DEVELOPER TOOLKIT / V1.2

PRIVACY & COOKIE NOTICE · UPDATED OCTOBER 24, 2026

Your data in this workspace.

This notice explains what stays in your browser, what is sent when you run a browser experiment, what the hosting provider receives, and how advertising by Google AdSense uses cookies and requests consent in the European Economic Area (EEA), the United Kingdom and Switzerland.

1. Scope

ClientHintsGenerator.com is operated by GASO Studio, the trading name of a private individual based in Italy, who is the data controller for this website. Privacy requests can be sent to privacy@clienthintsgenerator.com. The controller’s full identity is provided on request to people exercising their data protection rights and to supervisory authorities. This email address is for privacy and data protection requests; the site does not offer user support.

This notice applies to this website, its echo and opt-in endpoints and the advertising shown on it. It does not apply to external sites you test, to sites you reach through external links, or to third-party services’ own websites. This website has no user accounts, no contact form and no newsletter.

2. Generating and inspecting data locally

The generator, “Read my browser”, compatibility lookup, pasted-response inspector and script builder process their inputs in your browser. The application does not upload those inputs, target URLs or pasted headers to a testing service. “Read my browser” and “Read this browser’s high-entropy values” use your browser’s JavaScript API only when you select them, and the results stay in the page. The compatibility snapshot is a local site file; looking up a header does not contact MDN.

3. Browser negotiation experiments

When you run the negotiation lab, your browser navigates to /api/optin on this site, which responds with an Accept-CH header and returns you to the lab. The reloaded page then sends one request to /api/echo. Depending on browser support, earlier opt-in state and the fields you select, these requests can include browser and platform details, architecture, bitness, device model or full browser versions.

The return address contains the names of the hint headers that request 1 carried, not their values. The echo endpoint returns allowlisted UA-CH headers with a timestamp, a random request identifier and the requested hint names. The endpoints do not reflect cookies, authorization credentials or IP address headers, and their code does not store or log requests. Responses are marked Cache-Control: no-store. This does not mean that the hosting provider receives no connection data (see section 5).

A pending experiment and up to 20 completed reports are kept in this tab’s sessionStorage so that they survive the lab’s own page reload. They are removed when you select “Clear results” or close the tab, and are never sent to a server. Browser and version labels you type are added to the report only. The browser’s origin opt-in remains until another navigation response changes it; the lab’s “Clear origin opt-in” button sends an empty Accept-CH header for that purpose.

4. Running generated commands

This website does not execute the generated cURL or A/B commands for you. If you run them, your computer contacts the target you chose and sends the configured headers. The A/B script saves responses in a temporary directory on your device. The target’s privacy practices and the handling of files on your device are outside this site’s control.

5. Hosting and connection information

The site is hosted on Cloudflare Pages, with Pages Functions for the two endpoints. Serving a page, a file or an endpoint response necessarily makes connection information available to the hosting infrastructure, such as IP address, request time, URL and browser information. Cloudflare may process that information for service delivery, reliability and security under its applicable terms and settings. See Cloudflare’s privacy policy (opens in a new tab).

6. Advertising and cookies (Google AdSense)

The workspace page uses Google AdSense, an advertising service provided by Google, to display ads. The privacy notice, the 404 page and the API endpoints do not load advertising code.

Learn more in How Google uses information from sites or apps that use its services (opens in a new tab) and How Google uses cookies in advertising (opens in a new tab). You can manage personalised advertising from Google in My Ad Center (opens in a new tab). Visitors in the United States can also opt out of some third-party vendors’ use of cookies for personalised advertising at aboutads.info (opens in a new tab).

This site also publishes an ads.txt file and a Google site-verification meta tag. Neither of them loads code, sets cookies or sends data from your browser.

For visitors in the EEA, the United Kingdom and Switzerland, ads are served with a consent management platform certified by Google and integrated with the IAB Transparency and Consent Framework (TCF), which Google requires for personalised ads in these regions. On your first visit, the consent message lets you accept, reject or manage the purposes and vendors before advertising cookies are used where consent is required. This applies the EU General Data Protection Regulation (GDPR) and ePrivacy rules (in Italy, Article 122 of the Italian Privacy Code), the UK GDPR and Privacy and Electronic Communications Regulations (PECR), and the Swiss Federal Act on Data Protection (FADP).

Rejecting is as easy as accepting, and you can change or withdraw your choice at any time from the privacy and cookie settings link or button shown by the consent tool on the workspace page. Withdrawing consent does not affect processing carried out before you withdrew it. If you do not consent, Google may show non-personalised or limited ads as described in Google’s documentation. Using the tools on this site never depends on accepting advertising cookies.

8. Cookies and browser storage

You can also delete or block cookies in your browser settings. Blocking all cookies can affect how ads and the consent tool work.

10. International transfers and retention

Google and Cloudflare can process data outside your country, including in the United States. They describe the safeguards they rely on, such as adequacy decisions (for example the EU–US Data Privacy Framework and its UK and Swiss extensions) or standard contractual clauses, in their own privacy information, for example Google’s data transfer frameworks (opens in a new tab). This page does not claim that all processing takes place in the European Union.

This site’s own code does not keep personal data on a server. Emails sent to the privacy address are kept only as long as needed to handle the request and any follow-up. Retention of hosting records and advertising data is determined by Cloudflare and Google under their policies and the account settings; consent choices are stored by the consent tool in your browser for the period it states.

11. Your rights and complaints

To exercise your rights, write to privacy@clienthintsgenerator.com. We may ask for proportionate information to verify a request; do not send identity documents unless we ask for them. We aim to reply within one month, as required by the GDPR. Depending on the law that applies to you, you may have rights to access, correct, delete, restrict or object to processing, to data portability, and to withdraw consent at any time (section 7). For data processed by Google for advertising, you can also use Google’s own tools, such as My Ad Center (opens in a new tab) and Google’s data and privacy settings (opens in a new tab).

You have the right to lodge a complaint with a data protection authority, in particular in the country where you live or work or where an alleged infringement took place:

Visitors outside Europe

This website is available worldwide. Visitors from other countries have the rights given by their local law and can use the same privacy address.

This website is not directed at children under 16 and does not knowingly collect their personal information.

12. Changes

We update this page when the site’s data handling changes. The date at the top identifies this version. Questions about this notice can be sent to the same privacy address given in section 1.