FavIconFlex
Privacy & cookies
Last updated 5 October 2026
The short version
- Your images never leave your browser. What you draw, the images you upload or paste, and every icon generated from them are made on your own device. None of it is sent to us or to anyone else - "upload" only means opening it in this tab.
- There are no accounts. No sign-up, no login, no email address needed to use FavIconFlex.
- There are no cookies. FavIconFlex sets none at all. Your drawing, your image (if it is small enough), the text and every setting are remembered in your browser's local storage, which never leaves your device.
- Visits are counted, people are not. We use self-hosted, cookieless analytics that collects no personal data and does not follow you between sites or between visits.
What happens to the images you make
FavIconFlex runs in your browser. When you open the site your browser downloads the program itself - the same fixed set of HTML, CSS and JavaScript files everyone gets - and then runs it locally. From that point on, everything you draw, type or open, and every icon made from it, lives in the browser tab in front of you.
We do not receive your images, and we could not, because nothing in the app sends them anywhere. There is no upload, no API call, no analytics event carrying your content, and no server-side component that ever sees it. The server's only job is to hand over the application files.
The word "upload" in the app is a convenience, not a description of what happens. When
you choose, drop or paste an image, your browser reads it from your disk or clipboard
straight into the page. The icons, the .ico file and the
.zip you download are all assembled in the browser and saved straight to
your device; when you press Copy HTML, the markup is written from the
browser to your clipboard. None of it travels through us on the way.
In practice this means you can disconnect from the network once the app has loaded and carry on working - drawing, exporting and downloading all still work - and it means that working on an unreleased logo does not disclose it to us.
How to check this yourself
You do not have to take our word for any of the above. Open your browser's developer tools, switch to the Network tab, and use FavIconFlex normally: draw, open an image, change the style, download the zip. After the initial load of the application files the only requests you will see are the analytics beacons described below, which carry the page's address and nothing from your work - because nothing carrying your content is ever sent. Or simply go offline after the app has loaded and watch it keep working.
What is stored on your device
FavIconFlex remembers your work and your settings so that closing the tab does not throw them away. It does this with your browser's local storage, which is a store on your own computer. Nothing written there is transmitted to us or to anyone else, and nothing in it is readable by another website.
| Name | What it holds | Why |
|---|---|---|
fi-session |
Your pixel drawing, the image you opened and its file name, the text icon, and every setting: style, site name, colours, folder and which files to make. An image too large to store is left out and a note says so - the rest is still kept. | So a reload or an accidentally closed tab does not lose your work. |
fi-theme |
Light or dark, if you have chosen one. | So the app opens in the theme you picked. |
You can remove all of it at any time by clearing site data for this site in your browser's settings - in most browsers, through the padlock or information icon in the address bar. Doing so loses the remembered work and settings and nothing else. If you would rather nothing were kept at all, a private or incognito window discards it when you close the window.
Cookies
FavIconFlex sets no cookies. Not for sessions, not for settings, not for analytics, not for advertising - there are none.
Our analytics stores nothing on your device at all - no cookie, no local storage, no identifier of any kind - so it falls outside those rules too. That is why FavIconFlex has no cookie banner: there is nothing to ask you to agree to.
Analytics
We use Plausible Analytics to count how much the site is used. Two things about how it is set up matter here:
- It is self-hosted on our own server in the European Economic Area
(
plausible.vsrc.uk). There is no third-party analytics company receiving anything, and the measurements are not shared with, sold to or combined with data from anyone else. - It is cookieless and identifier-free. It does not set a cookie, use local storage, or store any persistent identifier, so it cannot follow you from visit to visit or from site to site.
For each page view it records:
- the page address on this site - which is only ever a page such as
/or/privacy, and never contains anything from your work; - the site you arrived from, if any;
- your browser, operating system and device type;
- your country and, approximately, region - worked out from your IP address at the moment of the request.
Your IP address is used only to derive the country and to produce a one-way hash that lets the same visitor be counted once rather than twice within a day. The IP address itself is never written to storage, the hash cannot be reversed to recover it, and the secret used to produce it is replaced every 24 hours, so yesterday's hash and today's cannot be matched up. The result is a count of visits, not a record of visitors.
Our lawful basis for this is legitimate interests (UK GDPR Article
6(1)(f)): we need to know roughly how much the site is used and which pages people
reach, and this is the least intrusive way we know of to find out. We have weighed that
against your interests and consider the impact minimal - no personal data is retained,
no profile is built, nothing is shared, and nothing about you is stored on your device.
If you would prefer not to be counted at all, blocking plausible.vsrc.uk
in a content blocker or your browser's settings stops it entirely, and FavIconFlex works
exactly the same without it.
Server logs
Like every website, the server that hands out the FavIconFlex application files keeps standard access logs. These record the IP address making the request, the time, the file requested, the response status and the browser's user-agent string. They are generated by the web server itself, not by the app, and they never contain anything you drew or opened - only the fixed file names that make up the program.
We use them to keep the site available and secure and to investigate faults and abuse. The lawful basis is again legitimate interests. They are retained for no longer than 30 days and are not used to build any profile or combined with the analytics above.
Who handles your information
FavIconFlex has no third-party services embedded in it - no advertising, no trackers, no social media widgets, no external fonts, no content delivery networks, and no third-party analytics provider. The only organisation involved besides us is the company that hosts the server, acting on our instructions under a contract, and the only information it handles is what the server logs section describes.
The servers - both the site and the analytics instance - are located in the European Economic Area, which UK adequacy regulations cover, so no transfer safeguards beyond that are needed. We do not transfer anything outside the UK or the EEA.
Security
The site is served only over HTTPS, with HTTP Strict Transport Security, so the application files cannot be tampered with in transit. Since your work stays in your browser, the strongest protection it has is the one your own device provides.
Contact
For anything about this notice, or to exercise any of the rights above, write to faviconflex+privacy@vsrc.uk.