Privacy Policy
Last updated 4 September 2026
privacy@caratbase.com), and your country of
establishment, which decides the governing law clause. They are marked
[TO CONFIRM] below. Everything else is accurate to what the site
actually does today.This policy describes exactly what CaratBase does with data. It is written to match the site as built rather than as a general template, so where it says something does not happen, that is a statement about the code.
The short version
- No cookies. The site sets none, for any purpose.
- No third-party trackers, ad networks or analytics services. Analytics is our own and runs on our own infrastructure.
- No persistent identifier. Nothing is written to your device to recognise you, and we cannot follow you from one day to the next.
- No external requests. Fonts are served by us, not by Google. Loading a page contacts nobody but CaratBase.
- Your saved jewellery never leaves your device unless you type an email address into a form and submit it.
Who is responsible for your data
CaratBase is operated by [TO CONFIRM: legal entity or trading name], established in [TO CONFIRM: country]. For any question about this policy or to exercise the rights described below, write to privacy@caratbase.com.
How visits are counted
We want to know how many people use each tool. We do that without identifying anyone.
Your browser sends no identifier at all. Our server derives a one-way hash from three things — a shortened form of your IP address, your browser's user-agent string, and a secret salt that changes every day at midnight UTC — and stores only that hash.
Two consequences follow, and both are deliberate:
- Your IP address is truncated before hashing, to the first three octets of an IPv4 address or the first four groups of an IPv6 one, so the input corresponds to a neighbourhood rather than a household. The full address is never written down.
- Because the salt rotates daily, yesterday's hashes cannot be matched to today's. We can count how many people visited on a given day. We cannot build a profile, follow a person over time, or work backwards from stored data to an individual.
Alongside the hash we record the page path, the referring site if your browser sends one, the country your request came from as reported by our network provider, whether you are on a phone, tablet or desktop, and the time. We do not record your full IP address, your name, or anything else about you.
This is why the site has no cookie banner: there is no persistent identifier to ask your permission for.
What is stored on your own device
Several tools save your work locally so it is still there when you return. This uses your browser's local storage, never cookies, and none of it is transmitted to us:
| What | Why |
|---|---|
| Your vault | The pieces you have valued and chosen to save |
| Saved ring sizes | Sizes you have named and stored, and your last result |
| Screen calibration | So the ring sizer stays true to life on your screen |
| Game history | Your streak and past guesses |
Clearing your browser data deletes all of it, and we have no copy. This storage exists only because you asked for a feature that needs it, which is why it does not require consent.
What you actively give us
Two forms send data to our server, and only when you fill them in and submit:
- Value-change alerts. If you give an email address we store it with the specification of the piece you valued, so we can tell you if its value moves materially. The lawful basis is your consent, which you may withdraw at any time.
- Reported offers. If you tell us what a buyer offered you, we store the amount, the type of buyer, the stone's specification and the country. This is deliberately anonymous — it carries no email address and nothing that identifies you — and it is what allows the site to publish honest resale figures.
Where the data is held
The site is hosted on GitHub Pages. Analytics and form submissions are processed by a Cloudflare Worker and stored in a Cloudflare D1 database in the Asia-Pacific region. Both are processors acting on our instructions. If we later enable email delivery it will be through Resend, and this policy will be updated before that happens.
Live metal prices are fetched by our server, not by your browser, so requesting a price reveals nothing about you to those providers.
How long it is kept
- Analytics events: 14 months, then deleted.
- Email addresses: until you ask us to remove them, or after two years of no contact.
- Reported offers: retained indefinitely, because they are anonymous and their value is as a long-run record. They contain nothing that identifies you.
Your rights
If you are in the UK, the EU, or a jurisdiction with comparable law such as California, you have the right to ask what we hold about you, to have it corrected or deleted, to receive a copy, to object to processing, and to complain to your data protection authority.
In practice the only data we hold that can be linked to you is an email address you chose to give us. Write to privacy@caratbase.com and we will action it within 30 days. We do not sell personal information, and we do not share it for advertising.
We cannot delete analytics records on request, because after the daily salt has rotated we have no way to work out which ones were yours. That is a consequence of the design rather than a refusal.
Links to other companies
Some pages link to retailers, insurers, buyers and laboratories. Following one takes you to a business we do not control, with its own privacy policy. Some of those links may earn us a commission; where they do it is disclosed on the page. See our disclaimer.
Children
The site is not intended for children and we do not knowingly collect data from anyone under 16.
Changes
If this policy changes materially the date at the top will change and the substance of the change will be described here rather than quietly absorbed.