Legal

Privacy Policy

Last updated 1 September 2026

The short version: your images are never uploaded. faviconflow has no server that could receive them — everything is drawn in your own browser, and that does not change whether or not you accept cookies.

We do use Google Analytics to see which parts of the tool get used, and we may show ads in future. Both are described below, and in regions where consent is required we ask before anything is set.

What happens to your images

Images, text, and icons you use in the generator are processed by JavaScript on your own device using the HTML5 Canvas API. They are never transmitted anywhere. Closing the tab discards them. This is a property of how the tool is built rather than a promise we ask you to take on trust — you can confirm it by opening your browser's network panel while you work. Analytics and advertising do not change this: neither has any access to what you are designing.

Analytics

We use Google Analytics 4 to understand which features people use and which pages they arrive on. It records things like the page visited, approximate location derived from a truncated IP address, device and browser type, and referring site. It does not record the contents of your icon.

IP anonymisation is enabled. Analytics runs only where it is permitted to: in the EEA, the UK and Switzerland we use Google Consent Mode with all storage denied by default, and nothing is stored until you choose Accept analytics. If you decline, no analytics cookies are set.

Advertising

We do not currently show ads. If advertising is introduced, it will be through Google AdSense, and this section and the date at the top of this page will be updated before any ad code goes live. Where consent is required, ad storage and personalisation stay denied unless you grant them; you would be asked again rather than opted in silently.

Search engine tools

The site is registered with Google Search Console and Bing Webmaster Tools. These report on how the site appears in search results. They work from data the search engines already hold from their own crawling and do not place anything in your browser or collect anything about you.

Cookies and local storage

Your cookie choice is remembered in your browser's local storage under the key ff-consent, so you are not asked on every page. This is stored on your device only and is never sent to us.
Google Analytics cookies (_ga and similar) are set only after you accept, and are used to distinguish visits.
The generator itself sets nothing. It keeps no history of what you have made.

You can change your mind at any time using Cookie settings in the footer of any page, or by clearing site data in your browser.

Third parties that see your IP address

Loading any web page requires your browser to request files, and some of ours come from content delivery networks run by other companies. Those companies necessarily receive your IP address, browser user-agent string, and the time of the request, because that is how an HTTP request works. This happens regardless of your cookie choice, as it is required to display the page at all.

Google Fonts (fonts.googleapis.com, fonts.gstatic.com) — the typefaces used across the site.
Cloudflare cdnjs (cdnjs.cloudflare.com) — the JSZip library, used to bundle your download into a .zip file.
jsDelivr (cdn.jsdelivr.net) — Twemoji emoji artwork and Lucide symbol artwork, fetched only when you use the Emoji or Icon modes.
Google (googletagmanager.com) — the analytics tag, loaded only where analytics is active.

These requests carry no information about what you are designing. Each provider handles the data it receives under its own privacy policy, which we do not control.

Your rights

Depending on where you live, you may have the right to access, correct, or delete personal data held about you, and to object to processing. Because we hold no accounts and store nothing server-side, the practical steps are: decline analytics, use Cookie settings to withdraw a previous acceptance, or clear site data. For requests concerning data held by Google, see Google's own privacy tools.

Shareable links

The Copy link button encodes your current settings — colours, text, shape, and similar options — into the part of the URL after the #. Browsers do not send that fragment to servers, and we do not record it. Any image you uploaded is not included in the link.

Downloads

The icon package is assembled in your browser and saved directly to your device. It does not pass through us.

Children

The site is not directed at children and we do not knowingly collect personal information from them.

Changes

If this policy changes — for example, when advertising is switched on — the date at the top of this page will change with it. Material changes will be described here rather than made quietly.

Contact

Questions about this policy: hello@faviconflow.com.