Privacy Policy

Who we are

This site is operated by NumLM (너멜엠), the operator of numlm.com. For anything in this policy, contact us at numstats.kr@gmail.com.

What we collect — and what we don’t

We do not collect tool inputs on our server. Local calculators, text tools and file tools process your data on your device. Network lookups send the requested domain or IP address to the providers listed below; an optional SEO URL fetch contacts the website you enter. The personal data our own service processes is:

• Server access logs. Like every web server, ours records the page path, date and time, IP address, browser type (User-Agent) and referring page of each request. The query string — the part of a URL where tool inputs can appear — is deliberately not logged, neither for the page requested nor for the referring page (when a page you opened from a link with values loads its own files, your browser sends that full address as the referrer; we cut the query off before it is written). We use these logs to compile aggregate visit statistics (IP addresses are anonymised in the reports) and to protect the service against abuse. Legal basis under the GDPR: legitimate interest (Art. 6(1)(f)).
• Visit statistics. A small script of our own reports each page you open to our own server, so we can see which tools are used and where visitors come from. It sends no tool inputs, places nothing on your device and shares nothing with third parties; the server keeps only the page path, a country code, coarse browser and device families and a visitor number that changes every day. Details, retention and the opt-out switch are in the “Visit statistics” section below. Legal basis: legitimate interest (Art. 6(1)(f)).
• Feedback. If you use the “Send feedback” button, the message you write — and your email address, only if you choose to add it — is sent to our own server and stored so we can read and answer it. Legal basis: consent (Art. 6(1)(a)); you can withdraw it at any time by asking us to delete your message.
• Account (optional). If you log in for a beta feature, we keep the login provider (Kakao, Naver or Google), the account number that provider assigns to you for our app, your nickname, when you signed up, and when you last used the account (logged in, or visited while logged in — recorded at most once a day). We do not receive or keep your password, email address, phone number, profile picture or contacts, and we do not keep the provider’s access token. Legal basis: contract — providing the account you asked for (GDPR Art. 6(1)(b)); Korea PIPA Art. 15(1)(4).
• Beta feature usage. When a logged-in beta feature finishes, the site sends our server the feature name and how many items it processed; we store per account the date, the number of runs and the number of items. Your photos, file names, image details and adjustment settings are never sent. We use the counts to plan limits and pricing and to prevent abuse. Legal basis: legitimate interest (GDPR Art. 6(1)(f)). For the video face-blur tool, the video, its frames, the detected face positions and your manual regions never leave your browser; the only report is that one export finished (feature name, count 1). For the focus environment of the time tools, logging in unlocks extra sounds and themes; the only report is that the pack was used in a page session (feature name, count 1) — never which sounds, themes or volumes.
• Nothing else. No advertising identifiers, no third-party analytics, and no cookies except the login cookie described below. We never sell personal data and never share it with third parties for marketing.

Visit statistics

To learn which tools are used and where visitors come from, the site runs a small measurement script that we wrote and that talks only to our own server. When you open a page it sends: the page path (never the query string or fragment, where tool inputs live); the site that linked you here, once per visit (or the utm_source tag when there is no referrer); and your browser’s time zone and language. When you leave a page, or move to another page within the site, it sends how many seconds that page was visible. Like every web request, the beacon also carries your IP address and browser identification (User-Agent). On a tool page it also reports, at most once per visit, that you interacted with the tool (yes/no) and, for some tools, that you received a result such as a download or a copied answer (yes/no). What you typed, the files you chose and the results themselves are never sent.

The server keeps none of that in identifiable form. It stores the page path and time, a country code derived from the time zone, the two-letter language, the device type (phone, tablet or desktop) and the browser and operating-system family, the referring site, the visit duration and a visitor number that is used only to count sessions and unique visitors. That number is a one-way hash of your IP address, your browser identification and a secret key that is replaced every day and then deleted — so visits on different days cannot be linked, and the number cannot be turned back into an IP address. The statistics service does not store your IP address or your User-Agent string.

Nothing is placed on your device for this purpose — no cookie, no identifier in storage — and nothing is read from it, so there is no cross-site tracking and, under the EU ePrivacy rules, no consent banner is needed. It does not send your login or account number, even when you are logged in. Legal basis under the GDPR: our legitimate interest in understanding and improving the service (Art. 6(1)(f)). Per-visit records are deleted after 180 days; only daily totals (visitors, sessions, page views and, per page, how many visits used it) without any identifier are kept longer. The reports are seen by the site operator only.

You can switch measurement off for this browser at any time with the control below; the choice is stored in this browser’s localStorage and nothing is sent while it is set. We also honour the Do Not Track and Global Privacy Control signals: if your browser sends either, no beacon is sent at all.

Accounts and beta features

Basic tools never ask you to log in. Some features marked “Log in · Beta” — for example applying edits to many photos at once, or blurring faces in a video — are available to logged-in users during the beta. Your photos are still processed only on your device; logging in does not upload them.

You log in through Kakao, Naver or Google. We ask the provider only for your nickname (Google also returns your name and profile picture as part of its basic profile; we keep the name as your nickname and discard the rest). The provider learns that you logged in to NumLM Tools under its own policy.

Your login is kept in a cookie named nlm_user that contains an internal account ID we generate (not the provider’s account number) and an expiry date, signed so it cannot be forged (HttpOnly, valid for 90 days). A second cookie, nlm_oauth, exists for up to 10 minutes while you are logging in, to protect the login against forgery. This browser also stores ns-account-hint=1 in localStorage so the site knows to check your login; it contains no identifier.

The visit-statistics script never sends your account; visit statistics stay anonymous whether or not you are logged in.

You can log out at any time from the account menu at the top of the page, and delete your account there with “Delete account”. Deletion is immediate: your account record and provider link are erased, your usage counts are merged into totals that identify no one, and for Kakao accounts we also disconnect our app from your Kakao account. Accounts not used for 2 years are deleted automatically in the same way; because we hold no contact details, we cannot notify you beforehand.

Data stored in your browser

Your preferences (language, theme, units, text size, favourites, recently used tools) and the inputs or records some tools keep (for example the subscription tracker) are stored in your browser’s localStorage so the site works and remembers your settings. This data never reaches our server. You can remove it at any time with a tool’s Clear button or by clearing the site’s data in your browser. If you log in, ns-account-hint (value 1, no identifier) is stored as described under “Accounts and beta features”; a photo tool may also keep your adjustment values — never the photos — in IndexedDB for 30 minutes when you log in in the same tab. The face-blur tool keeps that model in the browser’s Cache Storage (no personal data) and keeps nothing else — no video, no face positions — between visits. The time tools keep your focus-environment settings (theme, sound mix, link options, master switch) with the other timer settings in localStorage and saved mixes under a separate key; theme images and ambient-sound loops (and the cuckoo alarm clip) are ordinary cached files that contain no personal data.

Third-party requests

Loading the site triggers a small number of requests to third parties. Each request necessarily transmits your IP address to that provider:

• Login providers — only when you choose to log in: Kakao (kakao.com), Naver (naver.com) or Google (accounts.google.com). Your browser goes to the provider’s login page, and our server exchanges a one-time code with that provider to read your nickname and account number. Each provider processes your data under its own privacy policy.
• Google Fonts (fonts.googleapis.com / fonts.gstatic.com) — serves the Noto Sans KR web font. Google’s privacy policy: policies.google.com/privacy.
• Face-detection model. The video face-blur tool downloads a face-detection model and its WebAssembly runtime (about 14 MB, MediaPipe, Apache-2.0) from this site, not from a third party, the first time you analyse a video, and keeps it in your browser’s cache. No video data is sent in return.
• Frankfurter (api.frankfurter.dev) — the daily exchange-rate table (European Central Bank reference rates), fetched only when you open the Currency Converter.
• Internet measurements — Cloudflare (speed.cloudflare.com and 1.1.1.1) and selected Amazon Web Services regional endpoints receive measurement requests and your public IP address. Speed tests transfer download and upload test data after you press Start. The speed-test engine’s optional result logging is disabled.
• DNS tools — the selected DNS-over-HTTPS providers (Cloudflare, Google, DNS.SB, AliDNS, tiar.app and doh.li) receive your queried domain or reverse-IP name and your public IP address.
• IP lookups — Cloudflare, ipify, BigDataCloud, ipwho.is, ipinfo.io and ipapi.co may receive requests to identify your public address or look up the address you enter. Provider availability determines which fallback is used. Location results are approximate.
• WebRTC leak test — when started, it contacts the displayed STUN server to discover connection candidates. That server sees your public IP address; no microphone or camera permission is requested.
• SEO URL fetch — only when requested, your browser contacts the URL you enter. The target website receives your IP address and the requested URL. Pasted or uploaded HTML is analysed locally.

Cookies

Visitors who do not log in get no cookies from us; preferences live in localStorage, which stays on your device and is not sent with requests. If you log in for a beta feature, we set nlm_user (your signed login, 90 days) and, during login only, nlm_oauth (10 minutes) — both strictly necessary for the login you requested, so no consent banner is used. They are deleted when you log out or delete your account. The administration pages set separate cookies in the operator’s own browser, so that the operator’s visits are left out of the statistics.

How long we keep data

• Access logs are rotated and kept only as long as needed for the statistics and security purposes above, then deleted.
• Visit statistics: per-visit records for 180 days, the daily hashing key for one day; daily totals without any identifier (visitors, sessions, page views and, per page, how many visits opened it, used it, received a result and how long it was visible in total) are kept for as long as the site exists.
• Feedback is kept while we need it to respond and improve the service, and deleted when you ask us to or when it is no longer needed.
• Accounts: until you delete them, or 2 years after you last used the account (logged in or visited while logged in). Per-account usage counts: 365 days, after which — and immediately on account deletion — they are merged into totals without any identifier. Daily login totals (how many logins started and finished) contain no identifier and are kept for as long as the site exists.

Your rights

Depending on where you live (for example under the GDPR, the UK GDPR, the CCPA or Korea’s Personal Information Protection Act), you may have the right to access, correct, delete or receive a copy of your personal data, to restrict or object to its processing, and to lodge a complaint with a supervisory authority. To exercise any of these rights, email us at numstats.kr@gmail.com. Note that access logs and visit statistics do not allow us to identify you by name; where we cannot identify you, some rights may not be technically applicable (GDPR Art. 11). You can object to visit measurement directly, without contacting us, with the switch in the “Visit statistics” section. If you have an account you can delete it yourself at any time from the account menu; this erases the account immediately.

Children

The tools are a general-audience service usable without an account. Accounts are not intended for children under 14, and we do not knowingly create accounts for them; if we learn that an account belongs to a child under 14, we delete it. The feedback form is not directed at children.

International use

The site is available worldwide. The limited data described above is processed on servers we operate, and feedback is handled where we are established (the Republic of Korea). By using the site or sending feedback from another country, you understand that your data is processed there under this policy.

Changes to this policy

If we change what we collect or how we use it, we will update this page and its effective date. Material changes will be flagged here before they take effect.

Contact

Questions or requests about privacy: numstats.kr@gmail.com