Privacy and local data
Chromoforge processes colors and selected images in your browser. This page describes the services currently used by the site.
Updated:
Reading this policy
This privacy page loads no Google Analytics, Microsoft Clarity, Cloudflare Web Analytics or advertising scripts, even if you previously accepted statistics. Its content is available without accepting a banner and with JavaScript disabled. The footer privacy preferences control only saves your choice for other pages.
Local processing and storage
The color tools process selected images on your device without uploading them to a color-processing server. Named palettes, favorites, recent colors, theme, language and consent preferences can remain in this browser until you remove its site data. Palette backups are files you choose to download. Clearing browser data also removes locally saved palettes.
Hosting and delivery
Cloudflare Pages and the Cloudflare network deliver and protect the website. Loading a page involves technical request information such as IP address, requested URL and browser details. This hosting activity is separate from optional analytics and local image processing.
Optional statistics on other pages
Google Analytics 4 measures visits and tool usage, including copy, save and export events. Microsoft Clarity records interactions for heatmaps and session replay. These services can use cookies and related tracking technologies. They load only after you accept statistics, including a choice saved during an earlier visit. Rejecting prevents loading; rejecting after acceptance reloads the page to stop the optional scripts. Advertising consent signals remain denied. Product events do not include image filenames, saved palette names or backup contents.
Cloudflare Web Analytics on other pages
A separate Cloudflare Web Analytics beacon measures visits and page performance on tool and guide pages. It runs independently of the Google Analytics and Clarity choice. Cloudflare describes this service as cookie-free. It is excluded from this privacy page.
Advertising and the European regulations message
AdSense remains in account-verification mode: the site publishes its verification meta tag and ads.txt, but does not load the advertising SDK or request ads. A Google advertising consent message is not deployed by the current site code. Accepting statistics does not authorize advertising. The policy and consent integration must reflect the actual setup before advertising is enabled.
Changing your choice
Use Privacy preferences in the footer to review or change the statistics choice. On this page, accepting only saves the preference; analytics can load on a subsequent visit to another page. Revoking consent prevents further loading but does not automatically delete information already held by providers. You can remove local preferences and palettes in browser settings.
Provider information
See the provider notices for their processing, retention policies and international transfers. The actual retention of site analytics depends on the operator’s account settings.
Contact form and correspondence
Contact pages load no analytics, session recordings, ads or analytics consent banner, even after previous acceptance. Sending is voluntary and requires JavaScript. When you submit, the form sends optional name, required email, topic and message, together with site, language and a technical request identifier, to the shared QRWave service on Cloudflare Workers. Cloudflare protects requests and applies abuse limits; Resend forwards the plain-text email and Google/Gmail receives it in the private support mailbox. No attachments or automatic visitor replies are used. Fields are not sent to analytics or saved by the site in browser storage or service-worker caches. Success means provider acceptance, not confirmed mailbox delivery.
Contact security and counters
The shared service uses server-side protections without CAPTCHA. Cloudflare D1 counters store a technical identifier, UTC day and site, without names, email, messages or IP addresses. Active counters keep about three days; recovery copies follow provider settings. Technical request information is processed for hosting and abuse protection. Rate limits and daily quotas count retries and failed attempts; unchanged retries reuse a provider idempotency identifier for up to 24 hours.
Direct email
For support and privacy requests, you can also write directly to: enzo.digital.hub@gmail.com
Controller details still to complete
The owner must complete the controller’s legal name, contact address, legal basis for correspondence, actual correspondence retention and provider arrangements. No controller identity is inferred from the private recipient mailbox.