Privacy Policy

Last updated: 4 October 2026

FreeSVGLab does not require registration. This policy explains page measurement, browser storage, existing Google services and server logs.

Cookie-less first-party page measurement

We run our own measurement at /__h to understand which pages work and to distinguish people from automated traffic. It uses no cookies, no third-party analytics, and no advertising identifiers. We do not sell or share the records from this measurement. The service is operated by the site owner; records and daily token secrets are separate for each site. Other existing services are described separately below.

What your browser sends

When a page opens or its path changes without a full reload, your browser sends the page path without its query string or fragment; the referring site domain only, or the previous page path if it was on this site; a random page number kept in memory; and a random tab session number. It also sends the primary language code (two or three letters), how many languages are configured (0, 1 or 2+), the time zone offset rounded to the hour, colour-scheme setting, pointer type, and whether the browser reports automation.

Screen information is sent as coarse classes, never exact screen dimensions: viewport-width lower bounds of 0, 1, 360, 480, 768, 1024, 1440 or 1920 pixels, and pixel-density classes of 0, 1, 1.5, 2 or 3. The browser sends yes/no flags for whether its window fits the screen and has normal browser chrome, whether local storage could be written, whether the page was prerendered or restored from the back-forward cache, plus a reserved status field fixed at zero; this generic client does not detect 404 pages. It sends whether the page opened in the foreground and whether navigation was a normal load, reload, back/forward action or prerender. Changes limited to the URL query string or fragment do not start a new page-view record.

When the page is hidden, you leave, or the page path changes, it sends total time open and time in the foreground (whole seconds); delay before the first input (milliseconds, or no input); first input kind (mouse, touch, pen, keyboard, wheel or scroll); input and script-error counts; and whether a frame was painted or the window resized. Scrolling is grouped into no scroll, 0%, 25%, 50%, 75% or 100%; page length into 1, 2, 3 or 6+ screens; mouse movement into 0, 1–2, 3–9, 10–49 or 50+ events; and touch movement into 0, 1–4 or 5+ events. Input, click and error counts and timings are transmitted without caps. The server caps those stored counts at 99 and stored timings at one hour.

Click counts describe kinds of controls only: navigation (nav), breadcrumbs (crumb), footer (foot), downloads (dl), copy controls (copy), controls with play or preview labels or classes (play, best-effort), other same-site links (int) and external links (ext). We do not send clicked link destinations, copied text, audio content, typed text or mouse coordinates. Leaving records include the page path, page and session numbers and a sequence number (up to 10 per page view), so reports use the latest summary for each page view; earlier raw summaries remain until pruning.

How visits are counted

The server makes a daily token from your IP address and browser user-agent string with a random secret unique to this site. The secret changes every UTC day and the old one is discarded. Raw IP addresses and raw user-agent strings are not stored with page views; the token cannot be recomputed after the daily secret is discarded. A second daily token uses only the network part of the IP address (the first two IPv4 blocks or first two IPv6 blocks) to help detect automated fleets. The server also records browser and operating-system families, automated-browser flags, whether browser client hints agree with the browser string, and whether the address matches a known hosting network. Cloudflare provides the request country; only its two-letter country code is kept. Request times are recorded on the server.

Returning visits and browser storage

localStorage holds hh:fs:v1: the first visit date, last visit date and number of distinct visit days, capped at 21. Only ranges leave your browser: days since the first visit (0, 1, 2–6, 7–13, 14–29 or 30+), visit days (1, 2, 3–5, 6–20 or 21+), and days since the previous visit (first visit, same day, 1, 2–6 or 7+). The dates themselves are not sent. The record is replaced on the first visit more than 180 days after its first visit date. sessionStorage holds hh:sid, the random number used for that tab session, normally removed when the tab session ends. A separate random page number stays only in page memory. Clearing site data removes these records.

Global Privacy Control and Do Not Track

This first-party measurement honours Global Privacy Control (GPC) and Do Not Track (DNT). When your browser exposes either opt-out setting, it sends only an empty request and writes neither measurement storage record. The server stores no page-view row or visitor token and adds only a number to an opted-out-request counter, grouped by reason only; browser families are not recorded for opted-out requests. If an extension adds only the opt-out HTTP header without exposing the browser setting, local storage may still be written, but the server still discards the page-view data. These promises apply to /__h; the existing services described below have separate behaviour.

Retention

Raw first-party measurement rows are kept for up to 13 months. Daily totals, such as numbers of visitors and pages, contain no individual visit records and are kept indefinitely.

Server logs and abuse prevention

Standard server access logs contain IP addresses, browser strings, requested URLs and times and are kept for 14 days for abuse prevention. Pages also send a separate content-free /api/track/view request. It carries none of the measurement fields above and appears only in the standard server logs to help distinguish scrapers from readers.

Icon popularity and download counts

When an icon detail page opens, and when its PNG or SVG download link is activated, the browser sends the icon identifier and the action (view or download) to /api/track. This request sends no cookies and creates no browser storage or visitor identifier. We retain only cumulative view counts, download-link activation counts and a last-updated time per icon, indefinitely. A download count records a link activation, not confirmation that the file finished downloading. These counts help order popular icons; they are not unique visitor counts.

The browser skips these events when Global Privacy Control or Do Not Track is exposed, and the endpoint also honours the corresponding opt-out request headers. The aggregate table stores no IP address, browser string or event history. Standard server logs described above still apply. This counter is separate from the content-free /api/track/view request and the /__h page measurement.

Sponsored game card

The home page and icon pages show a card labelled “Sponsored” for Outlaw Immortals, a mobile game. When the card scrolls into view, or you open its trailer or select a store link, the browser sends the event name, the card position (home or icon page), the page language and, for store links, which store to /api/sponsored. The request sends no cookies, creates no browser storage and carries no icon or visitor identifier. The server stores nothing from it; the request appears only in the standard server logs described above, which we count to see whether the card is useful. These events are skipped when Global Privacy Control or Do Not Track is exposed. The store pages are operated by Google and Apple under their own policies.

Existing Google Analytics and advertising

FreeSVGLab also uses Google Analytics, which separately receives usage information such as page views, browser and device information, referral sources and approximate location. It may use analytics cookies and retains its data under its own policies. Our cookie-less measurement, opt-out and retention promises above apply to our first-party service; its records are not sent to Google. Google Analytics is a separate third-party service.

Advertising services, when enabled, may set their own cookies. Google AdSense may use cookies to serve advertisements based on prior visits to this or other websites.

Contact

For privacy questions or feedback, email [email protected].