Privacy Policy

Privacy while you browse: server logs, calculators and result files

The site is served via Cloudflare, which processes standard server logs (IP address, user agent) for security and delivery; see Cloudflare’s privacy documentation for details. Calculators run entirely in your browser — the numbers you enter never leave your device. A file of your own result — a loading plan, a volume calculation, a container number summary — is likewise made on your device and is not sent to us.

If you ask for that result by email, the figures of the result travel with your address and are kept with it for twelve months: the dimensions, quantity and weight you entered, the container, or for a loading plan its totals (containers, pieces, fill and what was left out), never the cargo list; for a container number summary only the owner code we already publish, never the number itself.

A volume calculation or a pallet plan sent by email is drawn on our server from those figures and attached to the letter.

What your browser keeps: local and session storage

Some tools remember things in your browser’s own storage: local storage, which stays until you clear it, and session storage, which is gone when you close the tab. None of it is a cookie, and none of it is sent to us unless this paragraph says so. The site keeps the colour theme you chose (theme). The tracking tool keeps the last five container numbers you checked, so that you can pick one again (contsize.tracking.recent.v1); they stay in this browser and are never sent.

The load calculator keeps the list you are working on, so that it is still there when you come back (load-plan-draft), the fact that you have seen its three-step tour (load-tour-seen), the products and plans you save (contsize.load.products.v1, contsize.load.plans.v1), the freight rates and currency you typed, which the LCL-or-FCL calculator shares (contsize.load.rates.v1), the company name and logo you put on its documents (contsize.brand.v1) and, in loading mode, the pieces you ticked off and when, with the container and seal numbers you typed (contsize.loading. followed by a code for the plan); all of this stays in this browser.

Its share link carries the list in the part of the address after the # sign, which browsers do not send to any server. The demurrage free-time clock keeps the tariff you typed (contsize.freetime.v1), never the dates.

For the offers, the site keeps the day of your last visit, a count of the days you have visited, a count of container numbers checked (never the numbers) and when you last closed an offer, so that an offer you declined stays away for thirty days (contsize.offergate.v1); a mark that this visit has already been shown one (contsize.offergate.visit, in session storage); and, once you have given an address, a note of that so the site does not ask again (contsize.subscribed.v1).

As you browse, session storage also notes the first page of the visit, the site you came from, when the visit began and the pages opened since (contsize.visit.v1), and local storage keeps the day of your first visit, the site and page it began on and its campaign tags (contsize.first.v1). These last notes and the two counts — days visited and numbers checked — are read only when you send a form: they go with it and are kept with the request, as described below.

Three aggregate counters, and what each one counts

We keep three aggregate counters, and nothing else.

One records, per day, how many visits arrived from each referring site and which page they landed on, how many times each page was opened from another page of this site and from which, how many visits arrived with campaign tags in the address (utm_source, utm_medium and utm_campaign, or an advertising platform’s click identifier, of which only the platform is kept, never the identifier itself) and which page they landed on, and how many requests came from automated crawlers, by the crawler’s name.

For the AI companies whose crawlers we recognise — OpenAI, Anthropic and Perplexity — the name also says which of their crawlers it was, where the company names more than one: the one that gathers pages for training, the one that builds their search index, or the one that fetches a page while it answers someone’s question (for example bot:openai-train, bot:openai-search and bot:openai-user, the same three for Anthropic, and bot:perplexity-index and bot:perplexity-user for Perplexity, which names no training crawler); nothing about the person who asked the question reaches us.

A visit that arrives with an AI assistant’s campaign tag in the address — such as utm_source=chatgpt.com, which ChatGPT adds to the links it gives — is counted as a visit from that assistant rather than as a direct one, with the landing page and nothing else. To tell a crawler from a reader we look at the browser’s user-agent header while the page is being served; it is not stored.

When you point at or touch a link to another page of this site, your browser may fetch that page in advance; that fetch is not counted, and if you then open the page, the page sends us one note so that the visit is counted all the same, carrying only its address and the page you came from, and counted as above.

The second records, per day, how many times the tracking tool was used and what it answered — a valid number, a wrong check digit or a wrong format, a bill of lading or booking number instead of a container number, an owner that is a shipping line, a lessor or unknown, and which owner in our directory when it is there — whether the example number was used, which of its buttons were pressed (open the tracker, open our page on that line, copy the number, pick a line from the list, read how to track by bill of lading) and whether its working was opened.

When the owner prefix of a container number is one our directory does not recognise, that counter also stores the three-letter owner code — a public company identifier from the BIC register, shared by thousands of boxes — so that we can add the missing company.

When a whole list of numbers is checked at once, the counter records that it happened and how long the list was, as one of four sizes (1, 2–5, 6–20, 21–50); the numbers themselves are checked in your browser and are not sent to us.

For the load calculator it records, per day, how many plans were made and whether everything fitted in one container, in several, or not at all, how often the 3D view was opened and how often a picture of the plan was saved, and how many people came to it from the home page or the calculators page and then made a plan, by which of those pages’ links they used, and, as one word each, how a list came in (pasted, from a spreadsheet or text file, from a PDF packing list, from the products saved in your browser), what was taken away (a PDF, a print, a spreadsheet, a CSV file, a picture, a link, a view-only link, the loading report or the VGM form), and how often pallets were built first or costs compared — never a size, a weight, a file name or a name of what you load; one more count is set aside for the planner shown on another site, and nothing sends it yet.

The check digit calculator, the demurrage free-time clock, the LCL-or-FCL calculator and the VGM calculator each add one to a daily count when used (and the VGM one when its form is printed); what you typed into them — a number, a date, a rate, a weight — is worked out in your browser and never sent.

On the subscribe page, the door check adds one when used and one is added when a page of the pack is opened at full size, and one when the sample sheet is opened before signing up; the sizes you type into the door check stay in your browser. Opening the card beside a figure in a table, the one that lists the published sheets behind it, adds one to a daily count, with nothing about which figure.

Opening a drawing in the size chart’s table adds one to another daily count, with nothing about which container; printing the chart with its button, or opening its data as CSV or JSON from the links beside it, adds one to a count of its own, with nothing about which file.

For the email forms it records, per day and per offer and place on the page, how often a form was seen, started, sent or waved away (and, from older cached pages, how often the window shown on leaving a page was shown, closed or sent), how often a reader asked for the confirmation again, went back to change the address or opened their webmail from the “check your inbox” panel, and how many addresses were confirmed and files downloaded from a letter — never the address.

If you write to us in the planner’s “What is missing?” box, the text and the page you wrote it on go to our team’s chat and are kept nowhere else; the box asks for no email address.

We never store a container number: not the serial, not the check digit, not any part that could identify a shipment — not in these counters, and not with a request either: the page address kept with a request loses everything after the ? sign except campaign tags, so a number carried in a tracking link is dropped.

The third records, per day, how fast the pages were for readers: once a page has loaded, a small script of ours measures how long its main content took to appear (LCP), how quickly it answered a tap or a key (INP), how much it moved while loading (CLS) and when the first text and the first byte arrived (FCP and TTFB), and sends each measure once.

It keeps the range the time fell in (never the exact time), whether the screen was narrow, medium or wide, the kind of page (the home page, a size page, a guide, a calculator and so on — never its address), the slowest part of the wait or the kind of control that was tapped (a button, a field, a link), and which version of the site served the page.

A request for one of the files we publish for machines — llms.txt, its short and full versions and their copies in other languages, and the Markdown copies of pages — is counted in the first counter like a page: per day, the file’s address and the crawler’s name, or “direct”, and nothing else. All three counters store counts only — no cookies, no identifiers, no IP addresses.

What we keep when you leave an email address

If you ask for one of our files or subscribe to updates, we store the email address you give us, which file you asked for, the page you asked from and the time.

Each thing you ask for is kept as a request — what, from which page and which place on it, when, and whether and when it was sent; a request that has been delivered is marked as sent, not removed. How many forms one network may send in a minute is limited; the IP address is read for that and not kept for it.

With the request we keep its context. From the connection: your IP address and what Cloudflare derives from it (country, continent, region, city, postal code, coordinates and time zone), your network provider and its network number, the Cloudflare data centre that answered and the HTTP and TLS versions used.

From the request headers: your browser’s user agent and languages and, where the browser sends them, its name, its platform and whether it is a mobile. From the page: your screen size and pixel density, the size of the window, your time zone and languages, whether the screen is a touch screen and, where the browser reports them, its approximate memory and the speed class of its connection.

And how your visit reached the form: the site you arrived from, as its address without the part after the ? sign; the first page of the visit, as its path with any campaign tags and, for an advertising click identifier, only the platform — never the identifier and never any other part of the address; the pages you opened in that visit and for how long; the count of days you have visited and of container numbers you checked (never the numbers); and the day, first page and referring site of your first visit.

The browser notes these come from are described above, and are sent only with a form. We use this to understand who our readers are and which pages bring them; we never sell it, and no one receives it but the services named on this page.

When a request arrives, its address, what was asked for, the page and the context above (place, network, device) are posted to a private Telegram chat that only the editor reads, so that it is seen at once. Bots are kept away from the forms by Cloudflare Turnstile, which checks the browser when a form is sent; Cloudflare’s terms apply to that check.

Twelve months after a request, we erase its IP address, user agent and the rest of its context, clear the figures of a result sent with it and delete the request itself; on our record of each letter, the address is erased and the delivery events are deleted twelve months after they happened, and the dates of your last open and last click are cleared once they are twelve months old.

How we write to you, and how to stop it

We use the address to send what you asked for and, if you chose the monthly letter, to write to you when the data changes, at most once a month, and to show that you agreed to that. Before the first message you confirm the address once, from a link we email you; an address that is not confirmed within 30 days is deleted everywhere it was kept; only an anonymous count of it remains.

The monthly letter is a choice of its own: a form may ask only for a file, and we keep which you chose; you can turn the letter on or off on the settings page. On a Russian-language form we also keep when you gave the separate consent to the processing of personal data.

Messages are sent through Resend, Inc. (United States), which holds the address, the message and its delivery events for 30 days; on messages sent from news.contsize.com — the monthly newsletter and the letters about your subscription — we also measure whether a message was opened and which links were clicked, through a tracking address of ours, and we keep those delivery events for twelve months.

The founder’s photo at the end of every message is a plain file on contsize.com; fetching it is not recorded. With those events we keep the kind of refusal a mail server reported (permanent, temporary, blocked, refused as spam) and the words of its reply, and for a click the family of device it came from (phone, tablet or desktop), never the browser itself.

The editor may attach a note or a tag to an address for his own use, and may note your company and the trade lane you work on; he keeps the topics and the sending frequency you choose on the preference page, the time zone your browser reported when you asked, and, if you tell us, what you do in shipping.

An address the editor imports from a list you gave him elsewhere is stored as unconfirmed until you confirm it here. When an address is given, we ask a public DNS resolver (Cloudflare’s) whether its domain accepts mail at all; an address whose domain does not, or that belongs to a disposable-mail service, is kept but never written to.

Every message carries a one-click unsubscribe; an unsubscribed address is kept only as a do-not-mail record. When you delete your address from the preference page, every row that holds it is removed — the address and its choices, your requests with their context, results, topics and tags, the letters and their events — and only a do-not-mail record stays, under a one-way hash of the address, so that we never write to it again and a form later sent from that address starts nothing.

If you write to us instead, we delete it the same way and, if you ask, the do-not-mail record too, so that you can sign up again. An address whose server refused our mail for good, or that marked a message as spam, is kept as a do-not-mail record even after the rest is deleted, under a one-way hash of the address, so we never write to it again. Addresses left before 5 October 2026 were given under a promise of no newsletter, and we do not write to them.

Who is responsible, the legal basis and your rights

Who is responsible: ContSize, run by Yuri Kan, Eilat St 12, Holon 5830434, Israel, info@contsize.com. We keep an address on your consent, given on the form and confirmed by the link we email you; you can withdraw it at any time with the unsubscribe link in every letter. You may ask to see, correct, export or delete what we hold about you, and object to its use, by writing to info@contsize.com or from the settings page linked from any letter.

Its download button gives you, as one file, everything we hold on the address: the subscriber record with its consents and choices, your topics and tags, every request with its IP address, user agent and context, the results kept with them, the list of what you asked for and whether it was sent, the history of the address, and the letters sent to it with their delivery, open and click times.

We answer within 30 days; a request made under Russian law is answered within ten working days, as that law requires. If you think we handle your data wrongly, you may also complain to the data protection authority where you live.

If you write to us, and if this policy changes

If you email us, we use your address only to reply. This policy will be updated here if the site’s behaviour ever changes.