Widget Data & Privacy
Exactly what a yootils calculator does — and doesn’t do — when you put one on your website. Written to be checked, not just believed.
The short answer
The widget collects nothing. No cookies. Nothing written to your site’s storage. No data sent anywhere — not to us, not to anyone else. No third-party code of any kind.
Whatever your visitors type into the calculator stays in their own browser and is gone when they close the page.
That is the default, and it is what happens unless you deliberately turn on your own analytics. There is no account, no tracking pixel, no advertising network, and no data-sharing arrangement behind these widgets.
The rest of this page sets out the specifics, including the one piece of contact with our servers that does happen — because a page like this is worthless if it quietly omits the inconvenient part.
What happens when someone uses the calculator
All of it happens on the visitor’s own device.
Someone types a salary, a mortgage balance, a date of birth or a set of body measurements. The calculation runs in their browser, the answer appears, and that is the end of it. Those values are never transmitted, never written to disk, and never seen by us or by you.
This matters most for the calculators that handle sensitive figures. A visitor working out their take-home pay, their due date or their body fat percentage is entering something personal. On these widgets that information does not exist anywhere except in the memory of their own browser tab, for as long as the tab is open.
What the widget never touches
- Cookies — none are set, read or required
- The values typed into the calculator — never transmitted or stored
- Location, GPS or IP-based geolocation
- Device fingerprinting — no user-agent, screen, language or timezone reads
- Browsing history, referring page or anything else on your site
- Form fields, logins or content elsewhere on your page
- Third-party scripts, ad networks, tag managers or trackers of any kind
Anything can be checked. The widget file is plain, unminified JavaScript served from our domain. Open it, search it, hand it to whoever reviews these things. Everything on this page is visible in the source.
The one piece of contact with our servers
To display the calculator, the visitor’s browser has to download the widget file from us. That request reaches our web server logs in exactly the same way as any hosted script, font or image, and it records the usual things a web server records: the requesting IP address, the user agent, and the page that referred it.
This is unavoidable for any hosted embed — it is how the file gets to the browser. We mention it because “no data leaves the page” would be an overstatement, and a claim that does not survive scrutiny is worse than no claim at all.
| Moment | What reaches yootils |
|---|---|
| Page loads, widget file is fetched | A standard web request: IP address, user agent, referring page — in server logs |
| Visitor types into the calculator | Nothing. No request is made |
| Visitor presses Calculate | Nothing. The maths runs locally |
| Visitor clicks the link to the full calculator | An ordinary click-through to our site, like any other link |
If you would rather your visitors never contact our servers at all, the honest answer is that an embedded widget is the wrong tool — link to the calculator on our site instead, and the request only happens for people who choose to follow the link.
If you turn on your own analytics
The widget can report how it is being used — but this is off unless you switch it on, and the data goes to your endpoint, not ours. We never receive it.
What an event contains
| Field | Example | What it is |
|---|---|---|
type | interaction | Shown, used, or link clicked |
tool | bmi-calculator | Which calculator |
action | Calculate | The visible label of the button pressed |
ts | 1755950400000 | Timestamp |
No value a visitor typed is ever included. An event records that a button labelled “Calculate” was pressed on the BMI calculator. It does not record the height, the weight, or the result.
If a send fails, events are held in a capped queue of at most 50 and retried — never an unbounded log. With no endpoint configured, nothing is queued and nothing is written at all.
Security
- No third-party code. The widget loads from
yootilsand nowhere else. No CDNs, no ad networks, no analytics vendors. - No dynamic code execution. No
eval, nonew Function, nodocument.write. This is enforced automatically before any change to the site can be committed. - Content Security Policy is set on our servers and restricts the widget host to our own origin.
- Isolation mode available. Add
data-iframe="true"and the calculator runs inside a sandboxed frame with no access to your page at all. Useful if your own policy requires it. - The widget reads nothing from your page. It renders inside the element you place, and never inspects anything outside it.
Pin what you run. The widget is published as a frozen, versioned release — the embed code in our directory always names the current one — and every snippet carries that release’s Subresource Integrity hash. Your browser checks the file against that hash and refuses to run it if a single byte differs — so you are trusting the copy you reviewed, not our hosting. A published version is never edited; changes go to the next one.
What this means for your own privacy policy
Because the widget sets no cookies and stores nothing on your domain, it does not by itself create a consent requirement under UK PECR or the equivalent EU rules — those attach to storing or accessing information on a visitor’s device, which the widget does not do.
The one thing worth mentioning in your own policy, if you list third parties, is that embedding the widget causes visitors’ browsers to request a file from yootils, and that this appears in our server logs as described above.
We are describing our own software here, not advising you on your obligations. If you are in a regulated sector or unsure, check with whoever handles that for you — and point them at this page, which is written to be useful for exactly that conversation.
Common questions
Do the widgets use cookies?
No. None are set, read or required — not for analytics, not for advertising, not for preferences.
Where do the typed numbers go?
Nowhere. The calculation runs in the visitor’s browser and the values are discarded when the page closes.
Is anything stored on my domain?
No — no cookies, no localStorage, no IndexedDB. Storage is used only if you configure your own analytics endpoint.
Does yootils get any data?
Only the initial request that downloads the widget file, which appears in our server logs like any hosted asset. Using the calculator sends nothing.
Do I need a cookie banner for it?
Not because of the widget — it stores and reads nothing on the visitor’s device. Your other tools may of course require one.
Can I verify all this?
Yes. The widget file is plain, unminified JavaScript on our domain. Open it and read it, or ask us anything at contact.