Privacy policy

This policy explains what personal data SetupCheck handles, why, for how long, and which rights you have. In short, the tests run in your browser and never upload your camera picture, sound, keystrokes or results.

Who is responsible

Maciej Barta WebForge (Polish tax ID, NIP: 5842840051) runs SetupCheck and is the controller of the personal data described here. For anything about your data, write to hello@setupcheck.app.

What stays on your device

Camera pictures, microphone sound (including the short clip you can record in the microphone test), key presses, mouse clicks, gamepad input and every test result are processed in your browser only. The test code does not send them over the network, so we never receive them and have nothing to look up, correct or delete.

• Your browser asks for your permission before a test can use the camera or microphone. A test stops the camera or microphone when you stop it, hide the tab or leave the page.
• A photo from the webcam test or a clip from the microphone test is saved only if you choose to download it, and the file goes to your device.
• The refresh rate test reads your phone’s model name from your browser (navigator.userAgentData), on your device, to pick the manufacturer’s settings steps. The test does not send it anywhere.

This covers the tests themselves. The Google tools described below run on the same pages and are covered separately.

Settings saved in your browser

The site saves a few settings in your browser’s local storage, and the refresh rate test also uses session storage, which your browser clears when you close the tab. They are not cookies, they are never sent to us or to anyone else, and you can clear them in your browser’s site data settings. Clearing them resets your choices and personal bests.

Google Analytics, ads and the consent message

SetupCheck uses Google Analytics 4 to see which pages and tests are used, Google AdSense to show ads, and Google’s consent message to ask for your choice where it is shown. What is set depends on where you are, as described below.

Your choice

European Economic Area, United Kingdom and Switzerland. Analytics and advertising cookies start switched off. Google’s consent message asks you before they are set. The Google Analytics tag loads on every page, but until you agree to analytics it sets no analytics cookies and sends only cookieless signals (pings) without a client identifier, which Google uses to estimate visits (Google’s consent mode). You can change your choice at any time with the Privacy settings link in the footer (in regions where the consent message is shown). Withdrawing consent is as easy as giving it, and under Article 7(3) GDPR it does not affect the lawfulness of processing based on consent before it was withdrawn. The message follows the IAB Europe Transparency and Consent Framework. If you decline, every test works the same. The cookieless pings rest on our legitimate interest in basic measurement (Article 6(1)(f) GDPR), so you can object to them under Article 21 GDPR by writing to hello@setupcheck.app; the Google Analytics opt-out add-on linked below also stops the tag from sending them.

All other countries. Google’s consent message is not shown, and analytics and advertising cookies are on by default. Personalized ads are on by default too, and ad technology providers may receive data. Our legal basis there is our legitimate interest in measuring how the site is used and in paying for it with ads (Article 6(1)(f) GDPR). You can switch cookies and personalization off yourself at any time, with no reason needed:

• Block or delete cookies in your browser’s settings.
• Install the Google Analytics opt-out browser add-on.
• Turn off or change ad personalization in Google’s ad settings (My Ad Center).

You also have the right to object to this processing under Article 21 GDPR, on grounds relating to your particular situation, by writing to hello@setupcheck.app. We then stop the processing unless we can show compelling legitimate grounds for it that override your interests, rights and freedoms, or it is needed to establish, exercise or defend legal claims. Your objection to personalized ads (direct marketing) is absolute under Article 21(2)–(3) GDPR: you do not need to give a reason, and these exceptions do not apply.

Cookies

In the European Economic Area, the United Kingdom and Switzerland the Analytics cookies _ga and _ga_* are set only after you agree to analytics. The ad cookies appear only once ads are switched on, and ads stay off until Google approves the site. In those regions they also appear only after you agree to them. The lifespans of the Google cookies come from Google’s cookie list and can change.

What we use them for

• Analytics (your consent in the European Economic Area, the United Kingdom and Switzerland for analytics cookies and the identifier, and our legitimate interest in basic measurement before you agree; our legitimate interest elsewhere): to count visits and see which pages and tests people use, so we can improve the site. Google Analytics receives the page you view, how you got there, your browser, device and language, your approximate location and a random identifier kept in the cookie. Before you agree in those regions it receives only cookieless pings without that identifier, which Google uses to estimate visits. Google states that Analytics does not log or store IP addresses. We set Analytics to keep its data for 14 months after your last visit, after which it is deleted automatically. Reports that only show totals can be kept longer.
• Ads (your consent for personalized ads in the European Economic Area, the United Kingdom and Switzerland; our legitimate interest elsewhere): to show ads that help pay for the site. Without your consent, Google may still show limited ads. They rely on the page you are on and your IP address, not on ad cookies or your browsing history, and we rely on our legitimate interest in paying for the free site.
• The AdSense code and the consent message: the Google AdSense code loads from Google’s servers on every page, from your first visit, because it shows the consent message and lets Google verify the site. When it loads, Google receives your IP address and browser details, whatever you choose. Ad units and ad cookies come only once ads are switched on (they stay off until Google approves the site) and, in the European Economic Area, the United Kingdom and Switzerland, only with the consent the message asks for. We use the message to ask for and record your choice where it is shown.

If you decline in the European Economic Area, the United Kingdom or Switzerland

The Google Analytics tag still loads, also before you make a choice, but until you agree to analytics it sets no analytics cookies and sends only cookieless pings without a client identifier, which Google uses to estimate visits (consent mode). No ad cookies are set either, and apart from the cookies of the consent message itself, Google sets none. Google still receives your IP address and browser details, with the pings and to show the message and any limited ads.

Google as a recipient

The recipients are Google Ireland Limited and Google LLC (United States). Other ad technology providers that Google works with may also receive data to show and measure personalized ads. In the European Economic Area, the United Kingdom and Switzerland this happens only after you agree to personalized ads, and the consent message lists the providers. In all other countries personalized ads are on by default and these providers may receive data, and you can turn personalization off in Google’s ad settings (My Ad Center) or by blocking cookies in your browser. Google LLC takes part in the EU–US Data Privacy Framework, under which the European Commission has found that personal data sent to participating US companies is adequately protected. For analytics Google acts on our behalf. For ads, Google is a separate controller. How it uses data to show and measure ads is explained in its privacy policy and its page on how it uses data from sites like this one.

Server logs

SetupCheck is hosted and delivered by Cloudflare. When you open a page, Cloudflare’s servers handle the request and record technical data such as your IP address, the page asked for, the date and time, your browser type and the response. We use this to deliver the site, keep it secure and fix faults, not to identify individual readers. Cloudflare keeps these logs as its privacy policy describes. If its bot protection is on, Cloudflare may also set a short-lived security cookie, __cf_bm, that distinguishes humans from bots and expires after about 30 minutes (see the cookie table above).

Email

If you write to us, we use your email address and what you wrote to answer you, and to deal with any follow-up. Please do not send passwords, payment details or other sensitive information.

Purposes and legal bases

You can object to processing based on our legitimate interest, as described under your rights below.

Who receives data

• Cloudflare, which hosts and delivers the site.
• Google Ireland Limited and Google LLC, for analytics, ads and the consent message, as described above.
• Ad technology providers that Google works with, for personalized ads: after you agree in the European Economic Area, the United Kingdom and Switzerland (the consent message lists them), and by default in all other countries.
• Our email provider, which handles the mailbox behind hello@setupcheck.app.
• Public authorities, where the law requires it.

We do not sell personal data. Cloudflare and Google may process data in the United States and other countries outside the European Economic Area. Google LLC and Cloudflare, Inc. rely on the EU–US Data Privacy Framework and on standard contractual clauses. Email sent to hello@setupcheck.app is forwarded by Cloudflare Email Routing to a Google (Gmail) mailbox.

How long we keep data

• Test data: we do not receive or store it.
• Local storage: until you clear it in your browser.
• Session storage: until you close the tab, at most an hour for the refresh rate reading.
• Cookies: for the lifespans in the table above, or until you delete them.
• Google Analytics data: 14 months after your last visit. Reports that only show totals can be kept longer.
• Cloudflare’s logs: as Cloudflare documents.
• Email: as long as needed to deal with your message and any follow-up or claim, then deleted.

Your rights

You have the right to access your data, have it corrected or erased, restrict its use, and object to processing based on our legitimate interest, including the analytics and ads described above for visitors outside the European Economic Area, the United Kingdom and Switzerland, and the cookieless pings in those regions before you agree to analytics (the ways to object are listed under “Your choice”). Where processing rests on your consent, you can withdraw it at any time and, where the law provides, receive the data you gave in a portable format. To exercise these rights, write to hello@setupcheck.app. We may ask you to confirm who you are.

If you think your data is handled unlawfully, you can complain to the President of the Personal Data Protection Office in Poland (Prezes Urzędu Ochrony Danych Osobowych, PUODO) or to the data protection authority in the country where you live or work. The European Data Protection Board keeps a list of the authorities.

Giving us personal data is voluntary. We do not take decisions about you based solely on automated processing that have legal or similarly significant effects.

Changes to this policy

We change this policy when what we do with data changes, for example when a new tool stores something in your browser or when we add a new service. This version is dated October 8, 2026.