Privacy Statement

Who we are

Cloud Pricing Calculators (cloudpricingcalculators.com) puts three cloud price calculators side by side — Azure Price Calculator (azure-price-calculator.com), AWS Price Calculator (aws-pricing-calculator.com), GCP Price Calculator (gcp-pricing-calculator.com) — and is run by William Carrington Jr, who runs all three. It prices nothing itself: it sends your request to those calculators' engines and shows their quotes on one canvas.

The three calculators share one set of accounts; this site does not. It has its own sign-in and its own data store, so an account here is not an account there, and everything below applies to this site only.

If you sign up with email, the confirmation email with your set-password link, and any password reset email, is sent from this site through Azure Communication Services, Microsoft's email service. It receives your email address and the message, and nothing else about you.

Independent tool: not affiliated with or endorsed by Microsoft, Amazon or Google. Questions about any of this: w7carrington@gmail.com.

What we store, and why

• Your account. Only if you sign in. With email: your email address, a hash of your password (scrypt, salted; the password itself is never stored and cannot be read back, not even by us), when you confirmed the address, and when you first and last signed in. With Microsoft or Google, where offered: which one, the user id that provider gives this site, your email, the display name the provider sends, and when you first and last signed in; that provider checks your password, through Azure Static Web Apps. Not a photo.
• Sign-in records. For an email account: one record per signed-in browser, holding a one-way hash of the session cookie below, the account it belongs to and when it expires; and, while a set-password or reset link is unused, a one-way hash of that link's code and the address it was sent to. Never the cookie or the code itself.
• Things you save. Your canvases, against your account: the quotes on them, including the descriptions you typed and the priced results, their names and layout. That is what saving means. Not signed in? Your canvas stays in your browser's own storage (localStorage) and never reaches us.
• Quote jobs. While a quote is being priced, a job record holds the description, the quote name, the result, and who may read it: your account id, a hash of the session cookie below, or a salted hash of your IP address.
• Mirror cache. Results of "Mirror on", keyed by a hash of the provider-neutral workload description, the target cloud and the day. No identity.
• Rate-limit counters. Daily counts against a salted hash of your IP address (never the address itself), your account id if signed in, or a hash of an agent key, so the free tools stay usable.
• Usage counts. One row per visitor per day and one per quote, comparison, import, share or first sign-in, with the day, the kind of action, the cloud and the length of the request, keyed by a salted one-way hash (see "Cookies and analytics"). No email, IP address, cookie value or request text.
• Server logs. Event names, the cloud involved, outcome, timings and a correlation id. Our own log events do not include your email address, your IP address or what you typed.

Never sign in and there is no account: your canvas in your browser, a random session id cookie, a salted hash of your IP in the counters and the usage counts above, and whatever you share.

Your chats and quotes

Pricing a quote sends what you typed — the description, the quote name and, when the canvas already has quotes, a short summary of them — to our server and on to the engine for the cloud you picked (see "How the answers are produced"). Our server keeps it in the quote job for 24 hours, so that you can read back the result, and then deletes it. The job records who may read it, not your email address.

Guided conversations are not stored. Each turn is answered and then forgotten by our server; the conversation stays only in your open browser tab. What remains is the request log line (turn number, outcome and timing, never the text) and the daily count of turns used for the limit.

Separately we count that a quote happened — the day, the cloud and the length of the request — against a salted one-way hash, never against your email. The request itself is not part of that count.

Canvases you deliberately save to your account, and anything you share by link, are stored. That is what saving and sharing mean.

Share links are public

A share link is public by design: anyone with it can open a read-only copy of the quotes it holds without signing in, unless you limited it to one email address; then only someone signed in with that address can. Keep personal information, customer names and anything confidential out of a quote you intend to share.

• A link created without an account, or by an AI agent, expires after 7 days. The date is fixed when the link is created: opening it does not extend it.
• A link created from an account lasts until you delete it.
• A link stores a copy of the quotes you shared, the name you gave it, your account id if you were signed in, the recipient's email address if you limited it to one person, and when it was created and expires.

How the answers are produced

Every price comes from one of the three calculator engines: Azure Price Calculator (azure-price-calculator.com), AWS Price Calculator (aws-pricing-calculator.com), GCP Price Calculator (gcp-pricing-calculator.com). When you price a quote, use "All three" or use "Mirror on", this site sends the engine for each cloud the description of the workload and the quote name, and identifies itself as Cloud Pricing Calculators. It never sends your email address, your name or your account id. Depending on how the connection to an engine is configured, it may also pass on your IP address, so that the engine can apply its own per-visitor daily limit.

The engines produce quotes with a third-party AI model, Claude, from Anthropic, and take prices from the cloud vendors' own public pricing APIs and documentation. Each engine also creates its own share link for the quote on its site. That link lasts 30 days and, like any share link there, anyone who has it can open it. What the engines do with a request is covered by their own privacy statements, not this one: Azure Price Calculator privacy statement, AWS Price Calculator privacy statement, GCP Price Calculator privacy statement.

Guided mode's questions come from the same kind of model, Claude from Anthropic, called by our server: what you type in that conversation, the earlier questions and the cloud you picked are sent to Anthropic to choose the next question. That model never prices anything, and nothing is priced until you press Price it. Our server identifies itself, not you: Anthropic does not receive your email address, your IP address or your account id, and handles that text under its own commercial terms and privacy policy, not this one.

An AI assistant building a quote for you uses the same public API any agent can, described on the agent access page.

Cookies and analytics

The site itself sets no tracking cookies. It sets one cookie of its own, and keeps your unsigned work in your browser's own storage:

• cpc_sid: a random session id this site sets the first time you price a quote without signing in, so that you, and only you, can read back the progress of that quote. It is sent only to this site's API, cannot be read by scripts, and expires after 30 days.
• cpc_session: set when you sign in with email, to keep you signed in. A random value that only this site can look up (it stores just a one-way hash of it); it cannot be read by scripts, is sent only to this site, lasts 30 days, and is revoked on our server when you sign out or change or reset your password.
• Signing in with Microsoft or Google, where offered, sets the sign-in cookie of Azure Static Web Apps instead, which keeps you signed in.
• Your unsigned canvas, in localStorage, as above. Clearing your browser data removes it.

One third-party analytics service runs on every page, and it does set its own cookies and identifiers under its own policy:

• Google Analytics 4, a web analytics service provided by Google LLC, to see how the site is used. It sets the first-party cookies _ga and _ga_GZ34HSL942, which tell visits and visitors apart and by default last up to two years. Each page you open sends Google the address of the page (including a share-link, import or AI-link address, if that is what you opened), the page you came from, details of your device and browser such as its type, operating system, screen size and language, and interactions it measures automatically, such as scrolling, clicks on links to other sites and file downloads. Google receives your IP address with each of these requests and derives an approximate location from it; Google says that Google Analytics 4 does not log or store the address itself. This site does not send Google your email address, your account id or the descriptions you type. Google Privacy Policy (see also how Google uses information from sites that use its services). You can opt out with the Google Analytics Opt-out Browser Add-on, or by blocking cookies for this site in your browser.

It is not needed for the site to work. Apart from Google Analytics, this site loads no analytics, advertising or tracking scripts, and its Content Security Policy allows scripts only from this site and from Google's tag server (www.googletagmanager.com). Cloudflare sits in front of the site to deliver and protect it; it handles each request, including your IP address, and may set a strictly necessary security cookie of its own.

Separately from Google Analytics, this site also counts visits and quotes itself. Once per browser session the page tells this site's API that it was opened; the API also notes each quote, comparison, import, share and first sign-in. It records the day, the kind of action, the cloud and the length of what you asked, keyed by a salted one-way hash of your account id, session cookie or IP address: never your email, your IP address itself, your cookie or what you typed. These counts are kept with the operator's reporting for the three sister calculators, so that the four sites can be compared.

The details of a quote show one placement labelled Sponsored, currently for CloudFit Software. It is the same sponsor on every quote, not a recommendation drawn from yours. Nothing about you or your quote is sent to the sponsor; if you click it, their site opens without being told which page you came from, and their privacy policy applies there.

How long we keep it, and how to have it deleted

• Quote jobs and the mirror cache: 24 hours, then deleted automatically.
• Guided conversations: not kept by this site at all.
• Rate-limit counters: 8 days, then deleted automatically.
• Share links: 7 days from creation without an account or when made by an AI agent; until you delete them for links made from an account.
• Your account and saved canvases: until you ask us to delete them.
• Set-password links: 24 hours; password reset links: 1 hour. Each works once, and stops working as soon as a password is set.
• Email sign-in sessions: 30 days from signing in, or until you sign out, whichever comes first; then deleted automatically.
• Your unsigned canvas: in your browser, until you clear it.
• Usage counts: kept with the operator's reporting for the sister calculators. They hold no email or address, so they cannot be looked up by your email.

There is no self-service delete button yet. Email w7carrington@gmail.com from the address on the account and we will delete the account, its canvases and its share links. You can also just ask what we hold about you.

Security

Email passwords are stored only as salted scrypt hashes, never in a form anyone can read, and sign-in links and session cookies only as one-way hashes. Sign-in attempts are rate-limited, and an account is locked for an hour after repeated wrong passwords. This site still issues no sign-in token: the session lives on our server and the cookie is only a random key to it. Microsoft or Google sign-in, where offered, goes through Azure Static Web Apps. All traffic runs over HTTPS. IP addresses are stored only as salted hashes, and agent keys only as hashes. The site's server talks to the three engines directly; your browser never calls them for a quote. The site, its API and its database run on Microsoft Azure in the United States (US East), behind Cloudflare.

No service can promise perfect security and we do not. What we can tell you is what we hold, which is above.

Children, changes, and getting in touch

This is a tool for planning cloud spending. It is not directed at children, and we do not knowingly collect information from anyone under 13.

If what we store changes, this page changes with it and the effective date at the top moves. We will not quietly start collecting something this page does not mention. Anything at all: w7carrington@gmail.com.