Privacy policy

1. Who is responsible

The controller under the EU General Data Protection Regulation (GDPR) is:

See also the legal notice (Impressum). We are not required to appoint a data protection officer.

2. Overview

What we process, why, and on which legal basis. Details follow in the sections below.

3. Hosting and server logs

CurveFox is hosted by Vercel Inc., USA. Our server functions run in Vercel's region iad1 in the United States. When you open a page, your browser sends technical data that Vercel receives and logs: your IP address, browser and device type (user agent), date and time, and the address of the page requested. This is needed to deliver the pages and to protect the site against attacks and misuse. Vercel keeps these logs for a limited time set by Vercel.

Legal basis: our legitimate interest in a secure, working website (Art. 6 (1) (f) GDPR). Vercel processes the data on our behalf under a data processing agreement and is certified under the EU-US Data Privacy Framework (section 12). More in Vercel's privacy policy.

Every calculator runs in your browser: the numbers you enter are not sent to our server and we keep no database of them. Our fonts are hosted on our own server, so your browser makes no requests to Google Fonts or other font services.

To count visits, we use Vercel Web Analytics. For each page view it records the page address, the referring website, the approximate location (country, region, city), and the device, operating system and browser type. It sets no cookies and stores nothing on your device. Instead of an ID, Vercel uses a hash of the request that is discarded after 24 hours, so a visit cannot be linked to a person or followed across sites. The script runs on our own domain. Legal basis: our legitimate interest in knowing how the site is used (Art. 6 (1) (f) GDPR). Details in Vercel's Web Analytics privacy notes.

4. Stored only in your browser

CurveFox uses your browser's local storage (not cookies) for things you ask the site to remember:

• your theme choice (light, dark or system);
• your cookie choice (section 5);
• the numbers and names you last entered in each calculator (grades, course names, scores), so they are still there when you come back.

This data stays on your device and is never sent to us. You can delete it at any time by clearing this site's data in your browser settings. This storage is strictly necessary to provide features you asked for (section 25 (2) no. 2 of the German Telecommunications Digital Services Data Protection Act, TDDDG). The list of entries is in our cookie policy.

Share links. When you use "Share link", your inputs are packed into the address of the link. Anyone you send it to can see them, and when the link is opened the address reaches Vercel's logs like any other page address (section 3). Only share links with inputs you are happy to share.

5. Cookie consent

In the EU/EEA, the UK and Switzerland, a banner asks whether you allow analytics. They stay off until you choose "Accept all" or switch on "Analytics" in the settings. "Reject all" is just as easy.

Everywhere else (for example the USA), session analytics are on by default and there is no banner. You can switch them off at any time under Privacy settings, and they stay off.

We tell the two apart from your device's time zone, in your browser; we do not look up your location. Any European time zone, or one we cannot read, gets the banner. If your browser sends a Global Privacy Control signal, we treat it as a no in every region; you can still opt in under Privacy settings.

Your choice and the time you made it are saved in your browser's local storage under the key cf-consent-v1, so we do not ask again on every page. After 12 months we ask again. Saving the choice is strictly necessary (section 25 (2) no. 2 TDDDG) and serves our duty to respect and prove consent (Art. 6 (1) (c) and Art. 7 (1) GDPR).

You can change or withdraw your consent at any time, with effect for the future: Privacy settings. The link is also in the footer of every page.

6. Microsoft Clarity

We use Microsoft Clarity, a service of Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland, and its parent Microsoft Corporation, USA. Clarity shows us heatmaps and session recordings, so we can see where people get stuck and make pages easier to use. In the EU/EEA, the UK and Switzerland the Clarity script is not loaded at all without your consent; elsewhere it loads unless you switched analytics off (section 5).

What is processed

How you interact with our pages (clicks, taps, scrolling and mouse movement), the pages you view, device and browser information, and a pseudonymous identifier. Microsoft also receives your IP address when the script loads. Clarity masks text you type in input fields by default, so it is not recorded. Clarity sets cookies such as _clck, _clsk, CLID, ANONCHK, MR, MUID and SM; see the cookie policy.

Legal basis and withdrawal

In the EU/EEA, the UK and Switzerland: your consent (Art. 6 (1) (a) GDPR; for cookies and access to your device section 25 (1) TDDDG). Elsewhere: our legitimate interest in finding and fixing usability problems (Art. 6 (1) (f) GDPR), and you can object at any time. Either way, switch analytics off under Privacy settings and we tell Clarity to stop, delete its cookies, and do not load the script again.

Storage and transfer

Data may be processed in the USA. Microsoft is certified under the EU-US Data Privacy Framework (section 12). According to Microsoft's Clarity documentation, session recordings are kept for 30 days and heatmap and dashboard data for 9 months, then deleted. More in the Clarity data retention notes and the Microsoft privacy statement.

7. Google Search Console

We use Google Search Console, a service of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, to see how CurveFox appears in Google Search: which searches show our pages, how often they are clicked, and whether Google can crawl the site. To prove that we own the site, our pages contain a verification meta tag. This tag is only text: it loads no script, sets no cookies and sends nothing about you to Google.

Google sees search data from its own search engine, under its own privacy policy, not data about visitors on our site. We only see summary figures. Legal basis: our legitimate interest in understanding and improving how people find the site (Art. 6 (1) (f) GDPR). More in the Google privacy policy.

8. When you email us

If you write to hello@curvefox.com, we use your email address, your name if you give it, and your message only to answer you. We delete them when your request is settled, unless we must keep them by law. Legal basis: Art. 6 (1) (b) GDPR when your message is about a contract or request, otherwise our legitimate interest in answering (Art. 6 (1) (f) GDPR).

9. Links to our social profiles

We may link to our profiles on social networks. These are plain links: nothing from these networks is embedded or loaded on our pages, so no data goes to them unless you click a link. Once you are on a network, its own privacy policy applies.

10. Affiliate links

Some test score pages show test prep providers through affiliate links, always labeled as such. They are plain links with a partner ID: nothing is loaded from the provider or the affiliate network until you click. When you click, you go to the network or provider, which records the click and may set its own cookies on its own site to credit us if you buy something. That processing is covered by their privacy policies. We only receive totals of clicks and commissions, never your name or what you bought. Legal basis for showing the links: our legitimate interest in funding a free site (Art. 6 (1) (f) GDPR).

11. What we do not do

No advertising at the moment, no ad tracking, no accounts or sign in, no newsletter, no contact forms and no social media plugins. If we add any of these later, we will update this policy first and ask for consent where needed.

12. Transfers to the USA

Vercel (hosting) and, when analytics are on (section 5), Microsoft (Clarity) may process data in the USA. Both are certified under the EU-US Data Privacy Framework, for which the European Commission adopted an adequacy decision on 10 July 2023 (Art. 45 GDPR). Where a transfer is not covered by the framework, the providers use the EU Standard Contractual Clauses (Art. 46 (2) (c) GDPR).

13. How long we keep data

• Server logs: for a limited time set by Vercel, for security and operation.
• Local storage: until you clear it in your browser; your cookie choice for 12 months.
• Clarity: recordings 30 days, heatmaps and dashboard data 9 months, as stated by Microsoft.
• Emails: until your request is settled, longer only where the law requires it.

14. Your rights

Under the GDPR you have the right to:

• access the data we hold about you (Art. 15);
• have wrong data corrected (Art. 16);
• have your data deleted (Art. 17);
• have processing restricted (Art. 18);
• receive your data in a common, machine-readable format (Art. 20);
• withdraw consent at any time, with effect for the future (Art. 7 (3));
• object to processing based on our legitimate interests, on grounds relating to your situation (Art. 21).

To use any of these rights, email hello@curvefox.com. Note that we cannot see data that only exists in your browser; you can delete it there yourself.

15. Right to complain

You can complain to a data protection supervisory authority (Art. 77 GDPR), in particular in the EU country where you live or work. The authority responsible for us is the State Commissioner for Data Protection and Freedom of Information Baden-Württemberg (Landesbeauftragte für den Datenschutz und die Informationsfreiheit Baden-Württemberg), Stuttgart, Germany, baden-wuerttemberg.datenschutz.de.

16. Privacy rights for US visitors

We do not sell or share personal information, as those terms are used in the California Consumer Privacy Act as amended by the California Privacy Rights Act (CCPA/CPRA), and we do not use it for targeted advertising. We honor the Global Privacy Control signal: if your browser sends it, analytics stay off unless you explicitly opt in. Residents of California and other US states with privacy laws can ask to know, correct or delete their personal information by emailing hello@curvefox.com. We will not treat you differently for using these rights.

17. Children

CurveFox is a general audience site for high school and college students, parents and teachers. It is not directed at children under 13, although parents and younger students may use the middle school GPA calculator. We do not ask for, and do not knowingly collect, personal information such as names, email addresses or phone numbers from children under 13, in line with the US Children's Online Privacy Protection Act (COPPA). The calculators work without any personal information, and what you type stays in your browser. Analytics identifiers (section 6) are used only to keep the site working and to improve it, never for advertising or to build profiles. If you are a parent and believe your child under 13 has sent us personal information, for example by email, write to us and we will delete it.

18. Other points

We do not use automated decision making or profiling under Art. 22 GDPR. You are not obliged to give us any personal data: every page and every calculator work without it. Only answering an email needs your email address.

19. Changes to this policy

We update this policy when the site or the law changes. The date at the top shows the current version.