# Privacy Policy Decoder

> What a privacy policy says it collects, shares, sells and keeps — with quoted evidence. Give the URL of a privacy policy or paste/upload its text (English or German). The decoder lists which data categories, purposes, sharing and sale practices, retention periods, user rights, laws (GDPR, CCPA/CPRA …), international transfer mechanisms and contacts the policy mentions, quotes the sentences, and points out topics it does not mention.

Part of usefulweb.site (https://usefulweb.site/). Results are deterministic calculations from the inputs and the listed assumptions; the API returns exactly what the web page shows.

## Use it
- Human interface: https://privacypolicydecoder.usefulweb.site/ (interactive tool at https://privacypolicydecoder.usefulweb.site/tool)
- JSON API: POST https://privacypolicydecoder.usefulweb.site/api/v1/calculate with a JSON object of inputs (schema: https://privacypolicydecoder.usefulweb.site/api/v1/tool)
- OpenAPI: https://privacypolicydecoder.usefulweb.site/openapi.json
- MCP (Streamable HTTP): https://privacypolicydecoder.usefulweb.site/mcp - tool `privacy_policy_decoder`

## Inputs
- text (textarea): Privacy policy text - Paste the text here, or use one of the other options below (exactly one).
- file (file): Or upload a file - TXT, PDF, DOCX, HTML or a photo/scan (PNG/JPG, read with OCR). Max 5 MiB.
- url (url): Or the privacy policy URL - A public http(s) address. The page text is fetched once and analysed.

## Method
- The policy is split into sentences; every sentence is tested against fixed English and German keyword patterns for 7 sections: data collected, purposes, sharing & selling, rights, laws, international transfers and contact.
- An item is "mentioned" when at least one sentence matches; up to 3 matching sentences are quoted. If every matching sentence contains a negation ("we do not", "nicht", "keine"), the item is marked as negated.
- Sale of data is classified from sentences with sell/sale/verkaufen: negated sentences count as "does not sell", others as "sells or may sell"; both present = "mixed statements".
- Retention periods are durations (e.g. "7 years", "nach 7 Tagen") found in sentences about retaining, storing or deleting data; open-ended phrases like "as long as necessary" are flagged as vague.
- Children's age thresholds are numbers in phrases like "under the age of 13" / "unter 16 Jahren". "Not mentioned" means no pattern matched — not that the practice does not happen.

## Limits
- Rule-based keyword analysis of the policy text, not legal advice and not a compliance audit. A policy can describe practices in wording these patterns miss, and what a company does may differ from what its policy says.