Privacy statement

Last updated: 16 October 2026. This statement describes what the site does today. When that changes, this page is updated on the same day, and the date above changes with it.

In one paragraph

Your grades never leave your device. The calculator runs entirely in your browser, there is no account and no upload, and nothing you type is stored or transmitted. We run no analytics of our own. We do run Google AdSense to pay for the site, and Google's advertising code can set cookies on your device and receives your IP address, so in the European Economic Area, the United Kingdom and Switzerland you are asked first. The only personal data we ourselves process is the IP address that any web server needs in order to send you a page, plus anything you choose to put in an email to us.

Who is responsible

beFortunate, established in the Netherlands, is the controller for the processing described here.

Contact: [email protected]. For a privacy question or a data protection request, put "Privacy" in the subject line.

Your grades and other input

Everything you type into the calculator — points, grades, weights, targets, your custom grading scale — is processed by JavaScript running in your own browser.

• It is not sent to us or to anyone else.
• It is not stored. Nothing you type is written to a cookie, to your browser's storage, or to any record on our server. Reload the page and your inputs return to their defaults; your custom scale resets too. The advertising cookies described below hold none of it.
• It is not logged. We never see it.

Verifiable, and worth being precise about. The page used to be served with a Content-Security-Policy that forbade every outgoing request (connect-src 'none'). That is no longer true: Google's advertising code cannot work under such a policy, so the policy now permits requests over HTTPS. What protects your grades is therefore not the policy but the calculator itself, which contains no code that sends anything anywhere. Our pre-release browser test records every single request the page makes and asserts that there is exactly one external request — Google's advertising script — and none at all from the calculator, in any of its four modes, including while you type.

Printing a teacher table happens through your browser's own print function. The sheet goes to your printer or your PDF file. It does not pass through us.

Technical data needed to deliver the page

Loading any web page requires your IP address to be visible to the servers that send it. For this site, that path is:

Short-term technical logs may exist at the Cloudflare and reverse-proxy layers for delivery, troubleshooting and protection against abuse. We do not use that data to profile you, we do not combine it with anything else, and we do not sell or share it. We do not track you across sites.

To be exact about that last row: normal page views are not written down anywhere on our server. An error is. If you request an address that does not exist, the web server records one error line, and that line includes the requesting IP address. Those error lines go to the container's own log, which is capped at two files of one megabyte and overwrites itself, so they are kept only briefly. We do not read them except when something is broken.

Legal basis, where the GDPR applies: our legitimate interest in delivering a working, secure website.

Cookies

We set no cookies of our own. Google's advertising code can set cookies, and it runs on every page here.

The cookie notice is the detailed page: it names each cookie, what Google says it is for, how long it lasts, and how to refuse or change your choice. In summary:

• Nothing you type is involved. Your grades are never put in a cookie.
• The cookies come from Google AdSense and from Google's consent message.
• In the EEA, the UK and Switzerland you are asked before personalised advertising data is used, and the Cookie settings button at the bottom of every page reopens that question whenever you want.
• The calculator needs no cookie, so refusing changes nothing about how it works.

Advertising

We fund the site with Google AdSense. Google's AdSense tag (publisher ca-pub-0745848274612756) and Google's own consent message load on every page.

No ads are showing yet. No ad unit is switched on, because Google has not finished reviewing the site. We are telling you now anyway: the code that can set cookies and that receives your IP address is already on the page, so this statement describes it now rather than after you have met it.

What Google processes. Because your browser fetches Google's script directly, Google receives your IP address and the usual request details, and can set or read the cookies listed in the cookie notice in order to serve and measure advertising, and to personalise it where that is permitted. We do not receive that data, we do not have an advertising profile of you, and we cannot look you up in Google's systems. Google's handling is governed by Google's own terms and privacy policy.

Ad technology providers. We use Google only. We have added no other advertising company. Google may itself work with ad technology providers; Google's consent message is where that list is presented to you, under Manage options.

Consent. Google's EU user consent policy requires publishers to make disclosures and obtain consent for cookies or other local storage where legally required, and for the collection and use of personal data for ad personalisation, from users in the European Economic Area, the United Kingdom and Switzerland, and to identify the ad technology providers used (Google, EU user consent policy). For personalised ads in those regions Google additionally requires a consent platform it has certified, integrated with the IAB Transparency and Consent Framework. We use Google's own certified message rather than a third company's.

Legal basis, where the GDPR applies: your consent, for the advertising cookies and for the use of personal data for ad personalisation, wherever consent is required. Withdraw it at any time with the Cookie settings button; withdrawal costs you nothing but personalised ads.

What we will not do. We will not add a second advertising network, an analytics product or any other third-party script without saying so on this page first. We did not switch advertising on quietly, and we will not change this quietly either.

The page's security policy

A detail for the technically minded, because this page used to claim the opposite.

This site is served with a Content-Security-Policy. It used to forbid all outgoing connections (connect-src 'none') and allow no third-party script. Google states that it supports only one strict policy shape for the AdSense tag, because the domains that tag loads from change over time. So the script rule is now the shape Google requires — a fresh random nonce generated for your individual request, plus 'strict-dynamic', which lets a script we vouched for load the further scripts it needs — and connect-src, img-src and frame-src now permit HTTPS. In plain terms: the browser is now permitted to talk to Google over HTTPS, where before it was permitted to talk to nobody.

What did not change: object-src, base-uri, form-action and frame-ancestors are all still locked down, the site still has no form that submits anything, and the calculator still contains no code that sends your input anywhere.

Analytics

We run none of our own. No Google Analytics, no alternative analytics product, no pixel, no fingerprinting script, no A/B testing tool. We do not measure your visit and we have no dashboard of visitors.

One thing we do not want to blur: Google measures its own advertising, and Google's own documentation classifies one of its consent cookies (FCNEC) as analytics. That is Google's measurement of its advertising, not us watching you — but it is measurement, and you should know it is there rather than read "no analytics" and assume nothing is counted.

If we ever add measurement of our own, this page will say so before it runs, and anything requiring consent will ask for it.

Email you send us

If you write to us, we receive your email address, your message, and whatever else you choose to include. We use it to answer you and to fix what you reported, and for nothing else. We do not add you to a mailing list; there is no mailing list.

Legal basis, where the GDPR applies: our legitimate interest in answering correspondence.

Children

The site has no accounts, no sign-up and no profiling, and collects nothing from anyone who simply uses the calculator. We do not knowingly collect personal data from children. Students are welcome to use the calculator; nothing they type reaches us.

Your rights

Where the GDPR or a comparable law applies, you have rights of access, rectification, erasure, restriction, objection and data portability, and the right to complain to your data protection authority.

An honest note on what we can do with them: in normal use of the calculator we hold no personal data about you at all, so there is usually nothing for us to access, correct or erase — we would have no way to find a record of your visit. If you have emailed us, we do hold that correspondence, and those rights apply to it in full. Write to [email protected].

Two things are not in our hands. Advertising consent is withdrawn through the Cookie settings button, because Google's message holds that choice, not us. And for data Google holds about you, you have to go to Google: we cannot access it, correct it or delete it on your behalf, and saying otherwise would be a promise we could not keep.

Changes to this statement

The date at the top is the date of the last change. Material changes — advertising, cookies, analytics, any new third party — will be reflected here before the change goes live, not after.

Sources

• Browser-only calculation, and exactly one external request: read from this site's code, and asserted by the pre-release browser test, which records every request the page makes and requires the only external one to be Google's AdSense script. The test stubs that script, so it proves what our page requests, not what Google's code then does. Verified 16 October 2026.
• No storage written by our own code: read from the code, which contains no document.cookie, localStorage, sessionStorage or IndexedDB call. The browser test checks requests rather than storage, so this claim rests on the code alone. Verified 16 October 2026.
• Access log switched off, error log on: this site's own web server configuration (container/nginx.conf, access_log off and error_log /dev/stderr warn). An nginx error line for a missing file carries the client IP. The container log cap is compose.yaml (json-file, max-size: 1m, max-file: "2"). Verified 16 October 2026.
• Advertising and consent code loaded on every page: public/assets/integrations.json records adsense.enabled: true with publisher ca-pub-0745848274612756, adsense.adUnitsLive: false, and consent.provider: google-funding-choices; every generated page in public/ carries the AdSense tag and public/assets/consent.js. Verified 16 October 2026.
• The Content-Security-Policy quoted above, word for word: container/nginx.conf — per-request nonce from nginx's $request_id, 'strict-dynamic', connect-src 'self' https:, img-src 'self' https:, frame-src https:, and object-src, base-uri, form-action, frame-ancestors all 'none'. Verified 16 October 2026.
• Google supports only a strict nonce-based policy for the AdSense tag, because its loading domains change: Google AdSense Help, Integrate the AdSense ad code with a Content Security Policy (CSP) — "Because the domains that the AdSense ad code uses change over time, we only support strict CSP". Checked 16 October 2026.
• Google's consent requirements in the EEA, UK and Switzerland: Google AdSense Help, EU user consent policy. Checked 16 October 2026.
• Certified consent platform required for personalised ads, and Google's own message certified: Google AdSense Help, European regulations overview and guidance. Checked 16 October 2026.
• Cookie names, purposes and lifetimes, including FCNEC classified as analytics: Google, Our advertising and measurement cookies. Checked 16 October 2026. The full list is in the cookie notice.