Privacy Policy

Last updated: 15 May 2026

1. Controller

The controller within the meaning of the GDPR is:
Timo Lutz, c/o Christian Jahnke, Gulisastrasse 93, 56072 Koblenz, Germany
Email: info@4ny.tools

We are not required to appoint a data protection officer (§38 BDSG — German Federal Data Protection Act). Please direct data protection enquiries to the email address above.

2. Hosting, CDN, Edge Functions & Storage — Cloudflare

The website 4ny.tools is served via Cloudflare Pages and Cloudflare Workers. Provider: Cloudflare, Inc., 101 Townsend Street, San Francisco, CA 94107, USA, represented in the EU by Cloudflare Germany GmbH, Rosental 7, c/o Mindspace, 80331 München, Germany.

When you access the website, the following data is technically processed to serve your request, protect against attacks and ensure stable operation:

  • IP address of your device
  • Date and time of the request
  • Requested path, HTTP method and status code
  • User-Agent, Referer and Accept-Language headers
  • TLS version and ASN/ISP information

Cloudflare's "EU Data Boundary" is activated; requests from the EEA are served from data centres within the EU. Any transfer to the USA is based on EU Standard Contractual Clauses and Cloudflare, Inc.'s certification under the EU–US Data Privacy Framework.

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in secure, performant operation). Cloudflare privacy policy: cloudflare.com/privacypolicy.

3. Analytics — Cloudflare Web Analytics

For aggregated reach measurement we use Cloudflare Web Analytics (provider as per §2). Only anonymised page view counts, referrers, country and device category are collected. No cookies are set, no identifiers are stored on your device and no personal profiles are created. The beacon embedded for this purpose (static.cloudflareinsights.com/beacon.min.js) is provided by the same provider.

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in privacy-friendly reach measurement); no consent required under §25(2) no. 2 TDDDG (German Telecommunications and Telemedia Data Protection Act), as no information is stored on or accessed from your device.

4. Result Share Links — Cloudflare KV

For selected tools you can share a calculated result as a short link. Only the calculation result is transmitted — no inputs, no plain-text values, no identifying data. The data is stored in Cloudflare KV with EU Data Boundary enabled and automatically deleted after 7 days. The share feature is not available for health-related tools (e.g. TDEE/Macro, Cardio-Score, Sleep-Cycle).

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in providing a convenient share function).

5. Consent Management — Consentmanager

For GDPR-compliant collection, documentation and revocability of consents for advertising third-party services (§6), we use the Consent Management Platform Consentmanager in accordance with IAB TCF v2.2. Provider: consentmanager AB, Håltegelvägen 1b, 723 48 Västerås, Sweden, represented in the EU by Jaohawi AB.

As part of the CMP, a technical identifier (consent ID) is stored on your device to record and document your choices.

You can open, adjust or fully revoke your consents at any time via the "Privacy Settings" button in the footer of this website.

Legal bases: §25(2) no. 2 TDDDG (technically necessary storage on device) and Art. 6(1)(c) GDPR in conjunction with Art. 7(1) GDPR (obligation to demonstrate consent). Provider privacy policy: consentmanager.net/privacy.php.

6. Advertising — Google AdSense

We finance the service through display advertising via Google AdSense. AdSense is loaded only after your explicit consent via the CMP (§5). In the CMP you can choose whether personalised or non-personalised ads are shown. Without consent, no ads are served, no data is transferred to Google, and no cookies or other identifiers are stored on your device by Google.

When consent is given, Google processes in particular: IP address, User-Agent, Referer, ad interactions and, where applicable, an advertising identifier. Provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (parent company: Google LLC, USA). Transfer to the USA is based on the EU–US Data Privacy Framework.

Legal bases: Art. 6(1)(a) GDPR and §25(1) TDDDG (consent). Further information: policies.google.com/privacy.

7. Affiliate Programmes

On individual tool pages we use contextually relevant recommendation links to third-party providers. Such links are always labelled with the designation "Affiliate-Link" (§5a UWG — German Unfair Commercial Practices Act, §6 DDG — German Digital Services Act). Commission arrangements do not influence content; see the Affiliate Disclosure for details.

Only when you click on an affiliate link does the relevant affiliate network store a cookie or comparable technical identifier on your device. This serves solely to enable the network to attribute a commission if you complete a purchase at the linked retailer. We receive only aggregated commission statements; individual persons are not identifiable to us.

Legal bases for commission attribution: Art. 6(1)(f) GDPR (legitimate interest in financing the free service) and §25(2) no. 2 TDDDG for the storage on your device initiated by your click.

We use the following affiliate networks depending on tool category:

  • Awin AG, Eisenzahnstraße 1-3, 10709 Berlin, Germany — cross-category (Health, Finance, Travel, Lifestyle, Developer). Associated processing may also be carried out by Awin Ltd., London, United Kingdom; transfer basis: EU Commission adequacy decision for the United Kingdom. Privacy policy: awin.com/gb/legal/privacy-policy.
  • Amazon Partnernet — Provider: Amazon EU S.à r.l., 38 avenue John F. Kennedy, L-1855 Luxembourg. Focus: physical products in Health, Travel and Lifestyle. Intra-group transfers to Amazon.com, Inc. (USA) are based on EU Standard Contractual Clauses. Privacy policy: amazon.de/datenschutz.
  • financeAds GmbH & Co. KG, Berlin, Germany — primarily for Finance tools (e.g. FIRE Calculator, Contractor vs. Employee). Privacy policy: financeads.net/datenschutz.

8. External Search Forwarding

The search box on the home page lets you launch your typed query at one of several external providers (Google, Startpage, DuckDuckGo, Shodan, Wikipedia, Amazon) by selecting an engine and pressing Enter. The query opens in a new tab. For Wikipedia the query is sent to the Wikipedia of your currently active interface language. For Amazon the query is sent to the Amazon storefront matching your interface language (DE → amazon.de, FR → amazon.fr, IT → amazon.it, ES → amazon.es). For English-language users the destination depends on the regional tag of your browser language: en-GB and en-IE are routed to amazon.co.uk; all other English regions (incl. en-US) are routed to amazon.com.

The Amazon entry is an affiliate launcher: the launched URL contains our Amazon affiliate tracking identifier (tag=lutzit00-21 for the EU Partnernet storefronts; tag=lutzit00-20 for amazon.com), so that any subsequent purchase you make on Amazon may be attributed to us as a commission. The entry is visibly marked as such in the engine selector (asterisk on the chip; "(Affiliate-Link)" label in the popover) in accordance with §5a UWG and §6 DDG. The legal basis, retention and recipient details for affiliate commission attribution are governed by §7 (Affiliate Programmes).

When you launch an external search, your browser transmits the query directly to the chosen provider as part of the URL. We neither transmit, log nor store the query. From the moment the new tab opens, the chosen provider is responsible for any further processing of the query and of any data your browser sends to it.

No assets (logos, scripts, fonts, favicons, prefetch or preconnect hints) are loaded from any external search provider on this page. Provider contact occurs only after, and as a consequence of, your deliberate click on the launch action. The Referer header of the outbound request is suppressed (rel="noreferrer"); the provider sees only your query, not the page you came from.

To remember the order of the engine selector, your most-recent engine choices are stored on your device under search-engine-mru (see §10). No consent is required for this storage as it is technically necessary within the meaning of §25(2) no. 2 TDDDG to provide the function you have actively used.

Privacy policies of the providers: Google · Startpage · DuckDuckGo · Shodan · Wikipedia · Amazon.

9. Data Processing in Individual Tools

The vast majority of tools on 4ny.tools calculate exclusively in your browser. Inputs do not leave your device and are neither transferred to our servers nor to third parties. In detail:

  • Browser & IP Info (Tool)
    When you access the "Browser & IP Info" tool, the server reads the following data from the incoming HTTP request and returns it exclusively as a response to your browser. The data is not stored, not logged and not shared with third parties.

    Fields processed:
    Geolocation – continent, country, region, city, postcode, approximate geographic coordinates, timezone (source: Cloudflare geolocation database, ISO 3166-1/3166-2).
    Routing – IP address, ASN (Autonomous System), AS organisation name (internet provider), Cloudflare data centre (IATA code), HTTP protocol version, TCP round-trip time (milliseconds).
    Connection security – TLS version, TLS cipher suite.
    Browser – User-Agent string (from HTTP header).

    Legal basis: Art. 6(1)(b) GDPR (contract performance; provision of the requested function).
    Cloudflare, Inc. is the hosting provider and processes incoming requests as a data processor (Art. 28 GDPR). Details: Cloudflare Privacy Policy.
  • Tools with share function (e.g. Road-Trip Calculator, Carbon Footprint, Color Converter, FIRE Calculator, Fuel Consumption): see §4 (Cloudflare KV).
  • Local tools without data transfer: Sleep-Cycle Calculator, TDEE/Macro Calculator, Cardio-Score, Contractor vs. Employee, Base64 & URL Encoder, Number Base Converter, Color Converter, Road-Trip Calculator, Carbon Footprint, Fuel Consumption Calculator, Clothing Size Converter, Detergent Dose Calculator, Steak Wizard. All calculations are performed exclusively in your browser; neither inputs nor intermediate results leave your device.

10. Data Stored on Your Device

The following values are stored as technically necessary (§25(2) no. 2 TDDDG) or based on your active selection:

Cookies

  • lang (1 year) — chosen interface language
  • currency (1 year) — chosen display currency in finance and travel tools
  • Consent cookie from the Consent Management Platform (see §5)

In addition, the CDN edge layer (Cloudflare, see §2) sets the following strictly-necessary security cookies in HTTP response headers, before any JavaScript runs:

  • __cf_bm (30 minutes) — bot detection, protects against automated requests
  • _cfuvid (session) — per-visitor rate limiting
  • cf_clearance (up to 1 year, only after passing a security challenge) — proof of passed challenge
  • __cfruid (session, when active) — load balancing within the Cloudflare network

These cookies are strictly necessary (§25(2) no. 2 TDDDG) for abuse prevention and reliable delivery of the site; legal basis Art. 6(1)(f) GDPR (see §2).

Local Storage

  • dark-mode — chosen light/dark mode
  • color-theme, dark-color-theme — chosen accent theme (e.g. amber, mono, cyan)
  • copy-on-generation preferences per tool — toggle "automatically copy result to clipboard"
  • search-engine-mru — list of recently used external search engines (most-recent-first), used to order the search-engine selector. Plain JSON, no identifier, no profile.
  • Consent Management Platform storage (see §5)

If AdSense consent is active, additional cookies and local storage entries may be set by Google (§6); when clicking an affiliate link, by the respective affiliate network (§7).

11. Recipients and Third-Country Transfers — Overview

Recipients of personal data are the processors and advertising third parties named in §§2–7. Transfers to third countries within the meaning of the GDPR take place exclusively as follows:

  • Cloudflare, Inc. (USA): EU Data Boundary activated; transfer basis EU Standard Contractual Clauses and EU–US Data Privacy Framework.
  • Google Ireland Limited / Google LLC (Ireland → USA, only with AdSense consent): transfer basis EU–US Data Privacy Framework.
  • Amazon EU S.à r.l. (Luxembourg, not a third country) and intra-group transfers to Amazon.com, Inc. (USA): transfer basis EU Standard Contractual Clauses.
  • Awin Ltd. (United Kingdom): transfer basis EU Commission adequacy decision.

12. Retention Periods

  • Cloudflare server logs: per Cloudflare's standard retention (typically a few days) for security, performance and diagnostic purposes.
  • Cloudflare KV (short links): 7 days, then automatic deletion.
  • Consent record in the CMP: 12 months from the date of consent or last confirmation.
  • AdSense and affiliate cookies: per the respective provider's terms (typically 30–90 days).
  • Functional cookies and local storage entries from this website: until the browser is uninstalled or manually deleted by you.

13. Your Rights (GDPR Art. 15–22, Art. 7(3))

You have the right to:

  • Access the data stored about you (Art. 15 GDPR),
  • Rectification of inaccurate data (Art. 16 GDPR),
  • Erasure ("right to be forgotten", Art. 17 GDPR),
  • Restriction of processing (Art. 18 GDPR),
  • Data portability (Art. 20 GDPR),
  • Object to processing based on legitimate interests (Art. 21 GDPR).

Consents given may be revoked at any time with effect for the future (Art. 7(3) GDPR); the lawfulness of processing carried out prior to revocation is unaffected. You can most easily exercise revocation via the "Privacy Settings" button in the footer or by email to info@4ny.tools.

You also have the right to lodge a complaint with a supervisory authority of your choice. The authority with local jurisdiction for our registered office is: Der Landesbeauftragte für den Datenschutz und die Informationsfreiheit Rheinland-Pfalz, Hintere Bleiche 34, 55116 Mainz, Germany.

14. Automated Decision-Making

No decision based solely on automated processing that produces legal effects concerning you takes place.

15. Currency of this Policy

This privacy policy is updated when material changes are made to the service or the technologies used. The current version is always available at this URL.