Legal

Privacy Policy

Last updated: 2026-07-20

This privacy policy explains what data PrintablesWorld collects, what we do with it, and the rights you have over it. We aim to keep this page short and in plain English. If anything is unclear please get in touch at contact@brightscalelabs.com.

1. Who we are

PrintablesWorld is operated by Brightscale Labs Limited, a company registered in England and Wales (company number 16990009), whose registered office is at 8 Flay Field, Tithebarn, Exeter, England, EX1 3YA. Brightscale Labs Limited is the data controller for the purposes of the UK GDPR and is contactable at contact@brightscalelabs.com.

2. What data we collect

PrintablesWorld is a static website that generates printable PDFs in your browser. We are deliberately light on data collection.

• Technical request data. When you visit a page, our hosting provider (Cloudflare) automatically receives your IP address, browser user-agent, the page you requested and a timestamp. This is standard web-server logging and is used only to keep the site online and protect it from abuse.
• Rate-limit counter. To stop automated scrapers downloading thousands of PDFs, we count how many times each IP address requests a download permit during a single UTC day. The count is stored in Cloudflare KV keyed by a SHA-256 hash of the IP address (not the raw IP) and auto-deletes after 25 hours.
• Turnstile verification. Each download triggers Cloudflare Turnstile (a privacy-focused CAPTCHA alternative). Turnstile inspects non-personal signals from your browser to decide whether you are human. It does not track you across sites and does not set persistent advertising cookies.
• Local preferences. If you pin tools in the sidebar, toggle dark mode, or adjust the dashboard font size, those choices are saved to your browser's localStorage. They stay on your device and are never sent to our servers.
• Messages you send us (optional). If you use the contact form or the "Report a problem" button, we receive the name, email address, topic, subject and message you type in, so that we can reply. The form is protected by Cloudflare Turnstile, and the message is stored in our support inbox (a Brightscale Labs system shared across our sites) until the matter is closed. We use these details only to answer you — never to market to you, and never added to a mailing list. You can email us directly instead if you prefer not to use the form.
• Our own usage statistics. Separately from Google Analytics, we keep a small first-party record of how the tools are used, so we can see which printables are worth building next. When you open a tool page and when you generate a PDF, we record one row containing:
  • which tool and category it was, the action (viewed or downloaded), the paper size and the page language;
  • the filename of the PDF that was generated (see the note below);
  • your country and city, worked out by our host Cloudflare from your connection — we never see or store your IP address itself;
  • whether you're on mobile or desktop, your browser window size, your timezone offset, light/dark theme, the page you arrived from, and how long you were on the page before generating;
  • the date and time.

  These rows are tied together by a short-lived visit id that lets a page view and the download that follows it count as one visit. It is not a cookie — it lives only in the page's memory, is never written to your device, and is gone the moment you navigate away or close the tab. We cannot use it to recognise you on a later visit, and it is never linked to your name or email.

  Please note: in the worksheet editor, the title you give a worksheet becomes part of its filename, and that filename is stored in the record above. So please don't put a child's full name, or anything private, in a worksheet title — put it in the worksheet body instead, which is never sent to us. Nothing else you type into a tool is recorded, and we never store the PDF itself or anything printed inside it.

Our legal bases (UK/EU GDPR). We rely on consent for advertising and analytics cookies (you can withdraw it at any time via Cookie preferences in the footer); legitimate interests for keeping the site online and secure, which covers server logs, Turnstile and the rate-limit counter; and legitimate interests in answering correspondence for the messages you choose to send us. Our own usage statistics also rest on legitimate interests — the interest being to understand which printables are used so we can improve them. They involve no cookie and no lasting identifier, so no consent is required for them. If you would rather not be counted at all, turn on Global Privacy Control in your browser — we check for it and skip the record entirely. You can also object at any time under section 8.

3. What we do not collect

• No account system — there is no sign-up, no password, and no email wall. Every tool works without telling us who you are. (The only time we ask for a name and email is if you choose to write to us, as described above.)
• No Facebook / Meta tracking pixel and no advertising pixels from any social network.
• We never sell your personal data for money. Note that some US state privacy laws (California's CPRA and similar) treat using data for personalised advertising as "sharing" — which, with Google Signals enabled, applies to us. You can opt out at any time through Cookie preferences in the footer, or by turning on Global Privacy Control in your browser, which we honour.
• No logging of what you type into a worksheet — names on certificates, recipe ingredients, spelling lists and every other field stay in your browser and go straight into the PDF. (The one exception is a worksheet's title in the editor, because it forms the download's filename, which we do record — see section 2.)
• No copy of the PDFs you generate. The file is built in your browser and downloaded straight to your device; we store a record that a PDF was made and its filename, never the document or its contents.
• No cloud storage of your work. Worksheets you build in the worksheet editor are held in your own browser and never uploaded to us — there is no "save to cloud", no share code, and no copy of your work on our servers.

4. Cookies

Aside from the strictly-necessary cookies described at the end of this section, the optional cookies on PrintablesWorld come from Google AdSense (which keeps the site free), Google Analytics and Microsoft Clarity.

In short: in the EEA, the UK and Switzerland none of them store anything on your device until you agree in the consent message. Elsewhere, where the law is opt-out rather than opt-in, they are on by default and you can switch them off at any time through Cookie preferences in the footer. The detail for each one follows.

Google AdSense. We show ads served by Google AdSense. Google, as a third-party vendor, uses cookies (including the DoubleClick / Google ad cookies) to serve ads based on your prior visits to this and other websites, and may collect information such as your IP address and device/usage data. If you are in the EEA, the UK or Switzerland, our consent management platform (InMobi Choice) shows a consent message and Google only personalises ads with your consent; you can also opt out of personalised advertising at Google Ads Settings, or opt out of third-party vendors at aboutads.info/choices. How Google uses data when you use our site is described at policies.google.com/technologies/partner-sites.

Google Analytics 4. We use Google Analytics to count visits and see which printables are popular, so we know what to build next. It sets Google's _ga analytics cookies (up to two years) and processes your IP address and device/usage data. We run it with Google Consent Mode: if you are in the EEA, the UK or Switzerland, no analytics cookie is set and no identifier is stored unless you consent through the InMobi Choice consent message — before that, Google receives only aggregated, cookieless measurement pings. We never send Analytics the content you type into a tool.

Google Signals. With your consent, we enable a Google Analytics feature called Google Signals. If you are signed in to a Google account and have turned on Google's own Ads Personalization setting, it lets us see aggregated reports about the age range, gender and interests of the people using our printables, and recognise that the same person visited from more than one device. It also means your visit can be used to personalise the ads you are shown, and to build advertising audiences.

This only happens after you agree: in the EEA, the UK and Switzerland nothing is stored or personalised until you accept in the consent message, and you can withdraw at any time via Cookie preferences in the footer. Elsewhere it is on by default and the same link switches it off. You can also turn Ads Personalization off for your whole Google account at My Ad Center, which stops it everywhere, not just here. We only ever see grouped reports — Google never shows us who you are.

Microsoft Clarity. Clarity records aggregated heatmaps and anonymised session replays to help us see where a tool is confusing, and sets two cookies: _clck (about a year) and _clsk (session). Text you type into a tool is masked before anything is sent, so the values you enter are not captured. How it is switched on depends on where you are:

• In the EEA, the UK and Switzerland Clarity loads only if you consent through the InMobi Choice consent message. If you refuse, or simply close the message without deciding, the Clarity script is never added to the page at all — no cookie is set and no request reaches Microsoft.
• Everywhere else — where privacy law works on an opt-out rather than an opt-in basis — Clarity loads by default, but we honour opt-out signals: if your browser sends Global Privacy Control (recognised as a legal opt-out in California, Colorado, Connecticut and other US states) or a US Privacy signal indicating you have opted out, Clarity stays off.

Either way you can turn it off at any time using the Cookie preferences link in the footer; withdrawing consent tells Clarity to drop its cookie and end the session. See Microsoft's Privacy Statement.

Consent management (InMobi Choice). Your advertising and analytics consent choices are collected by InMobi Choice, a certified consent management platform, and recorded in cookies on this site: euconsent-v2 (your IAB Transparency & Consent Framework choices), IABGPP_HDR_GppString (US state privacy signals) and usprivacy, each stored for up to 13 months. These let advertising partners read and honour your choices. See InMobi's Privacy Policy.

Separately, Cloudflare may set a small number of strictly-necessary cookies for bot protection and performance (for example __cf_bm); these cannot be disabled without breaking basic site functionality.

5. Third parties

• Google provides AdSense (the ads that keep the site free) and Google Analytics (visit measurement), and may set advertising and analytics cookies and process your IP and device data as described above. Google's privacy policy: policies.google.com/privacy.
• Cloudflare hosts the site, provides the CDN, SSL, DDoS protection and the Turnstile verification service. Cloudflare's privacy policy: cloudflare.com/privacypolicy.
• Microsoft provides Clarity (heatmaps and session replay), loaded only after you consent via the InMobi Choice consent message. Microsoft's privacy statement: privacy.microsoft.com.
• InMobi provides the Choice consent management platform that collects and records your cookie choices. InMobi's privacy policy: inmobi.com/privacy-policy.
• GitHub hosts our source code. Visiting this website does not send any data to GitHub.

We do not sell your personal data, and we do not share it with anyone beyond the providers listed above.

6. Where your data goes

We are based in the United Kingdom, but the providers above operate globally, so some of the data described in this policy is processed outside the UK and the European Economic Area — in particular by Google, Microsoft, Cloudflare and InMobi in the United States. Where that happens, those transfers are covered by the safeguards the UK and EU recognise for international transfers: the EU-US Data Privacy Framework and its UK extension, and/or the Standard Contractual Clauses together with the UK International Data Transfer Addendum. Each provider's own privacy policy, linked above, sets out the mechanism it relies on.

7. How long we keep data

• Web-server logs (at Cloudflare): retained per Cloudflare's standard policy, typically a few days.
• Rate-limit counters (hashed IP): automatically deleted after 25 hours.
• Our own usage statistics (section 2): kept for 12 months, then deleted.
• Messages you send us through the contact form or by email: kept while we deal with your query and for up to 24 months afterwards, so we have the history if you write again — then deleted. Ask us and we'll delete yours sooner.
• Advertising, analytics and consent cookies: for the periods listed in section 4 above, or until you clear them or withdraw consent.
• LocalStorage preferences on your device: kept until you clear your browser storage.

8. Your rights

Under the UK GDPR you have the right to access, correct, erase or restrict processing of personal data we hold about you, to object to processing, and to data portability. Where we rely on consent, you can withdraw it at any time via Cookie preferences in the footer. Because we don't run an account system, in most cases the only personal data we hold is transient server-log IP addresses — and, if you have written to us, your message and the contact details you gave us. To exercise any of these rights, email contact@brightscalelabs.com with the subject "Privacy request".

You also have the right to lodge a complaint with the UK Information Commissioner's Office (ico.org.uk) if you are unhappy with how we handle your data.

9. Children

PrintablesWorld produces material for children, but the site itself is built for and directed at adults — teachers, parents, homeschool educators and tutors, who choose the settings, generate the PDF and print it. It is not directed to children, and it is not intended for use by children under 13 without an adult.

We do not knowingly collect personal data from children. The whole site can be used without entering any personal data at all, and we ask that only adults use the contact form. If you believe a child has sent us personal information, email contact@brightscalelabs.com and we will delete it.

The printed worksheets a child fills in never come back to us: everything is generated in your browser and nothing you type into a tool is transmitted or stored.

10. Changes to this policy

We will update this page when our practices change. The "Last updated" date at the top always reflects the most recent revision.

11. Contact

For any privacy-related question, email contact@brightscalelabs.com.