Privacy Policy

The short version

Calculator inputs you type on a page stay in your browser and are not sent to our servers just by calculating. What we do collect is limited to what a specific feature needs: an account if you create one, API keys and request metadata if you use the API, and the contents of a calculation receipt if you choose to issue one. This page explains each case, how long we keep data, who processes it, and the rights you have.

Using calculators on the site

When you use a calculator's web page, the numbers you enter are processed in your browser to produce a result. They are not transmitted to us or stored on our servers as part of normal use. If you call a calculator's API endpoint, the inputs travel over HTTPS so we can compute and return a result; see API logs below for what is retained.

Account data

Accounts are optional and are used to manage API keys, usage, and calculation receipts. If you create one, we hold the identifiers needed to sign you in and operate the account — such as your email address, a display name where provided, and timestamps for account events. You can ask us to close your account and delete this data (see Deletion).

Authentication providers

Where sign-in is offered through a third-party identity provider, that provider authenticates you and shares a limited profile (for example your email and a provider user ID) so we can create or match your account. We do not receive your password. The provider handles your credentials under its own privacy policy.

Saved calculations

If a feature lets you save a calculation to your account, we store the inputs and outputs you chose to save so you can retrieve them later. Saved calculations are tied to your account, are private to you unless you deliberately share or publish them, and are deleted when you delete them or close your account.

API logs

When you call the API, we record request metadata needed to operate, secure, and rate-limit the service — such as the endpoint, an identifier for the API key used, timestamps, response status, and IP address. These logs let us meter usage, detect abuse, and debug errors. We do not use them to build profiles of individuals for marketing.

Security logs

We keep security and audit logs of sensitive events — for example sign-ins, API key creation and revocation, and administrative actions — to protect accounts and investigate suspected abuse. API keys are shown once at creation and are stored only as a hash; we cannot recover a key for you, only issue a new one.

Billing

Paid API access is billed through our billing partner. Today that is RapidAPI, which handles subscription and payment data under its own privacy policy; direct billing via Stripe is planned and, once live, would process payment data under Stripe's policy. We do not store full card numbers. We may receive billing-related metadata (such as plan, invoice status, and a customer reference) to operate your subscription.

VCC receipts

A Verifiable Calculation Certificate (VCC) is a signed record of a calculation. When one is issued, it contains the inputs, the output, and metadata about the formula, and it is persisted in our receipt store so it can be retrieved and checked later. Because a receipt embeds the values it certifies, treat those values as part of the receipt. See VCC privacy below for how visibility, redaction, expiration, and deletion work.

Public verification pages

The public verify page and verify API let anyone check a receipt without an account. If a receipt is made public, the receipt content — including its embedded inputs and output — is served to anyone with the link. Verification requests are rate-limited and logged as described under API logs. A receipt stays private unless you opt in to a public permalink.

AI features

Some features (such as the Copilot, explanations, and comparison tools) send the text you enter to a third-party large-language-model provider so it can interpret your question and phrase a response. The model never computes the numbers — those come from our tested calculators — but your prompt text does leave our servers to reach the provider, which processes it under its own terms. Do not enter information into these features that you would not want shared with a model provider.

Analytics — Google Analytics 4

We use Google Analytics 4 to understand which calculators are useful and how visitors navigate the site. GA4 is configured with Consent Mode v2: analytics cookies are denied by default for visitors in the EEA, UK, and Switzerland, and a consent banner lets you grant or decline before any analytics cookie is set. Outside those regions cookies may be set without a prompt, but you can still decline. Google processes this data under its own privacy policy. See our Cookie Policy for details.

Advertising — Google AdSense

A Google AdSense script is present on the site. Ads and ad-related signals (ad_storage, ad_user_data, ad_personalization) are also subject to Consent Mode — denied by default for EEA/UK/CH visitors until you accept via the banner. Google processes ad data under its own privacy policy.

Hosting & server logs

CalcFleet is hosted on Vercel. Vercel automatically collects standard server logs (IP address, request path, timestamp, response code) for security and diagnostics. These logs are short-lived and governed by Vercel's privacy policy.

Processors

We rely on third-party processors to run the service. They act on our instructions for the purposes described here:

• Vercel — hosting, delivery, and server logs.
• Google — Analytics 4 and AdSense.
• RapidAPI — API distribution and billing (Stripe planned for direct billing).
• Large-language-model provider — powering AI features, as described above.
• Authentication provider — where third-party sign-in is used.

Retention

We keep personal data only as long as needed for the purpose it was collected. Account data is kept while your account is open. API and security logs are retained for a limited operational period and then deleted or aggregated. VCC receipts persist until they expire or you delete them, subject to any legal retention we are required to observe. Hosting logs follow Vercel's retention.

Deletion

You can delete saved calculations and revoke API keys from your account, and you can ask us to close your account and delete the personal data associated with it. We will delete or anonymise it within a reasonable period, except where we must retain certain records to meet legal, security, or billing obligations. Deleting a VCC receipt removes it and its public permalink.

Export

You can request a copy of the personal data associated with your account in a commonly used, machine-readable format. Contact us using the details below to make a request.

International transfers

Our processors may store or process data in countries other than your own, including the United States. Where personal data is transferred out of the EEA, UK, or Switzerland, we rely on the safeguards offered by those processors (such as standard contractual clauses or equivalent mechanisms) as set out in their own policies.

Security

We use technical and organisational measures appropriate to the data we hold — including HTTPS in transit, storing API keys only as hashes, access controls, and audit logging of sensitive actions. No method of transmission or storage is perfectly secure, so we cannot guarantee absolute security.

Legal bases

Where the GDPR or comparable law applies, we process personal data on these bases: performance of a contract (running your account, API, and billing); legitimate interests (security, abuse prevention, and service improvement, balanced against your rights); consent (analytics and advertising cookies, which you control via the banner); and legal obligation (records we are required to keep).

Data controller

The data controller for CalcFleet is CalcFleet, established in Italy (registered address: Italy). Contact: privacy@calcfleet.com.

Your rights

Depending on where you live, you may have rights to access, correct, delete, export, or restrict the processing of your personal data, to object to certain processing, and to withdraw consent at any time without affecting prior processing. To exercise a right, contact us using the details above. If you believe we have handled your data improperly, you may lodge a complaint with your supervisory authority (the Garante per la protezione dei dati personali — garanteprivacy.it).

Breach response

If a personal data breach occurs that is likely to present a risk to your rights, we will notify the competent supervisory authority and, where required, affected individuals without undue delay, in line with applicable law.

VCC privacy

Verifiable Calculation Certificates follow a privacy-by-default model:

• Private by default — a receipt is not publicly discoverable unless you choose to publish it.
• Opt-in public permalink — you decide whether to expose a shareable public link; publishing is an explicit action.
• Redaction — where supported, sensitive fields can be redacted before a receipt is shared, so the embedded values are not disclosed.
• Expiration — a receipt can carry an expiry, after which its public availability ends.
• Deletion — you can delete a receipt, which removes it and any public permalink.

Because publishing a receipt discloses the inputs and output it embeds, we surface this explicitly at the point you choose to make one public.

Contact

Questions about this policy or your data? Email privacy@calcfleet.com.