statistics with Google Analytics 4, advertising with Google AdSense). The banner stays visible until you decide. Visitors from the EEA, the UK and Switzerland are shown Google ads only after consenting through the certified CMP; a choice made in the site's own banner enables advertising only where the CMP reports that these consent rules do not apply.

Consent storage

A choice made in the Google message is stored by the CMP in your browser. After any decision (in the Google message or in the site's own banner), this site sets one first-party cookie, uw_consent (HttpOnly, signed, 180 days), which contains a random pseudonymous ID, whether ads and analytics are allowed (and, for the site banner, your category choices), the policy/banner version and the time of the decision. It contains no email address, IP address or advertising ID and is used only to avoid rendering advertising elements you refused. When we change this policy or the consent banner (currently policy version 1, banner version 1) you are asked again.

Consent records (audit log)

To be able to demonstrate consent, each decision (grant, reject, update, withdrawal, re-consent) is recorded with the pseudonymous ID, time, policy/banner version, CMP identifiers, the purposes and the Google vendor choice, the Google Consent Mode state and the page where it happened. The TC string is stored encrypted; no IP addresses are stored. Records are kept for 1095 days and then deleted. Only the site owner can access or export them.

Advertising (Google AdSense)

With your consent, pages show ads from Google AdSense (Google Ireland Limited / Google LLC). Google may then store and read cookies or similar identifiers on your device to serve, personalise (only if you allowed it), limit and measure ads and to detect fraud. Ads are never shown on the privacy page, documentation, admin or API pages. Ad slots are labelled “Advertisement”. More information: How Google uses cookies in advertising and How Google uses information from sites that use its services.

Advertising cookies

Advertising cookies (for example __gads, __gpi, IDE) are set by Google only after you consented to storage and access of information on your device (TCF purpose 1) and to Google as a vendor. If you refuse, the AdSense script is not loaded.

Analytics (Google Analytics 4)

With your consent to the analytics purposes, we use Google Analytics 4 to understand aggregate usage. Google Consent Mode is set to “denied” by default and only updated to “granted” for the categories you accepted. If you refuse, Google Analytics is not loaded.

Withdrawing or changing your consent

You can change or withdraw your consent at any time with the “Privacy / cookie settings” link in the footer of every page, which reopens the consent dialog. Withdrawal applies to future processing; scripts that are already loaded are stopped by reloading the page, which happens automatically.

Open privacy / cookie settings

Controller, general privacy policy and contact: Imprint & privacy policy · games@codemagic.net