Privacy policy

Last updated: 9 October 2026

In short

• Calculations run in your browser or in the app. Without an account, your inputs stay on your device.
• An account is optional. With one, we store your email address and your calculators so they are available on all your devices.
• No cookies, no advertising, no sharing with third parties. For anonymous visitor statistics we use self-hosted Umami – without cookies and without profiles.
• You can delete your account yourself at any time – including all stored calculators.

Controller

Calculating without an account

All calculations run on your device. Your inputs are not transmitted to us. So that you can use a calculator again later, the website stores in your browser's local storage (localStorage) your calculators and notepads, the calculators you opened last, the light/dark setting, a random device ID for synchronisation and the most recently loaded exchange rates. This data does not leave your device as long as you do not use an account. You can delete it at any time in your browser settings.

This storage is strictly necessary for the function you requested (§ 25 (2) no. 2 TDDDG); no consent is required for it.

For currency conversion in the notepad, the site loads the daily exchange rates of the European Central Bank from our server. No inputs are transmitted in the process.

Hosting and servers

The website itself is static and is delivered via Cloudflare Workers, a service of Cloudflare, Inc., 101 Townsend St, San Francisco, CA 94107, USA. Cloudflare delivers the site through its worldwide network of data centres, usually from a location near you. Requests to our interface (sign-in, synchronisation, exchange rates) also pass through Cloudflare and are forwarded from there to our server. In doing so, Cloudflare necessarily processes your IP address and details of the request (requested address, time, browser identifier) and stores them briefly in server logs, for example to fend off attacks. We have a data processing agreement with Cloudflare under Art. 28 GDPR (Cloudflare Data Processing Addendum). Cloudflare is certified under the EU-US Data Privacy Framework; transfers to the USA are therefore covered by an adequacy decision of the EU Commission (Art. 45 GDPR).

Our server with the interface, accounts and database is operated by netcup GmbH, Daimlerstraße 25, 76185 Karlsruhe, in Germany. The visitor statistics tool Umami also runs there. We have a data processing agreement with netcup under Art. 28 GDPR.

The legal basis for delivery via Cloudflare and netcup is our legitimate interest in a fast, reliable and secure website (Art. 6 (1) (f) GDPR).

Our server also necessarily processes your IP address in order to answer requests. Our application does not store access logs with IP addresses. To protect against password guessing and mass requests, the server keeps the IP address or email address in memory for at most 15 minutes after failed sign-ins, registrations and password reset requests; they are not stored permanently. The legal basis is our legitimate interest in secure operation (Art. 6 (1) (f) GDPR).

Visitor statistics (Umami)

To understand which pages and calculators are used, we use Umami. Umami runs on our own server at netcup in Germany; the data is not shared with third parties. Umami sets no cookies and stores nothing on your device.

It records the page visited, the referring page, browser, operating system, device type, screen size, language and the country or region derived from the IP address. When you use a calculator, we count the event “calculation” with the calculator's name once per page view. We also count when you copy a result (“result copied”) or a link (“link shared”), and once per session when you calculate in the notepad (“notepad used”) – your inputs and results are not transmitted. The IP address is not stored. To group the page views of one visit, Umami forms a checksum from the IP address, browser identifier and a regularly changing random value. We cannot attribute the data to any person and do not combine it with other data.

The legal basis is our legitimate interest in improving the service based on anonymous usage figures (Art. 6 (1) (f) GDPR). Since nothing is stored on or read from your device, no consent is required. You can object (Art. 21 GDPR); technically, an ad or script blocker is enough, and the site keeps working unchanged.

Account and synchronisation

If you create an account, we store on our server:

• your email address and an account ID,
• your password only as a cryptographic hash (bcrypt) – we do not know it,
• your calculators and notepads with inputs, titles and modification times, as well as the random ID of the device on which a change was made,
• sign-in sessions (only as a hash of the session key, with creation and last-use time),
• whether and when you confirmed your email address.

The purpose is to provide your account and to synchronise your calculators between web and app (Art. 6 (1) (b) GDPR). Sessions expire after 90 days; links to confirm your email address are valid for 7 days, links to reset your password for 1 hour.

Deleting your account

You can delete your account yourself at any time – on the web in the account menu, in the app in the account settings. This immediately deletes the account, sessions and all synchronised calculators. The data disappears from the daily database backups after 14 days at the latest.

Ideas and feedback

With “Send an idea” you can send us a suggestion. For this we store on our server the type (new calculator, improvement, bug, other), your text, the page you write from, the language of the website, the time and – only if you enter it – your email address. To prevent mass submissions, the server counts submissions per IP address in memory for at most one hour; the IP address is not stored.

We copy the suggestion, without your email address, as a task into our non-public project on GitHub (GitHub, Inc., USA, as a processor under Art. 28 GDPR; the transfer is based on the EU-US Data Privacy Framework). So please don't put anything personal in the text that we don't need for the suggestion.

We use your email address only to answer you: whether we build the suggestion and when it is live – at most one email per decision, no marketing. The legal basis is your consent (Art. 6 (1) (a) GDPR), which you can withdraw at any time by writing to info@calcpaper.com; for the suggestion itself, our legitimate interest in improving CalcPaper ((f)). 30 days after we have rejected or shipped a suggestion, we automatically delete it, including the email address, from our server; on request immediately.

Emails

We only write to you when it is necessary for your account: to confirm your email address, to reset your password and to confirm an account deletion – and, if you entered your address with a suggestion, about its status (see above). There is no newsletter. For sending we use Brevo GmbH, Köpenicker Str. 126, 10179 Berlin, Germany, as a processor (Art. 28 GDPR).

If you write to us at info@calcpaper.com, Cloudflare (Cloudflare Email Routing, provider see “Hosting and servers”) forwards the message to our mailbox. In doing so, Cloudflare processes your email address and the message in order to deliver it. We only use your details to answer your enquiry (Art. 6 (1) (f) GDPR, for questions about your account (b)).

iOS app

The same applies to the app as to the website: without an account, your calculators stay on the device; with an account, they are synchronised as described above. The session key is stored in the iOS keychain. The app contains no analytics, advertising or tracking libraries. Apple is responsible for download and updates; Apple's privacy policy applies.

Calculators embedded on other websites

Partners can embed our calculators in their websites. There, too, calculations run in the visitor's browser; inputs are not transmitted to us. Our server delivers the partner's settings and checks, based on the calling website, whether embedding is allowed. For statistics, we count anonymously how often each calculator was shown, used or its partner button clicked per partner and day – without IP addresses or other personal details. The respective partner is responsible for the website on which a calculator is embedded.

Your rights

You have the right to

• access the stored data (Art. 15 GDPR),
• rectification (Art. 16 GDPR) and erasure (Art. 17 GDPR),
• restriction of processing (Art. 18 GDPR),
• data portability (Art. 20 GDPR),
• object to processing based on legitimate interests (Art. 21 GDPR).

To do so, write to us at info@calcpaper.com. You can also lodge a complaint with a data protection supervisory authority, for example the authority where you live.

Changes

When CalcPaper changes, we update this policy. The version published here applies.