Privacy Policy

This Privacy Policy explains what happens to information when you use gis-tools.com (the "Service"). It sits alongside our Terms of Use and Cookie Policy.

1. Who we are

The Service is operated by Yarden Haramati, an individual based in Israel ("we", "us", "our"). For the personal data described in this policy, we are the data controller.

You can reach us at gis.tools.online@gmail.com. This is a one-person project, so that address is both the general contact and the privacy contact. We have not appointed a Data Protection Officer, and are not required to.

2. What this policy covers

It covers gis-tools.com and the tools on it. It does not cover other websites you reach from here — including the tip-jar link in the navigation bar, OpenStreetMap, or anything in an ad. Those sites have their own policies, and we have no control over them.

3. Your spatial data

This is the part most people come to this page for, so it goes first.

The geometries, coordinates and files you paste, draw, import or convert are processed entirely inside your browser, by JavaScript running on your own device. They are not uploaded to us. We could not read them if we wanted to, because there is no server on our side that receives them and no database that stores them.

Three consequences worth understanding:

• Your work is saved on your device, not ours. The tool remembers your layers, theme and sidebar width in your browser's local storage, under the keys gisconv.workspace.v1, gisconv.theme.v1 and gisconv.sidebar-width.v1. That data stays in your browser. Clearing your browser's site data for gis-tools.com removes it, and nobody else — including us — can reach it.
• Share links carry your data inside the link. The "copy share link" feature compresses your layers into the part of the URL after the #. Browsers do not send that part to any web server, so sharing a link does not send your geometry to us or to our host. But the data is genuinely in the link: anyone you give that link to can open it and see the layers, and so can anyone who later reads the message you sent it in. Treat a share link as you would treat the file itself.
• We cannot recover your work. Since we never hold it, we cannot restore a lost workspace or retrieve a layer you deleted.

4. What we collect, and what we don't

We do not ask you for your name, address, phone number or date of birth, and there is nowhere on the site to enter them. There is no registration, no login, no checkout and no newsletter.

What actually reaches us, directly, is a short list:

• Email you send us. If you write to the address above, we receive your email address and whatever you put in the message. We use it to answer you, and nothing else. We do not add you to any mailing list.

That is the whole list. In particular:

• We do not run server-side logging. The site is static files served from Amazon CloudFront and S3. Access logging is not enabled, so we hold no log of IP addresses, pages viewed or visit times.
• We hold no analytics data ourselves. If you allow analytics, the data goes to Google Analytics and we read it there — see section 5.
• We do not sell, rent or share personal data for anyone else's marketing.
• We do not build profiles and make no automated decisions that have legal or similarly significant effects on you.

5. Who your browser talks to

Loading any web page means your browser makes requests to the servers that deliver its parts. Each of those servers necessarily receives your IP address, your browser and operating system details, and the page you were on. That is how the web works, and it applies here even though we collect nothing ourselves.

These are all of them:

Google acts as an independent controller for its own advertising and measurement purposes, and its handling is governed by the Google Privacy Policy and How Google uses information from sites that use its services. You can review and change what Google does with your ad data at My Ad Center, and opt out of Google Analytics entirely with Google's opt-out browser add-on.

The Buy Me a Coffee link in the navigation is an ordinary outbound link. Nothing from that service loads on this site, and it learns nothing about you unless you click it. If you do choose to tip, that transaction happens on their site under their policy — we never see your payment details.

6. Cookies and browser storage

Our Cookie Policy is the full inventory — every cookie and storage entry, what sets it, what it is for and how long it lasts. In outline:

• Necessary — remembering your consent choice itself, and the tool's own local storage described in section 3. Always active; without it the site cannot work as intended.
• Analytics — Google Analytics via Tag Manager. Off unless you turn it on.
• Advertising — governs whether Google may personalise ads. Ads appear either way.
• Functional — remembering preferences such as your light or dark theme.

You can change or withdraw your choice at any time via Cookie Preferences in the footer of any page. Your choice is stored for 30 days, after which you are asked again.

If you are in the EEA, the UK or Switzerland, you will see Google's own consent message rather than ours. Google requires publishers serving ads in those regions to use a consent platform it has certified, and ours is not one — so rather than ask the same question twice, our dialog stands down and your answer in Google's message governs. Everywhere else, ours is the only dialog.

We do not currently respond to browser "Do Not Track" or Global Privacy Control signals, because there is no settled standard for what a static site with no server-side collection should do with them. Use the cookie controls above instead — they do work.

7. Why we are allowed to do this

For visitors in the EEA and the UK, the GDPR requires a legal basis for each purpose:

• Delivering the site (hosting, the script CDN, map tiles) — our legitimate interest in making the Service available at all. It cannot be delivered without these requests.
• Storing and reading your consent choice, and the tool's own local storage — strictly necessary to provide a service you asked for.
• Analytics — your consent, which you may withdraw at any time.
• Personalised advertising — your consent.
• Non-personalised advertising — our legitimate interest in funding a tool we give away for free, balanced against the limited data involved.
• Answering your email, and keeping the correspondence — our legitimate interest in replying to people who contact us and in keeping a record of what was said, and taking steps at your request.

Where we rely on legitimate interests you have the right to object; see section 10.

For visitors in Israel, we process personal data in accordance with the Protection of Privacy Law, 5741-1981 and the regulations under it. We maintain no database of users.

8. How long things are kept

• Your consent choice — 30 days, then it expires and you are asked again.
• The tool's local storage (workspace, theme, sidebar width) — until you clear your browser's data for this site. It is on your device, so the timing is entirely yours.
• Email correspondence — for as long as it may still matter: to deal with your message and any follow-up, and after that as a record of what was said, in case the same matter comes up again or we need it to establish or defend a legal claim. We do not use it for anything else, and we do not add you to any list.
• Everything else — we do not hold it, so there is nothing to retain. Data held by Google under its own policies is subject to Google's retention periods, not ours.

9. Where data goes

We are based in Israel, which the European Commission has recognised as providing an adequate level of data protection. The third parties in section 5 are based mainly in the United States, and serve this site from a global network, so a request may be answered from a server anywhere.

Where personal data of EEA or UK visitors reaches those providers, the transfer relies on the mechanisms each provider has in place — the EU-US and UK-US Data Privacy Framework where the provider is certified, and Standard Contractual Clauses otherwise. We have accepted the relevant data processing terms with Google and with Amazon Web Services.

10. Your rights

Depending on where you live, you may have the right to access the personal data held about you, to have it corrected or erased, to restrict or object to its processing, to portability, and to withdraw consent at any time without affecting what was done beforehand.

There is an honest practical point here. Because we run no accounts, no logs and no database, in almost every case we hold nothing about you, and our answer to an access or erasure request will be exactly that. The two real exceptions are:

• Email you have sent us — we can tell you what we hold, and delete it if you ask. The one exception is an exchange we still need as a record — for instance one concerning a complaint or a possible legal claim — which we may keep; if that applies to your request, we will say so rather than quietly decline.
• Data held by Google — that is Google's to give you, not ours. Use My Ad Center, your Google Account controls, or contact Google directly. We will help where we can, but we cannot reach into Google's systems on your behalf.

To exercise any right, email gis.tools.online@gmail.com. We aim to reply within 30 days. We do not charge for this, and we will not ask you to create an account to make a request.

If you think we have handled your data badly, please tell us first — but you also have the right to complain to a regulator: your national data protection authority in the EEA, the Information Commissioner's Office in the UK, or the Privacy Protection Authority in Israel.

11. Children

The Service is a technical tool for working with geographic data. It is not directed at children and holds no appeal we are aware of as a children's service. Under our Terms of Use you must be at least 13 to use it.

We do not knowingly collect personal data from children. If you believe a child has sent us personal data — realistically, by emailing us — contact us and we will delete it.

One nuance for the EEA: member states set the age for valid consent to cookies and similar technologies somewhere between 13 and 16. If you are under that age where you live, you should not accept the optional cookie categories without a parent or guardian.

12. Security

The site is served over HTTPS, and the storage bucket behind it is private and reachable only through the content delivery network. Because your spatial data never leaves your browser, the largest category of data involved here is not exposed to us or to anyone else in transit.

No method of transmission or storage is completely secure, and we cannot guarantee absolute security. What we can say is that the amount of personal data we hold is close to zero by design, which is the most reliable protection available.

13. Links to other sites

The Service links to sites we do not operate — OpenStreetMap, library documentation, our tip-jar page, and whatever appears in an advertisement. Clicking a link takes you outside this policy. We have no control over those sites and take no responsibility for their content or their privacy practices. Read their policies.

14. Changes to this policy

If what we do changes, this page changes with it and the "Last updated" date at the top moves. Because we have no accounts and no mailing list, we cannot notify you individually — posting the revised policy here is the notice. Changes take effect when posted, so it is worth glancing at this page occasionally.

Where a change would materially widen what is collected, we will ask for fresh consent rather than rely on a silent update.

15. Contact

Questions about this policy, or about anything privacy-related:

• Email: gis.tools.online@gmail.com
• Data controller: Yarden Haramati, Israel