Who is responsible
I am Ishan Karunaratne, based in New Jersey, United States. I operate What’s Taller? at whatstaller.com, a visual comparison resource for a general audience. This policy explains how I handle information when you use the site. For privacy questions or requests: [email protected] or the contact page.
What the current tool uses
- Comparison choices: selected subjects, positions, units, and custom dimensions are processed in your browser. There is no account, cloud scene database, or upload form.
- Saved reference height: when you use “Add yourself,” the height is saved in browser local storage under
whatstaller-heightso it can be remembered on this device. The application does not send that value to my server. It stays until you replace it, clear site data, or your browser removes it. - Site delivery: your browser must send connection information, including an IP address and requested resource, to the infrastructure serving the website. Infrastructure may record timestamps, browser information, request paths, and security events to deliver and protect the service.
- Messages you choose to send: contacting me shares your email address and message with me and my email provider. Include only what is needed to answer your request. The contact page opens your email application; there is no on-site message form, and the comparison app does not read your mailbox.
The current application does not set advertising cookies, run session replay, or load Google Ads or Amazon tracking scripts. Fonts and comparison artwork are served with the site.
Optional Google Analytics
If you allow analytics, I use Google Analytics 4 to understand visits and use of features such as adding subjects, selecting comparisons, copying links, and downloading images or source notes. Google receives page paths, browser and device information, interaction events, and cookie identifiers. Connection information, including your IP address, is processed when your browser contacts Google.
The Google tag loads only after you accept analytics and the page finishes loading. Declining keeps it unloaded. I exclude entered heights, search text, URL query strings, and shared-scene fragments from analytics events. Advertising consent remains off, and Google signals and advertising personalization are disabled.
Your choice is saved in local storage under whatstaller-analytics-consent-v1. With permission, Google uses _ga and related cookies, configured to expire after one year without renewal, to distinguish visits. Event and user data retention is set to 14 months without resetting the retention period on new activity; aggregated reports may remain longer. Withdrawing consent stops future collection and removes this site’s Analytics cookies. It does not delete previously collected reports. You can keep using every comparison feature with analytics off.
See Google’s privacy policy for information about its processing.
Hosting and mail infrastructure
The public site runs on Coolify on a Hetzner dedicated server, fronted by Cloudflare. Coolify manages deployment, Hetzner provides the server infrastructure, and Cloudflare is providing the domain’s DNS, proxying, caching, and traffic protection.
Requests to the site pass through this infrastructure. Connection and security information may be processed to deliver pages, prevent abuse, and diagnose problems. Provider information is available in the Hetzner privacy policy and Cloudflare privacy policy. Those policies supplement this notice; they do not replace my responsibilities for the site.
Cloudflare Web Analytics is disabled. Cloudflare also supplies Network Error Logging instructions in response headers, which can cause supported browsers to send connection failure reports to Cloudflare. These infrastructure diagnostics are separate from the comparison choices and saved height, which the application processes in your browser.
I use my self-hosted Stalwart Mail Server on Amazon Web Services for this domain’s mail, with outgoing mail relayed through Amazon Simple Email Service. This infrastructure handles email addresses, message contents, attachments, delivery metadata, and security logs needed to receive and reply to messages. Some role addresses and catch-all messages forward to my Gmail inbox, where Google also processes the forwarded copy. Direct messages to the hello mailbox are not subject to that catch-all forwarding rule.
See the AWS Privacy Notice and Google Privacy Policy for provider information. Sending email is separate from browsing or comparing objects; the app currently has no server-side email submission feature.
I am verifying operational log retention, backup retention, and relevant provider settings. I have not yet established a confirmed fixed deletion period for those infrastructure records.
Shared links, images, and source notes
A shared scene is encoded after the # in its link. Browsers do not normally include that fragment in the HTTP request to my server. The full link is still visible to anyone you send it to, the app running on the page, and potentially your browser history, synced devices, extensions, or the messaging service you use.
Comparison images and the optional source-notes text file are created in your browser and downloaded to your device. They can contain selected subjects, custom dimensions, measurement assumptions, references, and attribution. Downloading them does not upload your comparison to me. If you use your device’s share menu or post a link, image, or source notes elsewhere, the destination service receives what you choose to share and applies its own policy. Shared copies cannot be recalled by clearing this site’s data.
Google advertising: planned, not active
I plan to support the site with Google advertising. Before enabling it, I will update this policy to identify the actual services and recipients, their purposes, retention, and applicable choices, and implement required consent controls. Advertising is not activated by accepting these terms or by reading this page.
When implemented, Google and participating advertising partners may use cookies or similar technologies, IP addresses, device information, and ad interactions to deliver, measure, and, where permitted, personalize advertising. Details are available in how Google uses information from partner sites and the Google Privacy Policy.
Where consent is required, optional advertising technologies must wait for your choice. A persistent privacy-choices control will allow you to change or withdraw consent. Choosing non-personalized ads does not necessarily mean that cookies or consent requirements disappear. I do not currently sell personal information or share it for cross-context behavioral advertising.
Affiliate links: planned, not active
I may add clearly disclosed paid links to Amazon or other retailers. Following one would send you to that retailer, which may use its own cookies or other tracking to attribute purchases. I may receive a commission and referral reports; a retailer handles checkout and payment under its own privacy policy.
I do not currently claim Amazon Associates participation or publish active affiliate links. If the program is enabled, the required Amazon statement and a plain-language commission disclosure will appear clearly with the relevant content.
A general-audience resource
You can explore without providing a name, date of birth, photo, or email address. Use a generic reference height whenever a real person’s measurement is unnecessary.
I do not provide user accounts or a system for collecting personal records. Keep personal details out of comparisons and shared notes. The comparison guide explains how to preserve measurement context without adding personal information.
Your choices and rights
Clear this site’s data through your browser settings to remove the saved height. You can use the comparison tool without saving a personal height. Clearing browser data does not erase exported files, shared copies, or infrastructure logs.
Depending on where you live and the processing involved, you may have rights to access, correct, delete, restrict, object to, or obtain a copy of personal information, withdraw consent, or complain to a privacy regulator. Contact me to exercise applicable rights. I will use proportionate verification and will not ask for unnecessary identity information.
I use information only as needed to provide requested functionality, protect the service, meet legal obligations, and respond to requests; where applicable these purposes rely on providing the requested service or legitimate interests in secure operation. Optional uses requiring consent will rely on that consent. Hosting and email providers may process information outside your country. My review of their processing locations and applicable transfer safeguards is ongoing.
Retention, security, and updates
Saved browser data follows the retention described above. I keep contact messages only as long as needed to resolve the request and any applicable legal obligations. I will publish confirmed infrastructure retention details as the review is completed.
I use technical safeguards appropriate to the service, but no website or transmission can be guaranteed completely secure. Material changes to data use will be reflected here before the new processing starts, with additional notice or consent when required. The revision date appears above.