Privacy Policy

Last updated: 2026-06-04 · Applies to: krutils.com/main (English-language tools)

At a glance

No sign-up or login. We do not collect names, emails, addresses, phone numbers, or any directly identifying information.
Calculator inputs live only inside your browser's localStorage; nothing is uploaded to our servers.
Analytics (Google Analytics 4) are currently active and set the _ga and _ga_J9WLSGMNMF cookies to collect anonymous pageview stats only.
The AdSense site-verification script (adsbygoogle.js) currently loads, but no ad units render and no ad cookies (__gads, __gpi, etc.) are set. Ads activate only after Google AdSense approves this site.
Visitors from the EEA, UK, and Switzerland see a Funding Choices (GDPR) consent banner.

1. What we collect

kr-utils (the "Service") does not require accounts and does not collect names, emails, phone numbers, addresses, ARN/RRN numbers, bank account numbers, or any other directly identifying information on our servers. Every value you type into a tool — gross salary, address, visa expiration, ARC number, customs declaration value, etc. — is handled in one of the two ways below.

1.1 Browser-local storage (localStorage)

To improve usability across visits, some tools remember a few of your last-used settings in your browser's localStorage. All keys use the uk: prefix and are partitioned per tool. Examples:

uk:bmi-calculator — last selected sex on the BMI tool
uk:foreigner-tax — last entered salary range and visa type
uk:visa-expiration — saved visa expiration dates for the tracker
uk:loan-repayment — last entered loan terms (principal, rate, term)

This data stays inside your browser and is never transmitted to us or any third party. You can wipe it any time via your browser settings → Cookies and site data → Clear data for krutils.com.

1.2 In-memory processing only (nothing transmitted)

Values you type for an actual calculation (e.g., salary into the foreigner tax calculator) are processed entirely by the JavaScript engine inside your browser and then discarded. They are not transmitted to our servers and not logged anywhere.

2. Third-party services and data processors

Currently active third-party services:

Cloudflare, Inc. (USA) — static hosting, CDN, and edge-level WAF. Connection IP, User-Agent, Referer, and request timestamps are processed transiently for security and traffic analysis. See the Cloudflare Privacy Policy.
Google Analytics 4 (Google LLC, USA) — currently active (measurement ID G-J9WLSGMNMF): on the production domain (krutils.com), gtag.js loads automatically on page load and sets the _ga and _ga_J9WLSGMNMF cookies to collect anonymous pageview, session-duration, and bounce-rate stats. IP anonymization is on by default (last octet zeroed). No advertising identifier (ad_id) is collected, no User-ID is set, and Demographics & Interests reports are disabled. Retention: user-/event-level data 14 months. See the Google Privacy Policy · GA opt-out extension.
Google LLC (USA) — AdSense site ownership verification: every page's <head> contains a <meta name="google-adsense-account" content="ca-pub-1005049417920340"> tag. To support this verification, the site-verification loader (adsbygoogle.js) currently loads. However, no ad units (ins.adsbygoogle) render and no ad cookies (__gads, __gpi, NID, IDE) are set, because no ad slot ID is configured. See the ad cookie policy.

Planned for activation after AdSense approval (ads not yet served):

Google AdSense ad units and ad cookies — after approval, once an ad slot ID is configured, ad units begin to render. From that moment, ad cookies (__gads, __gpi, NID, IDE) are set, and Google will process IP, ad identifiers, and page context for ad delivery, frequency capping, invalid traffic protection, and relevance. (The site-verification loader above already loads, but ad serving and ad cookies are activated only at this stage.)
Google Funding Choices (CMP) — a GDPR-compatible consent banner shown to visitors with IP addresses in the EEA, the UK, and Switzerland. Before consent, only non-personalized ads (NPA) are shown; if you refuse consent, the rest of the site continues to work normally.

International data transfers: GA4 and AdSense processing happens on Google's global infrastructure, primarily in the United States. EU/UK visitors can refuse via the Funding Choices banner or block via the GA opt-out extension or a content blocker.

3. Cookies and similar technologies

The Service itself (our tool code) sets no cookies. Cookies are set only via third-party services. Their current status is as follows:

Cookies currently set (active):

_ga, _ga_J9WLSGMNMF — GA4 session and visitor identification (up to 2 years). Currently set for all visitors.

Cookies not yet set (set once ads begin serving after AdSense approval):

__gads, __gpi — AdSense ad delivery (up to 13 months). Not created while no ad slot is configured.
NID, IDE — general Google advertising (on google.com / doubleclick.net, up to 2 years). Not created yet.
FCNEC, FCCDCF — Funding Choices CMP consent state (up to 13 months). Set for EEA / UK / Switzerland visitors once the CMP is active.

How to block or remove cookies:

Browser settings — Chrome, Safari, Firefox, and Edge all let you block cookies per-domain via "Cookies and site data".
GA opt-out — install the official Google Analytics opt-out extension.
Content blockers — uBlock Origin, AdGuard, Ghostery, and similar browser extensions.
DNT / GPC — Do Not Track and Global Privacy Control signals are auto-detected, but they restrict personalization rather than ad serving as such.

4. Children

We do not knowingly collect personal data from children under 14 (per Korea's PIPA §22-2). The Service has no age-verification mechanism and stores nothing server-side, so there is no targeting of minors. Parents and guardians who want to limit access for younger children should use browser parental controls (Family Link, Screen Time, etc.) at the device level.

5. Your rights and how to exercise them

kr-utils stores no personal data on its servers, so there is nothing to access, correct, or delete on our side under PIPA §35-37 or GDPR §15-21. However, you can exercise rights against the third-party data processors directly:

GA4 data deletion — use the Google Analytics user-deletion form.
AdSense ad personalization — manage at Google Ads Settings.
EEA / UK residents (GDPR & UK GDPR) — rights to access, rectify, erase, restrict, port, and object can be exercised through the Funding Choices CMP ("Manage preferences") or by contacting Google as data controller for the analytics/ad data.
California (CCPA / CPRA) — kr-utils does not "sell" or "share" personal information as those terms are defined under CCPA. Right-to-know and right-to-delete requests for third-party data should go to the relevant processor (Google).

localStorage data can be cleared from your browser settings at any time — no operator action is required.

6. Data security

HTTPS everywhere — every page and static asset is served over TLS via a Cloudflare-issued certificate.
No server-side database — the site is statically generated and hosted on Cloudflare Workers Static Assets. There is no database, no session store, and no user record to compromise.
Content Security Policy — external scripts are restricted to Google domains (googletagmanager.com, googlesyndication.com) to mitigate XSS.
Vulnerability reporting — please report any security issue to support@krutils.com. We aim to acknowledge within 72 hours.

7. Changes to this policy

If we change this policy, we will:

Update the "Last updated" date at the top of this page;
For material changes (new data categories, new third parties, longer retention), give 7-day advance notice on the home page or via a banner at the top of this page;
You may stop using the Service if you disagree with the changes; clearing localStorage from your browser is sufficient — no operator action is required.

8. Contact and privacy officer

Privacy questions, deletion requests, and general inquiries: support@krutils.com

Privacy officer: site operator (reach via the email above)
Response time: typically within 48 business hours
Use the same channel for ad-related concerns, content corrections, feature suggestions, and security disclosures

If you live in Korea and want to report a privacy violation, you can also contact the Korea Internet & Security Agency (KISA) Privacy Reporting Center (☎ 118, privacy.kisa.or.kr) or the Personal Information Protection Commission (pipc.go.kr).

9. About the operator

krutils.com is an independent, individually operated free utility site based in South Korea. It serves two audiences in parallel: Korean residents through utilkit (Korean-language tools) and foreign residents of Korea through kr-utils main (English-language tools and guides). All tools work without sign-up or login.

Site name: krutils.com (utilkit · kr-utils main)
Operation type: individual operator (no registered business entity)
Operating region: Republic of Korea
Started: April 2026 — single-domain consolidation in May 2026
Responsible person / privacy officer: site operator (reach via the email above)
Revenue model: Google AdSense ads (activates after review approval)

Because there is no registered business entity in Korea, no business registration number or mail-order business number is displayed. The tools are for informational purposes only — they are not legal, tax, immigration, or medical advice. See the disclaimer on each tool page.

10. Governing law

This Privacy Policy is drafted in accordance with Korea's Personal Information Protection Act (PIPA, 2024 amendment). For EEA and UK residents, the relevant provisions of the General Data Protection Regulation (Regulation (EU) 2016/679 and the UK GDPR) also apply. Disputes related to this policy are governed by the laws of the Republic of Korea.