Privacy
What we do — and don't.
The vendored app measurement does not confirm an encrypted local database. It records an unencrypted SQLite file; an app lock does not encrypt that file. Protect your device and backups independently. End-to-end encryption belongs to the proposed own-storage sync design. There is no publicly approved security evidence for a running sync service; support for a storage provider alone does not verify that property.
Website usage analytics
We use Umami with PostgreSQL on the operator's own Home-Server to understand which public pages and tools are useful. This cookieless measurement does not store a persistent analytics identifier in your browser. IP addresses and the browser's User-Agent are processed transiently for the request and short-lived visit assignment; the measurement is not a guarantee of anonymity.
We send canonical public page paths without query strings or fragments, the referring site's origin and fixed language, tool and event identifiers. Calculator inputs or results, formula text, names, file contents, filenames and page titles are excluded. The four core actions are a valid calculation after a real edit, a successful formula copy where available, a prepared download handed to the browser, and article engagement after 20 visible seconds, real interaction and 50% content depth. A copied message or result link is recorded separately and is not labelled as a formula copy.
To improve these features, we also record the first real calculator edit, fixed error categories for calculations, copies and downloads, clicks to known tools, templates or learning paths, and searches with no results. Search text and error messages are not sent. These diagnostic actions are separate from the four core usage actions.
Active raw analytics records are kept for 180 days. Encrypted backups expire after seven days, so a raw record may remain in a backup for up to 187 days plus the deletion job's execution delay. Daily aggregate counts are retained for 24 months. These analytics retention periods do not change the storage rules for data you intentionally send to other services.
We honor Global Privacy Control and Do Not Track. You can also exclude
this browser on this site by setting analytics.disabled to
1 in local storage; our own browser tests are excluded before
page scripts run. Existing provider choices and privacy settings continue
to apply.