TextFlex

Privacy & cookies

Last updated 28 August 2026

What happens to the data you paste

TextFlex is a WebAssembly application. When you open the site your browser downloads the program itself - the same fixed set of files everyone gets - and then runs it locally. From that point on, the transformation engine, the parser, the pattern language and everything you type live in the browser tab in front of you.

We do not receive the data you paste, and we could not, because nothing in the app sends it anywhere. There is no upload, no API call, no analytics event carrying your content, and no server-side component that ever sees a pane. The server's only job is to hand over the application files.

The same is true of the output. When you press Save, the file is written from the browser straight to the folder you choose or to your downloads - it does not travel through us on the way.

In practice this means you can disconnect from the network once the app has loaded and carry on working, and it means that pasting confidential or personal data into TextFlex does not disclose it to us. What you do with that data remains yours to govern; if it is personal data, you stay its controller.

What is stored on your device

TextFlex remembers your work and your settings so that closing the tab does not throw them away. It does this with your browser's local storage, which is a store on your own computer. Nothing written there is transmitted to us or to anyone else, and nothing in it is readable by another website.

You can remove all of it at any time by clearing site data for this site in your browser's settings - in most browsers, through the padlock or information icon in the address bar. Doing so loses the remembered session and settings and nothing else. If you would rather nothing were kept at all, a private or incognito window discards it when you close the window.

Cookies

TextFlex sets no cookies. Not for sessions, not for settings, not for analytics, not for advertising - there are none.

UK law on cookies - the Privacy and Electronic Communications Regulations 2003 - covers not only cookies but any storage of, or access to, information on your device, which includes the local storage described above. It requires consent for that, except where the storage is strictly necessary to provide a service you have explicitly requested. The four items above are all of that kind: they exist only to give you back the work, the theme and the layout you chose. They are not used to recognise you, to build a profile, or for any purpose other than the one stated beside each of them.

Our analytics stores nothing on your device at all - no cookie, no local storage, no identifier of any kind - so it falls outside those rules too. That is why TextFlex has no cookie banner: there is nothing to ask you to agree to.

Analytics

We use Plausible Analytics to count how much the site is used. Two things about how it is set up matter here:

• It is self-hosted on our own server in the European Economic Area (plausible.vsrc.uk). There is no third-party analytics company receiving anything, and the measurements are not shared with, sold to or combined with data from anyone else.
• It is cookieless and identifier-free. It does not set a cookie, use local storage, or store any persistent identifier, so it cannot follow you from visit to visit or from site to site.

For each page view it records:

• the page address on this site - which is only ever a page such as / or /privacy, and never contains anything from the panes;
• the site you arrived from, if any;
• your browser, operating system and device type;
• your country and, approximately, region - worked out from your IP address at the moment of the request.

Your IP address is used only to derive the country and to produce a one-way hash that lets the same visitor be counted once rather than twice within a day. The IP address itself is never written to storage, the hash cannot be reversed to recover it, and the secret used to produce it is replaced every 24 hours, so yesterday's hash and today's cannot be matched up. The result is a count of visits, not a record of visitors.

Our lawful basis for this is legitimate interests (UK GDPR Article 6(1)(f)): we need to know roughly how much the site is used and which pages people reach, and this is the least intrusive way we know of to find out. We have weighed that against your interests and consider the impact minimal - no personal data is retained, no profile is built, nothing is shared, and nothing about you is stored on your device. If you would prefer not to be counted at all, blocking plausible.vsrc.uk in a content blocker or your browser's settings stops it entirely, and TextFlex works exactly the same without it.

Server logs

Like every website, the server that hands out the TextFlex application files keeps standard access logs. These record the IP address making the request, the time, the file requested, the response status and the browser's user-agent string. They are generated by the web server itself, not by the app, and they never contain anything you typed - only the fixed file names that make up the program.

We use them to keep the site available and secure and to investigate faults and abuse. The lawful basis is again legitimate interests. They are retained for no longer than 30 days and are not used to build any profile or combined with the analytics above.

Who handles your information

TextFlex has no third-party services embedded in it - no advertising, no trackers, no social media widgets, no external fonts, no content delivery networks, and no third-party analytics provider. The only organisation involved besides us is the company that hosts the server, acting on our instructions under a contract, and the only information it handles is what the server logs section describes.

The servers - both the site and the analytics instance - are located in the European Economic Area, which UK adequacy regulations cover, so no transfer safeguards beyond that are needed. We do not transfer anything outside the UK or the EEA.

Your rights

Under the UK GDPR you have the right to be informed, and rights of access, rectification, erasure, restriction of processing, data portability and objection, as well as the right not to be subject to automated decision-making. TextFlex makes no automated decisions about anyone and does no profiling.

Because we hold nothing that identifies you, there is in practice very little for these rights to reach: we cannot look you up, because there is nothing to look up by. The exception is a server log entry, which we can find only if you can tell us the IP address and the approximate time. You are welcome to ask, and to object to the processing described above, at the address below.

If you are unhappy with how we have handled your information, you can complain to the Information Commissioner's Office, the UK's data protection regulator, at ico.org.uk/make-a-complaint or on 0303 123 1113. We would rather you raised it with us first so we have a chance to put it right.

Children

TextFlex is a tool for working with text and is not directed at children. It asks for no personal information from anyone, of any age.

Security

The site is served only over HTTPS, with HTTP Strict Transport Security, so the application files cannot be tampered with in transit. Since your content stays in your browser, the strongest protection it has is the one your own device provides.

Changes to this notice

If TextFlex changes in a way that affects any of this - and in particular if it ever gains a feature that sends your data anywhere - we will update this page and change the date at the top before that feature ships.

Contact

For anything about this notice, or to exercise any of the rights above, write to [email protected].

← Back to TextFlex