Privacy

Page analytics (Flarelytics)

We count page views with Flarelytics, a cookieless analytics tool that runs on Cloudflare. It stores nothing on your device, so it runs without asking. For each page view it records:

• the page path, without any query parameters, and the domain of the site that sent you here, plus the utm source, medium and campaign tags if the link had them
• your country, as Cloudflare reports it, and the device type, browser and operating system, read from your browser's user-agent string
• a visitor hash: a keyed hash of your IP address, user agent, the site and the date. It changes every day, and your IP address itself is not stored.

It also records how far you scroll, how long you stay on a page and which external links you follow (the link's domain and path). The site adds a few events of its own: clicks on links to tools (which tool, and where on the page the link was), newsletter signups, reaching the middle of a blog article, quiz completions (the top-matched tool) and, when you email yourself quiz results, the domain part of your address (for example gmail.com), never the full address. These events carry the same visitor hash, country and device details as page views. Requests that look like bots are logged with their user-agent string, the page path and country, and are left out of visitor counts.

Error monitoring and usage analytics (OpsBeaver)

OpsBeaver is an observability service we run ourselves on servers at Hetzner in Helsinki, Finland. Its script loads from this site's own address (/_v/), and our server passes the data on without your cookies.

Always: error reports

When something breaks on the page, your browser sends an error report: the error message and stack trace, the page path, browser and OS versions, and device type. This stores nothing on your device, and the report carries no session or visitor identifier. We mask email addresses in error messages before storing them. Your browser may also report blocked content under our security policy (the page address and what was blocked).

Our server also records a trace of each request it handles and of each call it makes to Euromail (below): the address requested, timing and status code. This is how we see slow or failing pages.

Always: visitor counts from page requests

When our server sends you a page, it also tells OpsBeaver that the page was requested. It sends the page address (the path and the names of any parameters, but not their values), campaign tags, the site that referred you, the status code, your browser and operating system versions, your device type and your country. Your IP address and browser are combined with a secret to make a daily and a weekly visitor hash. The secret is deleted later, and we don't store the IP address itself. Nothing runs on your device or is read from it for this, so we don't ask for your consent. We do it because we have a legitimate interest in knowing how many people use the site and where they come from (GDPR Article 6(1)(f)). If your browser sends a Global Privacy Control signal, we don't count the page. Visits from crawlers and bots are counted separately from visits by people.

Only if you allow analytics: usage analytics

With your consent, OpsBeaver also records:

• sessions and page views, with addresses kept to their path and parameter names (no parameter values)
• the referring site and campaign tags
• page speed and loading timings, time on page and scroll depth
• the domains of external links you follow
• progress through the quiz (started, results shown, results emailed) and the newsletter form (submitted, subscribed)
• a daily and a weekly visitor hash, computed from your IP address and browser with a secret that is later deleted. The IP address itself is not stored. A deleted secret stays in OpsBeaver's database backups until those backups expire.

For this, your browser keeps two items in sessionStorage: opsbeaver.session, a random session ID with its start and last-activity time, and opsbeaver.journey.quiz or opsbeaver.journey.subscribe, which tracks your progress through that flow. Both are deleted when you close the tab, and the session also ends after 30 minutes of inactivity. Withdrawing consent removes them.

How long OpsBeaver keeps data

Raw events are kept for 90 days and aggregated statistics for 400 days. Grouped errors are kept until 400 days after they were last seen.

Newsletter and quiz results email (Euromail)

If you subscribe to the newsletter or ask for your quiz results by email, your address goes onto our newsletter list at Euromail, the EU-based email service that sends our mail. A newsletter signup from a new address gets a welcome email. Signing up again with an address already on the list sends nothing. Asking for quiz results sends the results email instead of a welcome email: it lists the three tools the quiz picked for you, and goes out even if you are already subscribed.

To slow down abuse, signups are rate-limited by IP address and by email address. Those counters live at Cloudflare for about a minute.

Every email we send has an unsubscribe link signed for your address. It opens a page where one click on the button removes you from the list. Mail apps that offer one-click unsubscribe remove you directly. You can also email hello@mailtoolfinder.com and we will remove you.

Hosting (Cloudflare)

The site runs on Cloudflare. Like any web host, Cloudflare handles your IP address and request details to deliver pages and protect the site from attacks. Its own privacy policy covers that processing.

Affiliate links

Some links to tool vendors are affiliate links, which may earn us a commission at no cost to you. They go through /go/<tool>/ on this site, which sends you straight on to the vendor and sets no cookie. Flarelytics counts the click (which tool, and where on the site). Once you reach the vendor's site, its own privacy policy and cookies apply, including the affiliate tracking that credits us.

What we store on your device

• mtf_consent (cookie, one year): your analytics choice, so we don't ask again. Only this site can read it.
• theme (localStorage): your light or dark mode choice, saved only if you use the switch.
• opsbeaver.session and opsbeaver.journey.* (sessionStorage): only if you allow analytics, see above.

Questions and requests

To ask what we hold about you, to have it deleted, or about anything on this page, email hello@mailtoolfinder.com.