Privacy
Privacy policy
What this site collects, what it does not, and what happens to the images you open here.
The short version
Images you open in ColorFinders are read inside your browser and are never sent to this site. There is no account system, and the site does not build a profile of you. Google Analytics runs only if you accept it in the consent banner. The host keeps ordinary access logs, described below.
Who is responsible
The owner of ColorFinders runs this site and decides how the personal data described here is used. That makes the owner the controller under the GDPR and the UK GDPR, and the Data Fiduciary under India's Digital Personal Data Protection Act, 2023. Google processes analytics data on the owner's behalf, as a processor. Every question or request goes to hello@colorfinders.com.
Images and colour data
When you choose, drag, paste or link an image, your browser decodes it and draws it onto a canvas element in the page. Every colour value shown to you is read from that canvas by JavaScript running on your own device.
In practice, this means:
- No copy of your image is transmitted to, received by, or stored on this site's servers.
- There is no retention period, because there is nothing retained.
- The colours you sample, the values you type into the tools, the palettes you generate and the files you export are equally local. They exist in the page until you close or reload the tab.
- When a tool hands a colour to another tool, or you share a tool link, the colour travels after a
#in the address (for example/color-code#c=3498db). Browsers never send that part of an address to any server, so it reaches neither this site's host nor analytics.
You can verify this yourself. Open your browser's developer tools, switch to the network panel, then load an image and pick a colour. You will see no request carrying the image, because the page never makes one.
The one exception: loading an image by URL
If you paste an image address into the URL field, your browser fetches that address directly. The request goes from your device to that server, not through this site, and that server will see it as it would any other request from your browser, including your IP address. No referrer and no cookies are sent with it. ColorFinders never sees the response.
What is stored on your device
ColorFinders uses your browser's local storage for two small preferences. Local storage stays on your device and is not transmitted anywhere. The site uses no offline cache and no service worker.
| Key | What it holds | Why |
|---|---|---|
colorfinders.theme | The word light or dark | So the site opens in the theme you chose last time |
colorfinders.consent | Your answer for each purpose you were offered, when you gave it, and the notice version | So you are not asked the same question again, and so the answer can be shown to be yours |
Both are strictly necessary for what you asked the site to do, so they need no consent. If you accept the consent banner, the Google services described below also set their own cookies. Those are listed in the cookie policy.
Analytics
This site uses Google Analytics 4, a measurement service provided by Google, to learn which pages and tools are used and to notice when a feature stops working. It is loaded only if you choose Accept all in the consent banner, or allow usage measurement under Choose or on the Privacy choices page. Before you answer, and if you reject, the Google Analytics script is never requested and nothing is sent to Google.
When it is loaded, Google Analytics receives:
- a random ID kept in a cookie, so repeat visits from the same browser count once;
- the pages you open on this site and their titles, as the address without anything after a
?or#; - the page that sent you here: the page on this site, or only the name of another site;
- how long each page is open;
- your browser, operating system, device type, screen size and language;
- an approximate region (country and city) that Google works out from your IP address. Google Analytics 4 does not log or store the IP address itself;
- a small set of product events, such as "an image was loaded", "a palette was generated" or "a colour was copied", with coarse labels like the file format, the palette size or the tool's name.
It never receives your images, their file names or addresses, the colours you pick or anything you type into a tool. The code that sends events only accepts the fields listed above, page addresses are sent without their query or fragment, and tool state is kept in the fragment, which browsers never send. Google signals, ad personalisation and user-provided data collection are switched off, so this measurement is not used to show you advertising.
Legal basis: your consent (GDPR art. 6(1)(a); DPDP Act section 6), which you can withdraw at any time on the Privacy choices page, as easily as you gave it.
Cookies:_ga and _ga_WCBMJHH7VD, each kept for up to 2 years unless you refuse or withdraw, which deletes them.
Who processes it: Google processes this data on the owner's behalf under its data processing terms for Google Analytics, in the United States and elsewhere. Google LLC is certified under the EU-US Data Privacy Framework (with its UK extension and the Swiss framework), and Google's terms include the European Commission's standard contractual clauses. Google explains its practices in its privacy policy. You can also block Google Analytics on every site with Google's opt-out browser add-on.
Retention: Google Analytics deletes this data after 14 months.
Advertising
None. This site shows no advertising and loads no advertising code. The layout reserves space where advertising could appear later; that space is empty and no request is made to fill it.
If advertising is added, this section and the cookie policy will be updated first, and the consent banner will ask before any advertising code is loaded.
What is not collected
There are no accounts, no sign-up, no newsletter and no contact form. Nothing you type into the site is sent to a server. The site asks for no name, age, date of birth or identity document.
Server and security logs
Hostinger hosts the site and Hostinger CDN delivers and protects it, both on the owner's behalf. Like every web server, they record each request in access logs: the time, your IP address, the address requested, the referring page, your browser's user agent, the response, and the country worked out from the IP address. Hostinger CDN records requests at the edge; Hostinger records the ones that reach the server. This needs no cookie and no consent, but you should know it happens.
- Why: to deliver the site, find faults and keep it secure, for example to spot and block abuse. Logs are never used to profile visitors and are never combined with analytics.
- Legal basis: the legitimate interest in running a secure site (GDPR art. 6(1)(f)).
- Who can see them: the owner, in the Hostinger control panel, and Hostinger as the host.
- How long: access logs are kept for the period Hostinger sets.
- Erasure: a request to delete log entries is weighed against the need to keep them for security, and answered either way.
Tools keep their state after a #, which never reaches these logs. A link made before November 2026 could carry a colour after a ? instead (such as ?c=3498db). Opening one sends that colour to the host once, before the page moves it behind the #.
Other third parties
Web fonts are loaded from Google Fonts, which means your browser makes a request to fonts.gstatic.com. Google receives the request as it would any other font request, including your IP address, and no cookie is set. The legal basis is the legitimate interest in showing the site in its own typefaces (GDPR art. 6(1)(f)); a content blocker can stop the request, and the site then falls back to your system fonts. If you accept the consent banner, Google Analytics is contacted as described above. No other third-party service is contacted by any page on this site.
Clearing your data
Clearing this site's data in your browser removes your theme choice, your consent answer and any cookies set here. It does not remove records Google Analytics has already received. Those are tied to the analytics ID in the _ga cookie, so to have them erased, copy the ID first from the Privacy choices page, then write to hello@colorfinders.com. Once the cookie is gone, nothing links this browser to those records.
Children
This site is a general-purpose utility and is not aimed at children. It asks for no age, date of birth or identity document, and it does not knowingly process children's personal data. If you are under 18, please choose Reject all in the consent banner: in India anyone under 18 is a child, and the site does not collect the verifiable parental consent that tracking a child would need. A parent or guardian who believes a child's data was collected can send the child's browser analytics ID (from the Privacy choices page on that browser) to hello@colorfinders.com, and those records will be erased.
Your rights
Depending on where you live, data protection law gives you the right to:
- get a copy, or in India a summary, of the personal data held about you;
- have inaccurate data corrected;
- have data erased;
- restrict or object to its processing;
- receive it in a portable form;
- withdraw consent at any time, as easily as you gave it, without affecting processing that happened before;
- have a grievance addressed; and
- in India, nominate someone to exercise these rights for you if you die or become incapacitated.
How to use them: write to hello@colorfinders.com. This site holds no account or profile, so records exist only against the analytics ID in your browser's _ga cookie. Include that ID, shown on the Privacy choices page; nothing else is needed.
Complaints: in the EU or the UK you can complain to your data protection supervisory authority at any time. In India, please raise a grievance at the address above first; if you are not satisfied with the answer, you can complain to the Data Protection Board of India through its online platform. The privacy notice for India sets this out item by item, as the DPDP Act requires.
Data retention
- Google Analytics records: deleted after 14 months.
- Google Analytics cookies: up to 2 years, or until you refuse, withdraw or clear site data.
- Theme and consent answer in local storage: until you clear site data.
- Host access logs: the period Hostinger sets.
Contact and grievances
The owner of ColorFinders, hello@colorfinders.com. Every request and grievance is answered within 30 days, and never later than the 90 days the DPDP Rules allow. You can also use the contact page.
Changes
If this policy changes, the "last updated" date at the top changes with it. Changes that affect what is collected are made before the collection starts, and the consent banner asks again when what you agreed to changes.