Privacy Policy

This Privacy Policy describes how PÚNYCODEX collects, uses, and handles information across all of its products and services. Because we operate distinct products with different data practices, this document is organized by product. Please refer to the section that corresponds to the service you are using.

Summary

Contents

1. Keyboard & Type Tool
2. Search Engine
3. Website
4. General Provisions

1. Keyboard & Type Tool

1.1 Zero Keylogging

PÚNYCODEX is a keyboard for scholarly Unicode names. We understand that trust is everything when it comes to input methods. We do not log, transmit, or store anything you type.

Your keystrokes are processed entirely on your device. The suggestion engine runs locally using a bundled lexicon. No text ever leaves your phone.

1.2 Local Data Storage

The companion app stores the following locally on your device only:

• Recent conversions — your last 50 typed name conversions
• Favorites — names you have starred
• Session stats — conversion counts and day streaks

None of this data is uploaded, synced, or transmitted. Clearing app storage removes it permanently.

1.3 Permissions

The Android keyboard requires two permissions:

• VIBRATE — for haptic key feedback (can be disabled in system settings)
• INTERNET — used only by the companion app shell to check domain availability and load the Unicode directory

The keyboard service itself does not use the internet. It operates entirely offline.

1.4 Third-Party Services

We do not use Google Analytics, Firebase, Mixpanel, or any tracking SDK in the keyboard or companion app. We do not serve ads. We do not sell data. The only external service the companion app contacts is our own API at punycodex.com for domain status checks and the Unicode character directory.

2. Search Engine

2.1 Crawler

The PÚNYCODEX Search Engine discovers and indexes Unicode domain names (xn--) and their associated websites. Our crawler:

• Fetches publicly available web pages via HTTP(S) with a 10-second timeout
• Extracts page metadata: title, meta description, Open Graph description, H1 heading, and first paragraph
• Stores this metadata in our database alongside the domain's Unicode and Punycode forms
• Respects robots.txt where technically feasible

We do not index page content beyond the summary fields listed above. We do not execute JavaScript during crawling. We do not attempt to bypass authentication or access non-public pages.

2.2 Search Query Logging

When you perform a search, we log the following to improve result quality and detect abuse:

• Query text — the search terms you entered
• Result count — how many results were returned
• Search mode — whether you searched the network, Unicode web, or all sources
• IP hash — a one-way SHA-256 hash of your IP address (first 16 characters only). Cannot be reversed to reveal your IP.
• User-agent hash — a one-way SHA-256 hash of your browser's user-agent string (first 16 characters only)

These hashes are intentionally truncated and irreversible. We cannot reconstruct your original IP address or browser fingerprint from them. Query logs are retained indefinitely for quality analysis but contain no personally identifiable information.

2.3 Click Tracking

To improve ranking quality, we record when you click a search result:

• Clicked result — which site you selected
• Position — where the result appeared in the list
• Dwell time — approximately how long you remained on the clicked site before returning (capped at 5 minutes)

This data is linked to your anonymized query hash, not to any personal identifier. It is used solely to train and improve our relevance ranking. Dwell time is measured via the browser's page visibility API, not via embedded scripts on third-party sites.

2.4 Accounts and Cookies

The search engine does not require user accounts. We do not set cookies for tracking purposes. We do not build profiles of individual users. Each search is treated as an independent event.

2.5 Opting Out

If you own a domain and do not wish it to appear in our search index:

• Ensure your robots.txt disallows our crawler user-agent (PunyBot/1.0)
• Contact us at punycodex@gmail.com with the domain and we will remove it promptly

3. Website

3.1 No On-Site Tracking

The PÚNYCODEX website (punycodex.com and all subdomains serving static content) does not contain analytics scripts, tracking pixels, or third-party cookies. We do not use Google Analytics, Plausible, or any other visitor analytics on the static site. We do not use advertising networks. We do not embed social media widgets that track you across sites.

3.2 Hosting and Logs

Our website is hosted on Vercel (main site) and Cloudflare Pages (temple subdomain sites). These hosting providers may collect standard server access logs as part of their infrastructure, including your IP address, requested URL and timestamp, browser user-agent string, and referrer header.

We do not have direct access to these logs for analytics purposes. Vercel and Cloudflare retain them according to their own privacy policies. We do not combine hosting logs with search query logs or any other dataset.

3.3 Cookies and Local Storage

The static website does not set cookies. The Type Tool PWA may store preferences in your browser's localStorage (theme, recent conversions). This data never leaves your device.

4. General Provisions

4.1 Data Deletion

For the Keyboard & Type Tool, delete app data through your device's settings. For the Search Engine, contact punycodex@gmail.com to request removal of search logs or indexed site data. We process deletion requests within 30 days.

4.2 Changes to This Policy

We may update this Privacy Policy from time to time. Changes will be posted on this page with an updated effective date. Material changes will be noted in the development log.

4.3 Contact

If you have questions about this policy, contact us at punycodex@gmail.com.