The short version
We do not run analytics, we do not set cookies, we do not use advertising or tracking scripts, and there is nothing to sign up for. Your saved palettes live in your browser and are never uploaded. The only thing that travels to a server is a number: how many people have liked a given palette, with nothing recorded about who liked it.
What stays in your browser
Two values are written to localStorage, which is storage that belongs to your browser and is not transmitted anywhere:
palette.theme— whether you chose the light or dark theme, so the site does not flash the wrong one on your next visit.palette.likes.v2— the list of palettes you have liked, which is what fills your collection page.
Because this list is held locally and not against an account, it is tied to one browser on one device. Clearing your site data, using private browsing, or switching to another browser or computer will show you an empty collection. That is a real limitation rather than a bug, and it is the direct consequence of not asking you to register.
The tools behave the same way. When you extract a palette from an image, the image is read and processed by JavaScript on your own machine — it is never uploaded, and no copy of it exists on any server. The same is true of the eyedropper and page-scanning features in the browser extension.
What leaves your browser
One thing: the like counter. When you like a palette, the site asks a Firebase Realtime Database to add one to a number stored under that palette's identifier. The record is a palette and a count, and nothing else — no identifier for you, no session, no timestamp, no address. There is deliberately no per-user record, which is why the site cannot tell your likes apart from anyone else's, and why your collection has to be kept locally instead.
Reading is the same request in reverse: to show a like count the browser asks for that number. Those requests reach Google's Firebase infrastructure, so Google can see the connection in the ordinary way any server sees a request, which is covered below.
What our hosts can see, which we do not control
This is the part most policies leave out. Serving a page requires a connection, and the companies that serve it keep their own records:
- GitHub Pages hosts the site's files. GitHub receives your IP address and request details as part of delivering the page and handles them under its own privacy statement. We have no access to those logs and no ability to switch them off.
- Google Firebase receives the like requests described above, and likewise sees the connection they arrive on. We can see the counters; we cannot see who produced them.
We have not added anything on top of this. No third-party script runs on the site, so nothing beyond these two services is contacted while you use it.
The browser extension
The extension asks for the narrowest permissions that let it work: permission to act on the tab you are currently looking at, and only at the moment you invoke it. It deliberately does not request broad access to every site you visit. It generates palettes locally, keeps its saved palettes in the browser's own storage, and sends nothing anywhere.
Children
The site is a color reference and is suitable for general audiences. We do not knowingly collect personal information from anyone, of any age, because we do not collect personal information at all.
Changes
If this policy changes, the date at the top changes with it. Because the site is open source, the full history of this page is public in the repository, so you can see exactly what was altered and when rather than taking our word for it.
Contact
Questions about this policy, or about anything the site does, can go through the project's GitHub repository, where issues are public and answered in the open. The about page explains who runs the site and how it is built.