Privacy Policy

You can use almost all of rftools.io without an account and without telling us who you are. The calculators run in your browser; their inputs are not sent to us.

What we do hold: an email address if you register or subscribe to the newsletter; the work you choose to save; files you upload for simulation; billing details held by our payment provider; and a network address recorded for abuse handling and rate limiting.

We use Google Analytics, Google AdSense and LogRocket session recording. These are described in section 6 and in the Cookie Policy.

We do not sell personal data.

The controller of the personal data described here is the operator identified with a postal address and a contact address at the head of this document.

For any question about this policy, or to exercise a right under section 9, email contact@rftools.io.

Information you give us

• Account details. When you register, an email address and a password. The password is held by Amazon Cognito and we never see it. Cognito assigns your account an internal identifier, which is what most of our records are keyed to.
• Saved calculations. If you save a calculation, we store the calculator, a label you choose, the input values, the time, and the email address of the account it belongs to.
• Projects. If you create a project, we store its name and notes and, for each item you add: the calculator with its input and output values, or the simulation tool with the settings it ran with; a reference to the simulation job when the job is yours; the result's provenance (the formula or model, its assumptions and valid range, the software version and when it was computed); and when you added it. Project records do not contain your email address.
• Project share links. If you share a project, we store a one-way fingerprint of its link, never the link itself. Anyone who has the link can see the project's name, notes and items, including the results of your own simulations that we still keep. They cannot see your name, email address, account, uploaded files or job identifiers.
• Uploaded files. Touchstone and CSV files you upload for a simulation, stored in Amazon S3.
• Simulation jobs. The job type, the parameters you submitted, references to any uploaded files, the tier the job ran on, timestamps, and the result, and what running it cost: how long it ran, the processor time and memory it used, the computing time our cloud provider billed for it, and its cost in US dollars.
• Simulation credits. If simulation credits apply to your account, its credit balance — credits included with your plan, credits you bought, and credits held for jobs still running — and a record of every change to it: each grant, purchase, refund, hold and settlement, with the job or order it refers to, the amount and the balance afterwards. For each credit order we keep the order number, the pack, the number of credits and whether it was a test order, so that a refund removes exactly what the order added. While credits are not charged, each paid job records the credits it would have used, and no balance changes.
• API keys. We generate a key and store only a SHA-256 hash of it, together with a short preview, the label you give it and, when a program created it for you, that program's name (for example kicad-plugin). The key itself is shown once and is never stored, so it cannot be recovered — only replaced.
• API usage records. For your account and each of its keys, how many API calls were made in each hour and each calendar month, how many went over the monthly allowance, and when each key was last used. Each API call also writes a log line with the key's public identifier and, when the call is counted, your account identifier. These records contain no network address and no request content. If you connect a program with a sign-in code, we keep the code, the program's name and, once you approve it, your account identifier for at most 10 minutes. To stop codes being guessed, we also count wrong codes entered while you are signed in, for 10 minutes.
• Billing details. If you subscribe, your email address, our payment provider's subscription and plan identifiers, the subscription status and the period end. We never receive or store your card details — those go directly to the payment provider.
• Newsletter. If you subscribe, your email address and the date you subscribed.
• Calculator requests and votes. The title, description and category you submit. These records carry no identifier for you at all. Please do not put personal or confidential information in a request, because it may be shown publicly.
• Accuracy reports. If you report a result as wrong, we store the calculator, its inputs and outputs, any note you add, your account identifier if you are signed in, and the network address the report came from.
• Assistant queries. If you use the AI assistant, your question is sent to Amazon Bedrock to be answered. We do not retain the text of the question.

Information collected automatically

• Network address (IP). Recorded with an accuracy report, and used as the key for rate-limiting the assistant and file uploads when you are not signed in. It is also recorded with every request to the site, in the request logs described below.
• Product analytics events. Which calculators and features are used. These records contain no network address and no account identifier — they cannot be traced back to you by us.
• Embedded calculators. A website can show one of our calculators inside its own pages. When it does, the calculator records the same kind of product-usage events as on our site: which calculator was opened and used, the address of the website showing it (its origin, such as https://www.example.com), and the embed key we issued to that website, if any. These records contain no network address and no account identifier. No advertising and no session recording run inside an embedded calculator.
• Google Analytics. Standard web analytics, including approximate location derived from network address, device and browser, and pages visited. When you subscribe, renew, cancel or buy simulation credits, the rftools.io servers also send that event to Google Analytics — the plan, the amount and currency, and an order number — together with your browser's analytics identifier, so that it can be matched to the visit that led to it. These reports do not include your email address, name or account identifier. When you start a checkout, your browser's analytics identifier and the current analytics session number are passed to our payment provider with it, so that the purchase can be reported against your visit.
• Session recording. LogRocket records a replayable session of your interaction with the site — pages, clicks, navigation and network activity. Depending on the page, a recording may capture what you type into a form. Passwords are masked by the recorder. We use recordings to diagnose faults and to understand where the interface fails people.
• Advertising. Google AdSense sets identifiers used to select and measure ads. See the Cookie Policy.
• Request logs. Every request to the site passes through our content delivery network, Amazon CloudFront, which records the network address, the time, the page path without its query string, the referring page, the browser's user agent, and the network (autonomous system) and country the address belongs to. Cookies are not recorded. We use these logs for security, for abuse prevention, and to measure how much of our traffic is automated rather than human. Requests to our API servers are also logged with network address and time as part of ordinary operation.

Where the UK GDPR or EU GDPR applies to you, we rely on these bases:

Where we rely on legitimate interests, we have considered whether our interest is overridden by your rights, and you may object under section 9.

A project keeps a reference to a simulation, not a copy of its result: when a free-tier result is deleted after 30 days, the project keeps the settings and provenance but not the result.

Google and LogRocket apply their own retention to the data they hold. Their policies are linked in section 6.

We do not sell personal data and do not share it for anyone else's independent marketing. We use these providers:

• Amazon Web Services — hosting, database, file storage, user accounts (Cognito), outbound email (SES), the AI assistant (Bedrock), and translation of site content. Processed on our instructions.
• Lemon Squeezy — payment processing, as merchant of record for the paid tiers and for simulation credit packs. They receive your email address and payment details, and, with a checkout you start, your browser's Google Analytics identifier and session number. They are an independent controller for the transaction. If you enable pay-as-you-go API usage, they also receive the number of API calls over your allowance in each billing period.
• Google Analytics — web analytics, including the purchase, renewal and cancellation events that the rftools.io servers send for a subscription. These carry your browser's analytics identifier, the plan, the amount and the currency, but never your email address or account identifier. It also runs inside our calculators where another website embeds them.
• Google AdSense, with Google Funding Choices — advertising and, for visitors in the EEA and UK, the consent message that governs advertising cookies.
• LogRocket — session recording.

The Service also fetches public data from NOAA Space Weather Prediction Center, N2YO and public spectrum-allocation sources. These requests are made by our servers, not by your browser, so those parties do not receive anything about you.

We may also disclose personal data where we are legally required to, or where it is necessary to establish or defend a legal claim or to protect the Service against abuse.

Our infrastructure runs in Amazon Web Services in the United States (region us-east-1). The operator is established in Georgia. Our other providers may process data in the United States and elsewhere.

If you are in the European Economic Area or the United Kingdom, this means your personal data is transferred outside it. Those transfers rely on the European Commission's Standard Contractual Clauses, or the UK International Data Transfer Addendum, as incorporated into our agreements with those providers, together with any adequacy decision that applies to them.

You can ask us for more detail about a particular transfer at the contact address.

The Service sets cookies and stores data in your browser, both for functions you ask for and for analytics, advertising and session recording.

Each item is listed by name, with its purpose and who sets it, in the Cookie Policy. That page also explains what consent is and is not collected, and how to control each category.

Depending on where you live, you may have the right to:

• obtain a copy of the personal data we hold about you;
• have it corrected if it is wrong or incomplete;
• have it deleted;
• receive it in a portable format, or have it sent to another provider;
• object to processing we base on legitimate interests, including analytics and session recording;
• restrict processing while a dispute about it is resolved;
• withdraw consent at any time, where we relied on consent — this does not affect processing already carried out.

To exercise any of these, email contact@rftools.io from the address associated with your account where possible, so that we can identify you. We will respond within 30 days. There is no charge unless a request is manifestly unfounded or excessive.

If you are unhappy with how we have handled your data you may complain to your local data protection supervisory authority. In the EU that is the authority in your country of residence; in the UK it is the Information Commissioner's Office.

Ask at the contact address and we will delete your account.

Removed: your account record and email address in Cognito; your saved calculations; your projects, their items and their share links; your simulation jobs, uploaded files and results; your API key records; your simulation credit balance and the holds and settlements recorded against your jobs; your newsletter subscription if you have one. Retained, and why: billing and subscription records, including credit purchases and refunds, for as long as accounting and tax law requires; accuracy reports and rate-limit records until their own expiry (90 days and 48 hours), because deleting them on request would remove the abuse-handling record they exist to provide; product analytics events, which carry no identifier for you and cannot be located as yours; and anything we are legally required to keep.

Calculator requests and votes carry no identifier for you, so we cannot find them to delete. Tell us the request and we will remove it if you ask.

Unconfirmed registrations. If you start an email registration and never enter its confirmation code, then later sign in with Google using the same address, we delete the unconfirmed registration and create your account from the Google sign-in. An unconfirmed registration has never been signed in to, so nothing saved in it is lost.

The Service is intended for engineers and technical users and is not directed at children. You must be at least 16 years old to create an account.

We do not knowingly collect personal data from anyone under 16. If you believe a child has given us personal data, write to the contact address and we will delete it.

Traffic to and from the Service is encrypted in transit with TLS. Data at rest is stored in managed AWS services with encryption enabled. Passwords are held by Amazon Cognito and are never visible to us. API keys are stored only as SHA-256 hashes, so a copy of our database does not yield a working key. Administrative access is limited to the operator.

No service can promise absolute security, and we do not. You help by using a strong, unique password and by keeping your API keys private.

If personal data we hold is exposed, we will investigate, take steps to contain it, and record what happened.

Where the law requires it, we will notify the relevant supervisory authority — under the GDPR, within 72 hours of becoming aware where feasible — and we will tell affected users directly where the exposure is likely to present a high risk to them.

We may update this policy. The effective date at the head of this document shows when the current version took effect, and previous versions remain retrievable from the project's version history.

Where a change materially affects how we use your personal data, we will give notice on the Service before it takes effect.

This policy is written in English. Translations are provided for convenience only; in the event of any discrepancy, the English text governs.

Email contact@rftools.io, or write to the postal address at the head of this document.

We have not appointed a data protection officer, and are not required to. Correspondence goes directly to the operator.