The short version
Most FerrLens tools run entirely in your browser — we never see what you paste into the JWT decoder, the regex tester, the JSON formatter, the cron parser, the UUID generator, or the SERP preview. The server-side tools (Lighthouse SEO checker today, future DNS / HTTP headers / sitemap tools) receive only the public URL you submit, return a result, and cache the result for 24 hours to spare third-party APIs. No account is required for any of this.
The few things we do store are listed below, with the legal basis, the retention, and how to get them deleted.
Data controller
FerrLabs SAS — SIREN 104 243 951 — registered in France. Contact privacy@ferrlabs.com for any privacy question, data request or complaint. You can also lodge a complaint with the CNIL.
What we store
1. The 24-hour SEO cache
When you run a Lighthouse check on a URL, we store the result keyed by sha256(url + strategy) for 24 hours. The cached row contains the public URL you submitted
and the Lighthouse scores we returned — nothing about you. No IP, no User-Agent.
- Purpose: performance (avoid hammering Google's PageSpeed Insights API).
- Legal basis: legitimate interest (GDPR Art. 6(1)(f)).
- Retention: 24 hours, then automatically deleted.
2. Share snapshots
A snapshot is created only when you explicitly click Share this scan on a tool result page. The row contains the inputs you submitted (a URL) and the result we returned. The share URL is unguessable (~1017 combinations) but publicly accessible — anyone who has the link can view the snapshot.
- Purpose: enable you to share a result with a teammate / customer / forum.
- Legal basis: consent (GDPR Art. 6(1)(a)) — clicking Share is the consent action.
- Retention: 90 days for anonymous shares (longer with an account). You can revoke any share at any time from its URL — the row is marked revoked and the page starts returning 404 immediately.
3. Server logs
Like any web service, the load balancer (Traefik) and the API process write request logs that contain your IP address, the requested path, the HTTP method, the status code, and the response time. We never join these logs to anything else.
- Purpose: rate-limiting, abuse detection, debugging crashes.
- Legal basis: legitimate interest (GDPR Art. 6(1)(f)) — CNIL guidance on technical logs.
- Retention: 6 months, then automatically rotated out.
4. Cookies
FerrLens sets no marketing or analytics cookies. We don't run Google Analytics, Plausible, Fathom, or anything similar. If we ever do, you'll see a banner first. See the cookie policy for the running list.
What we don't store
- The content you paste into a browser-side tool (JWT decoder, regex tester, JSON formatter, cron parser, UUID generator, SERP preview). It never leaves your tab.
- Your IP, beyond the 6-month rolling log.
- A profile, a fingerprint, a session cookie (we don't have accounts yet).
- Anything from a third-party tracker.
Third parties
The server-side SEO checker calls Google PageSpeed Insights with the URL you submitted. Google can see that URL and our server's IP. Google's privacy terms apply to that call — see PageSpeed Insights docs.
We host on a self-managed Kubernetes cluster in France. No data leaves the EU. Cert-manager issues TLS via Let's Encrypt (US-hosted), which is involved only in the certificate-issuance flow — not in serving requests.
Your rights
Under GDPR you can ask us to:
- Access — get a copy of what we have on you.
- Erase — delete everything we have on you. For shares, just open the share URL and click Delete this share; we'll erase server logs on request even though they're aggregated.
- Rectify — fix anything inaccurate.
- Object / restrict — stop a specific processing.
Email privacy@ferrlabs.com. We respond within 30 days per GDPR Art. 12.
Changes
If we change this policy substantively (new data we collect, new third party, new retention), we'll bump the Last updated date at the top and post the change in the FerrLabs changelog. Subscribe to the RSS to be notified.