TokenScale is built privacy-first. The text you paste into the calculator never leaves your browser, we don't use advertising cookies, and we never sell your data. This page explains exactly what is and isn't collected — and your rights under European law.
TokenScale (tokenscale.dev) is operated by Bilton Projects (Will Bilton), the "data controller" for the purposes of the EU General Data Protection Regulation (GDPR) and the UK GDPR. You can reach us about anything on this page at will@biltonprojects.com.
The token calculator runs entirely in your browser. When you paste an email, a prompt, or a whole document, the character, word and token counts are computed by JavaScript on your own machine. That text is never transmitted to any server — not ours, not a third party's. Your background/theme choice is stored locally on your device (in your browser's localStorage) so the site remembers it next time; it never leaves your browser and isn't visible to us.
To understand which features are useful, we use two privacy-preserving measurement tools. Neither uses cookies, neither fingerprints you, and neither can identify you as an individual:
localStorage — it contains no identifier and no history, and the only thing reported is the word "new" or "returning"; you can clear it at any time by clearing your browser data. If you arrive via a link that carries a campaign label (for example ?from=newsletter), we record that label — it describes the link that was shared, not you. We also note a coarse device type — whether the visit was on a desktop, tablet, or phone — worked out from your browser's user-agent as one of three broad buckets; we never store the full user-agent string or anything that identifies your specific device. We record the host of the page that referred you (for example google.com, or "direct" if you typed or bookmarked the address) — the hostname only, with any path or query stripped away so nothing personal in a referring link is ever seen, and visits from our own pages are marked simply "internal". Within the calculator, we distinguish at a coarse level whether someone moved a slider or switched a control versus typed or pasted their own text into the live counter — as everywhere else, the pasted text itself is never read or sent; only the fact that a paste happened. These events are sent to our own endpoint and aggregated using Cloudflare Analytics Engine, where they are retained only for a limited period (around 90 days).The lawful basis for this anonymous measurement is our legitimate interest in understanding and improving the site (Article 6(1)(f) GDPR). In our assessment, because it places nothing on your device, uses no cookies, and records no stored or cross-visit identifier, it does not require prior consent under the ePrivacy rules. The opt-out is built into the request itself: if your browser sends a Do Not Track or Global Privacy Control signal, the script does not send any of these events — you can confirm this in the page source. And because the measurement stores nothing that identifies you, there is no individual record for us to find, change, or switch off separately.
Like every website, our host — Cloudflare Pages — automatically processes limited technical data (such as your IP address and browser type) in order to deliver pages to you and to protect the site against abuse and attacks. We rely on our legitimate interest in running a secure, working website as the lawful basis for this. We don't use these logs to build profiles of visitors.
We keep our own systems to a minimum and rely on a small number of vetted providers who act only on our instructions as data processors under a data-processing agreement: Cloudflare (hosting, security, and the anonymous analytics described above) and, only if you sign up, Beehiiv (newsletter). Some processing may take place outside the EEA/UK; where it does, it is covered by the European Commission's Standard Contractual Clauses (or an equivalent safeguard) through these providers' data-processing terms.
The site's typefaces are self-hosted: every font file is served directly from tokenscale.dev, so displaying the site sends no request to Google Fonts, Fontshare, or any other outside service, and your IP address is never shared with a font provider. The fonts are licensed for self-hosting — the Google families under the SIL Open Font License, and Clash Display under the Fontshare licence.
If you choose to enter your email address in the signup form, we use Beehiiv to store your address and send you the updates you signed up for. The lawful basis is your consent, which you can withdraw at any time using the unsubscribe link in any email. The signup form is provided by Beehiiv and may set its own cookies; see the Beehiiv privacy policy for details. If you never use the form, we never receive your email.
TokenScale sets no advertising or cross-site tracking cookies. The site itself uses only local browser storage to remember your preferences and interface state — such as your theme, text size, which panels you've opened or closed, and a single anonymous yes/no note that you've visited before (described under analytics above) — never to track or profile you, and our analytics are cookie-free. The only cookies that may be set are those from the Beehiiv newsletter form, and only if you interact with it.
We use Google Search Console to see which search queries lead people to the site. This is verified at the domain level and adds no tracking code, cookies, or visitor-data collection to TokenScale itself — it only reports anonymised, aggregated search statistics to us.
If you're in the EU or UK, you have the right to access, correct, delete, or receive a copy of any personal data we hold about you, and to object to or restrict its processing. In practice the only information that identifies you personally is a newsletter email address you chose to give us; the anonymous usage measurement described above isn't linked to your identity, so there's no individual record of you in it to retrieve or erase. To exercise any of these rights, just email will@biltonprojects.com. You also have the right to lodge a complaint with your local data protection authority.
TokenScale is a tool for developers and businesses and is not directed at children. We don't knowingly collect personal data from anyone under 16.
If we change what we collect, we'll update this page. Last updated: 7 July 2026 — added a coarse device type (desktop, tablet or phone), the referring page's host (hostname only, path and query stripped; our own pages marked "internal"), and a finer split of calculator use (moving a slider or control versus pasting your own text — the text itself is still never sent), all described under analytics above. Previously (5 July): added coarse, anonymous Model Graveyard events (which filter/section was chosen and whether the "Share view" link was used; a search term is never recorded), described under analytics above. Previously (4 July): added coarse, anonymous engagement events (the energy-usage lens being opened, a content-size button being pressed, a reader still being on the page after 30 seconds, and the overnight price-moves strip being clicked) and "help me choose" guide events (what was picked and which model it suggested), described under analytics above. Previously (3 July): added a single anonymous "been here before" note in your own browser (reported only as new/returning) and campaign-link labels (?from=…), both described under analytics above. Previously (26 June): web fonts became self-hosted, so displaying the site sends no request to Google Fonts or Fontshare and your IP address is never shared with a font provider.