Privacy Policy

Last updated: October 20, 2026

Short version

diff doesn’t keep a record of the pages you compare. The addresses and page content pass through the server only while a comparison is open, and are held in memory, never written to disk or logged by diff. The only things kept are a short list of recent pages in your own browser, which you can clear, one small security cookie that proves you passed a bot check, and simple page-view analytics for the website.

Where this applies

This policy covers the diff website at diff-my.site (“the site”). Where it matters, it also says how things differ when diff is run on your own computer.

What happens to the addresses you enter

Browsers stop one website from showing and reading another, so diff fetches the pages for you. When you start a comparison, the site’s server requests each page from its own website, changes the page’s links so they keep working inside diff, removes the headers and tags that stop a page being shown in a frame or that restrict its scripts, turns off service workers, and adds a small inspector that reads the rendered page (text, images, layout and styles) so the two can be compared. The inspector sends what it reads only to the diff window in your browser. It does not send it to us.

Each of the two pages is shown from its own random address under diff-my.site, separate from diff’s own pages, so a page you preview can’t read diff’s data. Because that address shares diff’s domain name, a previewed page can set cookies that your browser also sends to diff’s own pages. diff ignores them, but a page that sets a great many can stop diff loading until you clear the site’s cookies.

The start screen

As you type an address, the start screen asks the site’s server for a preview. The server fetches the page, reads it only as far as the end of its head section, and returns the title, description, and the addresses of its icon and preview image. The response is marked no-store and nothing is kept. Because this happens shortly after you stop typing, a partly typed address may be looked up before you finish it.

Your browser then loads the icon and preview image directly from the website that published them, without sending a referrer. It does the same for the icons shown in your recent pages and at the top of a comparison. Those are the places diff’s own pages contact another website without going through the server, apart from the bot check below.

Recent pages, stored in your browser

When you confirm a page, its address, title and icon address are saved in your browser’s local storage (up to 24 entries) so the start screen can suggest it next time. This list stays in your browser and is never sent to the server. Remove one entry with the cross beside it, choose “Clear history” in the suggestions, or clear your browser’s site data.

What the server holds, and for how long

While a comparison is open, the server keeps this in memory only:

for each of the two pages: a random label, a random token created by your browser, and which side it is
the website’s origin (scheme, host and port), with no path or query, and the origin of any redirect target
a random visitor ID taken from the security cookie below, and the time of last use
short-lived counters used to limit abuse, keyed by your IP address or that random visitor ID, which are discarded within minutes of going quiet

A session is dropped after 20 idle minutes, when you close the comparison, or when the server restarts. Nothing is written to disk or a database.

What is never stored

page content, paths, query strings, form submissions, or the comparison result
the cookies of the sites you preview
logs of the addresses you compare

Page content is held in memory only while it is being processed and passed back to you, and responses are marked no-store. diff is configured not to log requests or the addresses in them.

Who can see your requests

The websites you compare can see the requests, and that is outside diff’s control. When you use the site, they see the IP address of a separate relay server that diff sends requests through, not yours. The relay only passes traffic along: it can’t read encrypted pages, adds nothing to them, and keeps no record of what it is asked for. The relay looks up the names of the websites you compare using public DNS resolvers (Cloudflare and Quad9), which can therefore see those hostnames. They also receive these details from your browser: its user-agent, accepted formats, language preference, and, where the page uses them, range and content-type headers and anything you submit to a form on the page. diff sets the Referer and Origin it sends to the website’s own address. Any redirect target receives the same, apart from cookies, which are only returned to the site that set them.

Your own cookies are never sent to those websites, and cookies they try to set are never passed to your browser. If a website sets a cookie during a redirect (a consent or region check, for example), it is held in memory for that one request so the redirect can finish, then dropped.

The pages you preview run their own scripts in your browser. Those scripts, and any third-party services they load, can contact their servers directly. When they do, those servers see your own IP address. They may also store data in your browser for the preview address. diff doesn’t control or see that. Don’t sign in to accounts or enter sensitive information in a previewed page: anything you submit passes through diff’s server on its way.

The server is set up to refuse addresses on private networks and its own addresses, and it never connects to anything on your computer. It also limits how much any one visitor can load.

Previewing localhost on the site

The site’s server can’t reach your own computer, so a localhost address is handled by your browser instead. The diff page you have open asks the server which requests the preview needs, makes them to your own machine, and sends the responses back. Those pages and files therefore pass through the server, in memory, while they are rewritten and shown, exactly like any other page. They are not stored or logged. Only your own browser can do this for your preview, and only for addresses on your own machine. Your browser decides whether it is allowed: the server you are running has to permit it, and Chrome may ask your permission to reach devices on your network.

Bot check

To stop automated use, the site asks Cloudflare Turnstile to check that you’re a person before your first comparison or address lookup. Most people never see anything. The check loads a script from Cloudflare, which processes information such as your IP address and browser signals under its own privacy policy and may set its own cookies or storage. Our server confirms the result with Cloudflare and does not send your IP address when it does.

Cookies, storage and analytics

Security cookie. After a successful bot check the site sets one cookie, __Host-diff_gate. It holds a random ID, an expiry time and a signature. It is needed for the site to work, lasts four hours, can’t be read by scripts, and is used only to prove you passed the check and to apply fair-use limits. It is not used to track you and holds nothing about you.
Preview cookie. Each page you compare is shown from its own address, and each of those addresses sets one cookie, __Host-rbd_pv, that holds a random secret. It ties that preview to the browser that opened it, so that anyone else who somehow gets the address can’t open it or see your page (including a page from your own computer). It is needed for previews to work, can’t be read by scripts, is only ever sent back to that one preview address, and ends when you close the comparison or after four hours at most. It holds nothing about you.
Local storage. The recent-pages list described above, kept in your browser only.
Analytics. The site uses a simple page-view analytics script served from diff’s own domain. It records which pages of the site are viewed and for how long, along with the technical details any web request carries, such as your browser, device type, screen size, language and IP address. It is used only to understand how the site is used. It is not given the addresses you compare, the content of those pages, or your recent-pages list. It isn’t loaded if your browser sends Do Not Track or Global Privacy Control, and it isn’t loaded when diff runs on your own computer.
diff has no accounts and no advertising, and loads no third-party scripts apart from the bot check.
The site’s font is built into diff and served from diff itself, so your browser doesn’t contact Google for it.

Hosting and network providers

diff’s own software doesn’t keep request logs, but the companies that host the site and carry its traffic, which may include Cloudflare, can keep standard connection records such as IP addresses and timestamps. That is outside diff’s control.

Your choices

Clear your recent pages from the start screen, or clear the site’s data in your browser settings.
Turn on Do Not Track or Global Privacy Control, or block the analytics script, to opt out of analytics.
Close the comparison or the tab to end your sessions straight away.

Running diff on your own computer

When diff runs on your own machine, there is no bot check and no analytics. Pages are fetched by your computer, so the websites you compare see your own IP address, and local and private-network addresses can be previewed. Everything else above applies.

Changes

If this policy changes, the date at the top is updated. By using the site you also agree to the Terms of Service.