Privacy Policy

You can use almost all of rftools.io without an account and without telling us who you are. The calculators run in your browser; their inputs are not sent to us.

What we do hold: an email address if you register or subscribe to the newsletter; the work you choose to save; files you upload for simulation; billing details held by our payment provider; and a network address recorded for abuse handling and rate limiting.

We use Google Analytics, Google AdSense and LogRocket session recording. These are described in section 6 and in the Cookie Policy.

We do not sell personal data.

The controller of the personal data described here is the operator identified with a postal address and a contact address at the head of this document.

For any question about this policy, or to exercise a right under section 9, email contact@rftools.io.

Information you give us

• Account details. When you register, an email address and a password. The password is held by Amazon Cognito and we never see it. Cognito assigns your account an internal identifier, which is what most of our records are keyed to.
• Saved calculations. If you save a calculation, we store the calculator, a label you choose, the input values, the time, and the email address of the account it belongs to.
• Uploaded files. Touchstone and CSV files you upload for a simulation, stored in Amazon S3.
• Simulation jobs. The job type, the parameters you submitted, references to any uploaded files, the tier the job ran on, timestamps, and the result.
• API keys. We generate a key and store only a SHA-256 hash of it, together with a short preview. The key itself is shown once and is never stored, so it cannot be recovered — only replaced.
• Billing details. If you subscribe, your email address, our payment provider's subscription and plan identifiers, the subscription status and the period end. We never receive or store your card details — those go directly to the payment provider.
• Newsletter. If you subscribe, your email address and the date you subscribed.
• Calculator requests and votes. The title, description and category you submit. These records carry no identifier for you at all. Please do not put personal or confidential information in a request, because it may be shown publicly.
• Accuracy reports. If you report a result as wrong, we store the calculator, its inputs and outputs, any note you add, your account identifier if you are signed in, and the network address the report came from.
• Assistant queries. If you use the AI assistant, your question is sent to Amazon Bedrock to be answered. We do not retain the text of the question.

Information collected automatically

• Network address (IP). Recorded with an accuracy report, and used as the key for rate-limiting the assistant and file uploads when you are not signed in. It is not recorded with ordinary page views.
• Product analytics events. Which calculators and features are used. These records contain no network address and no account identifier — they cannot be traced back to you by us.
• Google Analytics. Standard web analytics, including approximate location derived from network address, device and browser, and pages visited.
• Session recording. LogRocket records a replayable session of your interaction with the site — pages, clicks, navigation and network activity. Depending on the page, a recording may capture what you type into a form. Passwords are masked by the recorder. We use recordings to diagnose faults and to understand where the interface fails people.
• Advertising. Google AdSense sets identifiers used to select and measure ads. See the Cookie Policy.
• Server logs. Requests to our servers are logged with network address and timestamp as part of ordinary operation and abuse prevention.

Where the UK GDPR or EU GDPR applies to you, we rely on these bases:

Where we rely on legitimate interests, we have considered whether our interest is overridden by your rights, and you may object under section 9.

Google and LogRocket apply their own retention to the data they hold. Their policies are linked in section 6.

We do not sell personal data and do not share it for anyone else's independent marketing. We use these providers:

• Amazon Web Services — hosting, database, file storage, user accounts (Cognito), outbound email (SES), the AI assistant (Bedrock), and translation of site content. Processed on our instructions.
• Lemon Squeezy — payment processing, as merchant of record for the paid tiers. They receive your email address and payment details, and are an independent controller for the transaction.
• Google Analytics — web analytics.
• Google AdSense, with Google Funding Choices — advertising and, for visitors in the EEA and UK, the consent message that governs advertising cookies.
• LogRocket — session recording.

The Service also fetches public data from NOAA Space Weather Prediction Center, N2YO and public spectrum-allocation sources. These requests are made by our servers, not by your browser, so those parties do not receive anything about you.

We may also disclose personal data where we are legally required to, or where it is necessary to establish or defend a legal claim or to protect the Service against abuse.

Our infrastructure runs in Amazon Web Services in the United States (region us-east-1). The operator is established in Georgia. Our other providers may process data in the United States and elsewhere.

If you are in the European Economic Area or the United Kingdom, this means your personal data is transferred outside it. Those transfers rely on the European Commission's Standard Contractual Clauses, or the UK International Data Transfer Addendum, as incorporated into our agreements with those providers, together with any adequacy decision that applies to them.

You can ask us for more detail about a particular transfer at the contact address.

The Service sets cookies and stores data in your browser, both for functions you ask for and for analytics, advertising and session recording.

Each item is listed by name, with its purpose and who sets it, in the Cookie Policy. That page also explains what consent is and is not collected, and how to control each category.

Depending on where you live, you may have the right to:

• obtain a copy of the personal data we hold about you;
• have it corrected if it is wrong or incomplete;
• have it deleted;
• receive it in a portable format, or have it sent to another provider;
• object to processing we base on legitimate interests, including analytics and session recording;
• restrict processing while a dispute about it is resolved;
• withdraw consent at any time, where we relied on consent — this does not affect processing already carried out.

To exercise any of these, email contact@rftools.io from the address associated with your account where possible, so that we can identify you. We will respond within 30 days. There is no charge unless a request is manifestly unfounded or excessive.

If you are unhappy with how we have handled your data you may complain to your local data protection supervisory authority. In the EU that is the authority in your country of residence; in the UK it is the Information Commissioner's Office.

Ask at the contact address and we will delete your account.

Removed: your account record and email address in Cognito; your saved calculations; your simulation jobs, uploaded files and results; your API key records; your newsletter subscription if you have one. Retained, and why: billing and subscription records, for as long as accounting and tax law requires; accuracy reports and rate-limit records until their own expiry (90 days and 48 hours), because deleting them on request would remove the abuse-handling record they exist to provide; product analytics events, which carry no identifier for you and cannot be located as yours; and anything we are legally required to keep.

Calculator requests and votes carry no identifier for you, so we cannot find them to delete. Tell us the request and we will remove it if you ask.

The Service is intended for engineers and technical users and is not directed at children. You must be at least 16 years old to create an account.

We do not knowingly collect personal data from anyone under 16. If you believe a child has given us personal data, write to the contact address and we will delete it.

Traffic to and from the Service is encrypted in transit with TLS. Data at rest is stored in managed AWS services with encryption enabled. Passwords are held by Amazon Cognito and are never visible to us. API keys are stored only as SHA-256 hashes, so a copy of our database does not yield a working key. Administrative access is limited to the operator.

No service can promise absolute security, and we do not. You help by using a strong, unique password and by keeping your API keys private.

If personal data we hold is exposed, we will investigate, take steps to contain it, and record what happened.

Where the law requires it, we will notify the relevant supervisory authority — under the GDPR, within 72 hours of becoming aware where feasible — and we will tell affected users directly where the exposure is likely to present a high risk to them.

We may update this policy. The effective date at the head of this document shows when the current version took effect, and previous versions remain retrievable from the project's version history.

Where a change materially affects how we use your personal data, we will give notice on the Service before it takes effect.

This policy is written in English. Translations are provided for convenience only; in the event of any discrepancy, the English text governs.

Email contact@rftools.io, or write to the postal address at the head of this document.

We have not appointed a data protection officer, and are not required to. Correspondence goes directly to the operator.