SetFlex
Privacy & cookies
Last updated 30 September 2026
The short version
- Your lists never leave your browser. The two lists you paste and the comparison result are worked out on your own device. None of it is sent to us or to anyone else.
- There are no accounts. No sign-up, no login, no email address needed to use SetFlex.
- There are no cookies. SetFlex sets none at all. Your lists, settings and pane sizes are remembered in your browser's local storage, which never leaves your device.
- Visits are counted, people are not. We use self-hosted, cookieless analytics that collects no personal data and does not follow you between sites or between visits.
What happens to the lists you paste
SetFlex runs in your browser. When you open the site your browser downloads the program itself - the same fixed set of HTML, CSS and JavaScript files everyone gets - and then runs it locally. From that point on, the comparison itself and everything you paste into the left and right lists live in the browser tab in front of you.
We do not receive the lists you paste, and we could not, because nothing in the app sends them anywhere. There is no upload, no API call, no analytics event carrying your content, and no server-side component that ever sees a list. The server's only job is to hand over the application files.
The same is true of the result. When you press Copy, the text is written from the browser straight to your clipboard - it does not travel through us on the way.
In practice this means you can disconnect from the network once the app has loaded and carry on working, and it means that pasting confidential or personal data into either list does not disclose it to us. What you do with that data remains yours to govern; if it is personal data, you stay its controller.
How to check this yourself
You do not have to take our word for any of the above. Open your browser's developer tools, switch to the Network tab, and use SetFlex normally: paste two lists, choose a comparison, copy the result. After the initial load of the application files the only request you will see is the analytics beacon described below, which carries the page's address and nothing from your lists - because nothing carrying your content is ever sent. Or simply go offline after the app has loaded and watch it keep working.
What is stored on your device
SetFlex remembers your lists and your settings so that closing the tab does not throw them away. It does this with your browser's local storage, which is a store on your own computer. Nothing written there is transmitted to us or to anyone else, and nothing in it is readable by another website.
| Name | What it holds | Why |
|---|---|---|
sf-session |
The text of the left and right lists, the comparison you have chosen, and the Case sensitive, Distinct, Sort and Invert option settings. If the two lists together are too large to store, the list text is left out and a note says so - the options are still kept. | So a reload or an accidentally closed tab does not lose your work. |
sf-theme |
Light or dark, if you have chosen one. | So the app opens in the theme you picked. |
sf-panes |
The sizes you have dragged the lists and result panes to. | So your layout survives a reload. |
You can remove all of it at any time by clearing site data for this site in your browser's settings - in most browsers, through the padlock or information icon in the address bar. Doing so loses the remembered lists and settings and nothing else. If you would rather nothing were kept at all, a private or incognito window discards it when you close the window.
Cookies
SetFlex sets no cookies. Not for sessions, not for settings, not for analytics, not for advertising - there are none.
Our analytics stores nothing on your device at all - no cookie, no local storage, no identifier of any kind - so it falls outside those rules too. That is why SetFlex has no cookie banner: there is nothing to ask you to agree to.
Analytics
We use Plausible Analytics to count how much the site is used. Two things about how it is set up matter here:
- It is self-hosted on our own server in the European Economic Area
(
plausible.vsrc.uk). There is no third-party analytics company receiving anything, and the measurements are not shared with, sold to or combined with data from anyone else. - It is cookieless and identifier-free. It does not set a cookie, use local storage, or store any persistent identifier, so it cannot follow you from visit to visit or from site to site.
For each page view it records:
- the page address on this site - which is only ever a page such as
/or/privacy, and never contains anything from your lists; - the site you arrived from, if any;
- your browser, operating system and device type;
- your country and, approximately, region - worked out from your IP address at the moment of the request.
Your IP address is used only to derive the country and to produce a one-way hash that lets the same visitor be counted once rather than twice within a day. The IP address itself is never written to storage, the hash cannot be reversed to recover it, and the secret used to produce it is replaced every 24 hours, so yesterday's hash and today's cannot be matched up. The result is a count of visits, not a record of visitors.
Our lawful basis for this is legitimate interests (UK GDPR Article
6(1)(f)): we need to know roughly how much the site is used and which pages people
reach, and this is the least intrusive way we know of to find out. We have weighed that
against your interests and consider the impact minimal - no personal data is retained,
no profile is built, nothing is shared, and nothing about you is stored on your device.
If you would prefer not to be counted at all, blocking plausible.vsrc.uk
in a content blocker or your browser's settings stops it entirely, and SetFlex works
exactly the same without it.
Server logs
Like every website, the server that hands out the SetFlex application files keeps standard access logs. These record the IP address making the request, the time, the file requested, the response status and the browser's user-agent string. They are generated by the web server itself, not by the app, and they never contain anything you typed - only the fixed file names that make up the program.
We use them to keep the site available and secure and to investigate faults and abuse. The lawful basis is again legitimate interests. They are retained for no longer than 30 days and are not used to build any profile or combined with the analytics above.
Who handles your information
SetFlex has no third-party services embedded in it - no advertising, no trackers, no social media widgets, no external fonts, no content delivery networks, and no third-party analytics provider. The only organisation involved besides us is the company that hosts the server, acting on our instructions under a contract, and the only information it handles is what the server logs section describes.
The servers - both the site and the analytics instance - are located in the European Economic Area, which UK adequacy regulations cover, so no transfer safeguards beyond that are needed. We do not transfer anything outside the UK or the EEA.
Security
The site is served only over HTTPS, with HTTP Strict Transport Security, so the application files cannot be tampered with in transit. Since your lists stay in your browser, the strongest protection they have is the one your own device provides.
Contact
For anything about this notice, or to exercise any of the rights above, write to setflex+privacy@vsrc.uk.