Privacy

Who is responsible

The controller for any personal data processed here is the operator of costdrag.eu. For privacy questions, to exercise any of the rights below, or to report a problem with this page, write to privacy@costdrag.eu.

Cookies and storage on your device

No cookies are set. Not by this site, and not by anyone else through it — there are no third-party scripts that could set one.

One thing is stored on your device, and only if you ask for it: if you switch between light and dark mode, the choice is saved in your browser's local storage under the key theme so the site does not flash the wrong colour on your next visit. It holds the word light, dark or system. It is not an identifier, it is never sent to the server, and clearing your browser data removes it. Nothing else is written to your device.

That is why there is no cookie banner. There is nothing to consent to.

What your browser talks to

Only this site. The Content-Security-Policy served with every page sets connect-src 'self', which means the browser is not permitted to send a request to any other origin. Where the tools need outside data — European Central Bank inflation figures, for example — the request is made by this server and the result passed on, so your browser never contacts the ECB and the ECB never sees you.

There are no fonts, scripts, images or embeds loaded from anyone else.

What you type into the tools

The calculators run in your browser. Portfolio sizes, contributions, salaries, target retirement ages and the rest are used to compute what you see and are not transmitted to the server, not stored, and not logged. Reload the page and they are gone.

Two things do leave your browser, and neither is personal: the fund you are looking at, so the server can return its cost figures, and the country you have selected, which appears in the address bar as ?country= so a link you share opens the way you left it.

Server logs

Like any web server, the machine serving this site records requests it receives, which includes IP addresses. That is ordinary operational logging — keeping the service running, spotting abuse, and diagnosing errors — and the legal basis is legitimate interest. These logs are not used to build a profile, are not combined with anything else, and are not shared.

Analytics

There is currently none. No analytics script is served and no usage events are collected.

The code supports a self-hosted, cookieless analytics setup that would run on the same machine as the site, with the browser talking only to this origin. It is switched off. If it is ever switched on, this page gets updated in the same change — and it would still set no cookies and still send nothing to a third party.

Your rights

Under the GDPR you can ask what personal data is held about you, ask for it to be corrected or erased, object to processing, and complain to your national data protection authority. In practice there is very little to ask about here: no account, no profile, no tracking, and server logs that are not tied to you by anything this site knows. Requests go to privacy@costdrag.eu.

Changes

If what this site does with data changes, this page changes with it. There is deliberately no "last updated" stamp: this site does not publish dates it cannot stand behind, and a date edited by hand goes stale the first time someone forgets. The terms and data sources pages cover the rest of how this site works.