UnicodeNow Privacy Policy
This page explains how UnicodeNow handles text entered into tools, search queries, technical logs, analytics, browser storage and other information associated with use of the site.
On this page
Browser-local tools
A tool is browser-local when its page is marked with the badge "Processed locally in your browser." That badge reflects the same setting the application uses to decide whether a tool's page loads client-only JavaScript or also submits requests to the server; it is not a separately maintained label. 32 of this site's tools currently carry that badge, including the Unicode Character Counter, Unicode Sequence Analyzer, Unicode Text Compare and Invisible Character Detector. See Methodology for how this site's processing model and Unicode data sources work in more technical detail.
For these tools: the primary analysis or transformation runs in your browser's JavaScript; input is not intentionally sent to the UnicodeNow application server as part of running the tool; input is not written to PostgreSQL; input is not cached in Redis; input must not be included in any analytics event if optional analytics is enabled later; input does not appear in error reports, because no error-monitoring platform is integrated; report generation and copy-to-clipboard actions run in your browser; and downloaded files are assembled in your browser and saved directly to your device.
Loading any page, including a local tool's page, still creates an ordinary HTTP request for the page itself (see Information collected automatically) — that basic request is not invisible to the server, even though your typed input is not part of it.
Limitations of local processing
Local processing is not a guarantee of complete confidentiality on every device. Browser extensions can potentially access page content; clipboard managers and some operating systems retain clipboard history independently of any website; browser developer tools can inspect page content; and malicious software already present on a device is outside UnicodeNow's control. If a future page-level analytics or monitoring tool were ever added, it would still be expected to record non-content events (such as a page view) rather than the text typed into a tool, but this site does not currently run any such tool at all.
Server-assisted tools and searches
Five tools submit entered text to this site's own POST /api/v1/tools/<slug>/process endpoint: Character Encoding Detector, UTF-8 Validator, Mojibake Repair, Confusable Character Detector and Punycode Converter. The submitted text is used only to compute the response for that request; these responses are returned with Cache-Control: no-store, and the request text is not written to PostgreSQL or Redis by that endpoint.
Unicode Character Lookup works differently: it uses a GET query parameter (?q=), and the page is rendered server-side from that query. Lookup and search pages, including Character Lookup and the site's tool-search and guide-search pages, may send the submitted query to UnicodeNow servers. Because a GET parameter is used, the query can appear in the page URL, your browser history, bookmarks, and, for links you click from the results, referrer information sent according to this site's Referrer-Policy (strict-origin-when-cross-origin, which limits what is shared with other sites). These pages do not write your query to PostgreSQL or Redis either.
Separately, this project also exposes two JSON API endpoints (/api/v1/unicode/search and /api/v1/unicode/character/<codepoint>) that are not called by any UnicodeNow page during ordinary browsing. Unlike the tools above, these two endpoints do cache the submitted query and the resulting data in Redis (15 minutes for search, 1 hour for a single character lookup) so that repeated identical requests can be served faster. Because no page on the site calls these endpoints itself, normal use of UnicodeNow's own pages does not trigger this cache, but a request made directly to that API address would.
Do not enter passwords, authentication tokens, private keys, medical information or other sensitive personal data into server-assisted search or tool fields, or into any field on this site. Standard web infrastructure (browsers, proxies, and, where a GET parameter is used, URLs, browser history and referrer headers) can retain such values beyond this site's control.
Information collected automatically
Like most web servers, the infrastructure that serves UnicodeNow (the application server and its nginx reverse proxy) processes standard connection information for every request in order to deliver the response: the requesting IP address, HTTP method and requested path (including any query string for GET-based pages), user-agent string, referrer header where sent, response status code and approximate response size. This is standard request handling needed to deliver the page, keep the service reliable, and detect abuse; no analytics provider is currently enabled to collect additional fields such as approximate geographic region, screen dimensions or performance timings beyond what a browser sends in an ordinary request.
The application also applies a per-IP rate limit on API requests (currently 120 requests per minute) to reduce automated abuse; requests exceeding that limit receive an HTTP 429 response.
Logs and diagnostics
The application uses Python's standard logging module at informational severity. Application code does not contain statements that log full request bodies or the text submitted to a tool. There is no dedicated application-level access-log middleware; ordinary web-server/reverse-proxy access logging (from nginx and/or the ASGI server) may still record the request path, which for GET-based search pages includes the query string, following each component's own default behavior. No error-monitoring or crash-reporting platform (such as Sentry) is integrated in this project, so exception details are not forwarded to a third party.
A configuration flag named enable_search_logging exists in the application's settings and defaults to off; it is not currently connected to any logging statement in the codebase, so enabling it would have no effect without further development.
A formal retention or rotation period for access, application or error logs has not yet been documented for this deployment.
Analytics
UnicodeNow does not currently enable Google Analytics, Plausible, Matomo, Cloudflare Web Analytics, PostHog, Microsoft Clarity, a self-hosted analytics platform, advertising-measurement pixels, or any custom event-tracking script. The site includes an optional analytics consent control for future use, but no analytics script is loaded unless analytics is configured by the site operator and the visitor accepts analytics. No analytics cookie is set by UnicodeNow's own consent code, no IP-based geolocation service runs on tool pages, and no query-string or tool-input data is sent to a third-party analytics endpoint while analytics remains disabled. If analytics is enabled in the future, it must be scoped to exclude tool input and output from event payloads.
Clipboard and downloads
Copy actions use the browser's Clipboard API (or an equivalent fallback) to place text on your system clipboard. Once copied, that content may be retained by your operating system's clipboard history, a clipboard-manager application, or a browser extension, independently of UnicodeNow; copied content does not simply disappear immediately, and this site does not control what happens to it after the copy action completes. Clipboard permission behavior also depends on your browser.
Report and export downloads are generated directly in your browser from the result already shown on the page (using a Blob and a generated download link) and saved to your device; there is no server-side export step and no upload of the downloaded content back to UnicodeNow. Generated filenames use a fixed, tool-specific name rather than your entered text, so sensitive input is not inserted into a filename. Files remain on your device until you delete them; UnicodeNow has no visibility into or control over that copy.
Contact forms and communications
The contact page is a submission form. It asks for your email address, an optional name, a category, a subject and a message, and — for bug, data-correction, accessibility or security reports — optional affected-page, expected-result and actual-result fields. Submitting the form sends this information through the Telegram Bot API to a private UnicodeNow Telegram channel; "security" reports may be routed to a separate private channel where configured. The message content is not written to this application's PostgreSQL database or Redis cache by the contact route.
Telegram processes and stores delivered messages under its own terms once they reach the channel, and messages remain visible in that channel's history until a UnicodeNow team member manually deletes them or Telegram's own retention settings apply; UnicodeNow does not control or document Telegram's internal infrastructure. Do not submit passwords, authentication tokens, private keys or other highly sensitive information through this form. A short-lived, one-way hash of your submission (not the message text itself) may be kept briefly in Redis to detect accidental duplicate submissions, and your IP address and email address are hashed (not stored in plain form) to apply rate limits; both expire automatically within a few minutes to a few hours.
Third-party services
This project is deployed as a self-hosted Docker Compose stack consisting of an nginx reverse proxy, the application server, a PostgreSQL database and a Redis cache; the repository does not designate a specific named hosting provider or fixed physical location, since that depends on where an operator chooses to run the stack. No analytics provider is currently enabled, and the consent control is implemented by this site rather than a third-party consent-management platform. No advertising network, CAPTCHA service, or third-party search service is integrated. Font files are served from this site's own static assets rather than a third-party font host. See Data Sources for the Unicode Character Database files (from unicode.org) that back tool behavior; those are data files, not a data-processing service that receives your input.
Data retention
- Server-assisted tool responses (5 POST-based tools): returned with
Cache-Control: no-storeand not written to PostgreSQL or Redis by the request handler. - Unicode Character Lookup queries: not written to PostgreSQL or Redis by the page route.
- The separate, page-unused
/api/v1/unicode/searchand/api/v1/unicode/character/<codepoint>API cache: up to 15 minutes and 1 hour respectively, in Redis, then expires automatically. - Access, application and error logs: a formal retention period has not yet been documented for this deployment.
- Contact messages: not stored in this application's own database; delivered to Telegram and retained according to that channel's history and settings until manually deleted.
- Cookies: the session cookie (unused by application code) follows the browser's own cookie lifetime; the contact success cookie lasts up to 2 minutes; no advertising cookie exists to retain.
- Local browser storage: the "theme" preference and analytics consent choice persist until you or your browser clears them; they are not sent to the server by this site's application code.
Where retention is enforced today, it is enforced by automatic expiry (Redis key TTLs) or by explicitly not storing data (no-store responses, no database writes) rather than by a scheduled deletion job.
Security
The application serves every response with security headers including X-Content-Type-Options: nosniff, X-Frame-Options: DENY, Referrer-Policy: strict-origin-when-cross-origin, a Permissions-Policy that disables camera, microphone and geolocation access, and a Content-Security-Policy restricting scripts and framing to this site's own origin. Session cookies are marked HTTPS-only in production. API requests are rate-limited per IP address to reduce automated abuse. Submitted text is treated as text, not executed as HTML or script, in tool output and diagnostic tables. Database and cache access is scoped to the application's own service credentials rather than exposed publicly.
UnicodeNow uses reasonable technical and organizational safeguards, but no website or transmission method can guarantee absolute security.
Children's privacy
UnicodeNow is a general-purpose technical website and is not directed specifically to children. The text tools do not intentionally request personal information from children or from any user.
Your privacy choices and rights
You can choose to use browser-local tools rather than server-assisted ones if you prefer your text not to leave your browser; avoid entering text into server-assisted search or processing fields if you would rather it not be transmitted; reject optional analytics from the privacy preferences banner; and clear stored theme or consent preferences using your browser's site-data controls at any time. You may contact UnicodeNow through the contact page to ask what information (if any) is associated with a request you made, to ask that it be corrected, to ask that it be deleted, or to object to a specific processing activity; requests of this kind are currently handled manually rather than through an automated self-service portal, since no such portal exists yet.
International users
This project does not designate a fixed hosting location or a specific list of sub-processors in its repository or public configuration; deployment location depends on where an operator runs the Docker Compose stack described above. If you access UnicodeNow from a different region than where it is hosted, standard internet routing means your request may cross regional or national boundaries in the same way as any other website visit. This page will be updated with more specific detail if and when a fixed hosting arrangement is documented.
Changes to this policy
This policy may be updated when site features, service providers or data-handling practices change. The latest revision date appears at the top of this page. There is not currently an automated email or in-app notification for policy changes; check this page directly for the current version.
Contact
Privacy questions and requests can be submitted through the contact page. A dedicated privacy-specific email address is not currently published; see About for general project information and Terms for the site's usage terms.
Frequently asked questions
Is text entered into local tools sent to the server?
No. For the 32 tools marked "Processed locally in your browser," the text you enter is analyzed or transformed by JavaScript running in your browser and is not intentionally submitted to the UnicodeNow application server as part of running that tool. Loading the page itself still generates an ordinary HTTP request, as with any web page.
Which tools send queries to the server?
Character Encoding Detector, UTF-8 Validator, Mojibake Repair, Confusable Character Detector and Punycode Converter submit entered text to this site's own POST processing endpoint. Unicode Character Lookup sends your search term to the server as a URL query parameter. All other tools on the site are browser-local.
Can search queries appear in URLs?
Yes, for Unicode Character Lookup and the site search/tools-filter pages, which use a GET query parameter. That means the query can appear in the page URL, your browser history, bookmarks, and (in limited form) referrer information sent to same-origin requests.
Does UnicodeNow store tool input?
The five POST-based server-assisted tools return responses with Cache-Control: no-store and do not write submitted text to PostgreSQL or Redis. Unicode Character Lookup also does not use PostgreSQL or Redis for your search. A separate API surface not used by any UnicodeNow page (documented below) does cache submitted queries in Redis temporarily.
Does UnicodeNow use cookies?
The application registers session-cookie middleware, but no page currently reads or writes session data, so no meaningful information is stored in it. A short-lived contact_success cookie carries a contact-form reference to the confirmation page. Optional analytics consent is stored in localStorage, not a cookie.
Does UnicodeNow use analytics?
No analytics provider is currently enabled. The site includes an analytics consent control so optional analytics can be added later without loading analytics until a visitor accepts it.
Are downloaded files stored by UnicodeNow?
No. Report and export downloads are generated in your browser from data already on the page and saved directly to your device; UnicodeNow's server is not involved in generating or receiving those files.
Can browser extensions access text entered into a tool?
Potentially, yes. Browser extensions, clipboard managers and other software installed on your device can interact with page content or clipboard data independently of UnicodeNow, and that is outside this site's control.
How long are logs retained?
A formal retention period for server and access logs has not yet been documented for this deployment.
How can I clear browser-stored preferences?
UnicodeNow only stores a light/dark theme preference in your browser's local storage under the key "theme." You can remove it using your browser's site-data or local-storage clearing controls.
How can I request deletion of personal data?
Use the contact page to make a request. Because most tools do not transmit or store your input, there is typically nothing tool-related to delete; requests about other data (such as messages you send us) will be handled manually.
How can I contact UnicodeNow about privacy?
Through the contact page. A dedicated privacy-specific email address is not currently published.