Who is responsible
I am Ishan Karunaratne, based in New Jersey, United States. I operate What’s Taller? at whatstaller.com, a visual comparison resource for a general audience. This policy explains how I handle information when you use the site. For privacy questions or requests: [email protected] or the contact page.
What the current tool uses
- Comparison choices: selected subjects, positions, units, and custom dimensions are processed in your browser. There is no account or cloud scene database.
- Saved designs and images: the design editor remembers your latest comparison, positions, titles, settings, logos, and background on this device. Settings use localStorage under
whatstaller-design-v1; image files and a recoverable copy of the design use IndexedDB underwhatstaller-designs. The application does not upload these files or include design text in analytics or scene links. Image downloads are rendered in your browser. The editor shows the saved size and approximate memory used by added images. Use “Clear saved design” in the editor to remove this draft and pause saving, or clear this site’s browser data. Browser eviction or private browsing can remove a draft. Download important work to keep a separate copy. - Saved reference height: when you use “Add yourself,” the height is saved in browser local storage under
whatstaller-heightso it can be remembered on this device. The application does not send that value to my server. It stays until you replace it, clear site data, or your browser removes it. - Measurement units: Cloudflare supplies an approximate country based on your connection so the server can show feet for US visitors and metric elsewhere from the first page render. This does not request your device’s precise location. When you switch units, your choice is saved in local storage and a preference cookie for seven days from your latest selection. The cookie sends only your unit choice and its expiry to the server so returning visits render in the right units immediately. Visits do not renew the expiry. After it expires, the tool uses the country default again. Shared links keep the units chosen by their sender. The application does not store your country or include your reference height in this cookie.
- Site delivery: your browser must send connection information, including an IP address and requested resource, to the infrastructure serving the website. Infrastructure may record timestamps, browser information, request paths, and security events to deliver and protect the service.
- Messages you choose to send: the contact form sends your name, email address, reason, message, and any optional school, age group, or related link to my hello mailbox through my hosting and email providers. These details are used to handle your request, not to subscribe you to an outreach list. Include only what is needed and leave out student names and sensitive information. You can also email me directly. The comparison app does not read your mailbox.
The current application does not set advertising cookies, run session replay, or load Google Ads or Amazon tracking scripts. Fonts and comparison artwork are served with the site.
Optional Google Analytics
If you allow analytics, I use Google Analytics 4 to understand visits and use of features such as adding subjects, selecting comparisons, copying links, and downloading images or source notes. Google receives page paths, browser and device information, interaction events, and cookie identifiers. Connection information, including your IP address, is processed when your browser contacts Google.
The Google tag loads only after you accept analytics and the page finishes loading. Declining keeps it unloaded. I exclude entered heights, search text, URL query strings, and shared-scene fragments from analytics events. Advertising consent remains off, and Google signals and advertising personalization are disabled.
Your choice is saved in local storage under whatstaller-analytics-consent-v1. With permission, Google uses _ga and related cookies, configured to expire after one year without renewal, to distinguish visits. Event and user data retention is set to 14 months without resetting the retention period on new activity; aggregated reports may remain longer. Withdrawing consent stops future collection and removes this site’s Analytics cookies. It does not delete previously collected reports. You can keep using every comparison feature with analytics off.
See Google’s privacy policy for information about its processing.
Hosting and mail infrastructure
The public site runs on Coolify on a Hetzner dedicated server, fronted by Cloudflare. Coolify manages deployment, Hetzner provides the server infrastructure, and Cloudflare is providing the domain’s DNS, proxying, caching, and traffic protection.
Requests to the site pass through this infrastructure. Connection and security information may be processed to deliver pages, prevent abuse, and diagnose problems. Provider information is available in the Hetzner privacy policy and Cloudflare privacy policy. Those policies supplement this notice; they do not replace my responsibilities for the site.
Cloudflare Web Analytics is disabled. Cloudflare also supplies Network Error Logging instructions in response headers, which can cause supported browsers to send connection failure reports to Cloudflare. These infrastructure diagnostics are separate from the comparison choices and saved height, which the application processes in your browser.
I use my self-hosted Stalwart Mail Server on Amazon Web Services for this domain’s mail, with outgoing mail relayed through Amazon Simple Email Service. This infrastructure handles email addresses, message contents, attachments, delivery metadata, and security logs needed to receive and reply to messages. Some role addresses and catch-all messages forward to my Gmail inbox, where Google also processes the forwarded copy. Direct messages to the hello mailbox are not subject to that catch-all forwarding rule.
See the AWS Privacy Notice and Google Privacy Policy for provider information. Contact-form notifications are sent from [email protected] to [email protected], with your email address as Reply-To so I can reply directly. The form does not send an automatic confirmation to your email address. Message content is not stored in an application database or added to analytics.
The contact form uses Cloudflare Turnstile to check for spam. When the form loads, your browser connects to Cloudflare, which processes connection and browser signals for that check. My server validates the resulting token before sending a message. Short-lived, process-local counters use a hashed email address after verification to limit repeated submissions; they expire after one hour and are cleared when the process restarts. The form does not store IP addresses in those counters. See the Cloudflare Privacy Policy. Direct email remains available if you prefer not to use the form.
I am verifying operational log retention, backup retention, and relevant provider settings. I have not yet established a confirmed fixed deletion period for those infrastructure records.
Shared links, images, and source notes
A shared scene is encoded after the # in its link. Browsers do not normally include that fragment in the HTTP request to my server. The full link is still visible to anyone you send it to, the app running on the page, and potentially your browser history, synced devices, extensions, or the messaging service you use.
Comparison images and the optional source-notes text file are created in your browser and downloaded to your device. They can contain selected subjects, custom dimensions, measurement assumptions, references, and attribution. Downloading them does not upload your comparison to me. If you use your device’s share menu or post a link, image, or source notes elsewhere, the destination service receives what you choose to share and applies its own policy. Shared copies cannot be recalled by clearing this site’s data.
Google advertising: planned, not active
I plan to support the site with Google advertising. Before enabling it, I will update this policy to identify the actual services and recipients, their purposes, retention, and applicable choices, and implement required consent controls. Advertising is not activated by accepting these terms or by reading this page.
When implemented, Google and participating advertising partners may use cookies or similar technologies, IP addresses, device information, and ad interactions to deliver, measure, and, where permitted, personalize advertising. Details are available in how Google uses information from partner sites and the Google Privacy Policy.
Where consent is required, optional advertising technologies must wait for your choice. A persistent privacy-choices control will allow you to change or withdraw consent. Choosing non-personalized ads does not necessarily mean that cookies or consent requirements disappear. I do not currently sell personal information or share it for cross-context behavioral advertising.
Affiliate links: planned, not active
I may add clearly disclosed paid links to Amazon or other retailers. Following one would send you to that retailer, which may use its own cookies or other tracking to attribute purchases. I may receive a commission and referral reports; a retailer handles checkout and payment under its own privacy policy.
I do not currently claim Amazon Associates participation or publish active affiliate links. If the program is enabled, the required Amazon statement and a plain-language commission disclosure will appear clearly with the relevant content.
A general-audience resource
You can explore without providing a name, date of birth, photo, or email address. Use a generic reference height whenever a real person’s measurement is unnecessary.
I do not provide user accounts or a system for collecting personal records. Keep personal details out of comparisons and shared notes. The comparison guide explains how to preserve measurement context without adding personal information.
Your choices and rights
Clear this site’s data through your browser settings to remove the saved height. You can use the comparison tool without saving a personal height. Clearing browser data does not erase exported files, shared copies, or infrastructure logs.
Depending on where you live and the processing involved, you may have rights to access, correct, delete, restrict, object to, or obtain a copy of personal information, withdraw consent, or complain to a privacy regulator. Contact me to exercise applicable rights. I will use proportionate verification and will not ask for unnecessary identity information.
I use information only as needed to provide requested functionality, protect the service, meet legal obligations, and respond to requests; where applicable these purposes rely on providing the requested service or legitimate interests in secure operation. Optional uses requiring consent will rely on that consent. Hosting and email providers may process information outside your country. My review of their processing locations and applicable transfer safeguards is ongoing.
Retention, security, and updates
Saved browser data follows the retention described above. I keep contact messages only as long as needed to resolve the request and any applicable legal obligations. I will publish confirmed infrastructure retention details as the review is completed.
I use technical safeguards appropriate to the service, but no website or transmission can be guaranteed completely secure. Material changes to data use will be reflected here before the new processing starts, with additional notice or consent when required. The revision date appears above.