All My LabelsAll My Labels

Create your custom labels in just a few clicks!

Privacy and cookies policy

Last updated: 12 October 2026

On this page, I explain what personal data AllMyLabels.com processes, why, with which providers, and how to exercise your rights.

Data controller

I am the data controller: a private individual who runs this site on my own (see the legal notice). You can reach me through the contact form.

The site has no user accounts: you can create and print your labels without giving me your name or your email address.

The data I process

Creating labels

  • Data: the features of your label (shape, colour, illustration, font, size) and the text you type (two lines and a date). This text may contain personal data, such as a first name on a school label.
  • Purpose: to make the image of your label and the printable sheet in PDF format.
  • Legal basis: providing the service you ask for.
  • How it works: this information is sent to a Google Cloud Functions function, which makes the image. The image is saved in Google Cloud Storage, where anyone who knows its address can see it; that address is computed from the content of the label. Each label created is recorded with its date in the site's database (Cloud Firestore), and its settings appear in the function's technical logs. The PDF sheet is made on demand and is not kept.
  • Retention period: the data of each label created is kept for 3 years in the database, the image for 30 days in Google Cloud Storage, and the technical logs for 30 days.

I advise you not to put sensitive information on your labels, such as a postal address or a phone number.

Label in progress

While you create a label, it is saved in your browser's local storage (keys label-maker and label-maker-<category>), so that you do not lose it if you reload the page. This data stays on your device. After 12 hours it is ignored and deleted on your next visit.

Anonymous identifier

On the result page, the site opens an anonymous Firebase Authentication session. This random identifier, which is not linked to your identity, authorises making the label and protects the service from abuse. Firebase keeps it in your browser's storage (IndexedDB).

  • Legal basis: my legitimate interest in protecting the service.
  • Retention period: this technical identifier contains no personal data entered by you. It is kept for as long as it is needed for the service to work, and I delete it after 3 years at the latest.

Contact form

  • Data: your email address, and the subject and content of your message.
  • Purpose: to reply to you.
  • Legal basis: my legitimate interest in answering the messages I receive.
  • How it works: your message is received by a Google Cloud Functions function located in Frankfurt (Germany), saved in Cloud Firestore, then forwarded to me by email, through the Firebase "Trigger Email" extension and OVHcloud's email sending service.
  • Retention period: 3 years, both in the database and in my inbox.

Guestbook

  • Data: your name or nickname, your message and its date; your email address if you choose to give it.
  • Purpose: to publish your message on the site. The name, message and date are public: anyone can read them. The email address is optional and I use it only to reply to you personally if you wish, with an email I write myself. It is never published or used for anything else: it is stored separately and cannot be read from the site.
  • Legal basis: your consent, given by posting your message. You can ask me to delete your message at any time through the contact form.
  • Retention period: your name, message, its date and your email address are kept for as long as the message is published in the guestbook.

Protection against abuse

The contact form and the guestbook accept at most five submissions per hour per visitor. To count them, the site computes a fingerprint (SHA-256 hash) of your IP address: only this fingerprint is stored in Cloud Firestore, never the address itself.

Before sending, your browser also solves a small computation (a "proof of work", with the open-source tool ALTCHA) that the site checks: quick for a person, costly for a bot sending messages in bulk. It sets no cookie, does not track you and sends no data to any third party: the challenge comes from the site and the answer goes back to it. The site only keeps the identifier of each solved challenge, so that it is used once, for 10 minutes.

  • Legal basis: my legitimate interest in protecting the site from spam.
  • Retention period: 1 hour for the IP address fingerprint, 10 minutes for the challenge identifier.

Audience measurement

I use Google Analytics, through Firebase, on every page of the site. Google Analytics loads only once you have accepted it in the consent message: without your consent, it does not load at all.

  • Data: pages viewed, technical information about your device and browser, approximate location derived from your IP address, identifiers stored in cookies.
  • Purpose: to measure how many people visit the site.
  • Legal basis: your consent (see "Your choices about cookies" below).
  • Recipient: Google.
  • Retention period: 14 months.

Advertising

The site shows Google AdSense ads on every page. If you accept, Google and its partners may use cookies and identifiers to show ads personalised to your interests, to limit how often you see them, to measure their performance and to fight fraud. If you decline, Google shows only non-personalised or limited ads, depending on the choices you made in the consent message. Google explains these uses on the page How Google uses information from sites or apps that use our services, and you can adjust ad personalisation in My Ad Center.

  • Legal basis: your consent (see "Your choices about cookies" below).
  • Recipient: Google.

Link to the Facebook page

The Contact and Guestbook pages offer a link to the site's Facebook page. It is a plain link: nothing is sent to Meta unless you follow it. Once on Facebook, Meta's privacy policy applies.

  • Legal basis: your consent (see "Your choices about cookies" below).

Donate button

When an ad does not show, the site may offer you a "Donate" button. Its image is served by the site itself: displaying the button sends nothing to PayPal. You are taken to PayPal only if you click the button, and PayPal's privacy statement then applies.

Hosting and technical logs

The site is served by Firebase Hosting (Google). Like any web server, it processes your IP address and the technical details of your requests to display pages and keep the service secure. The site's functions keep a log in Google Cloud Logging: date, requested address and the outcome of the request. The texts of your labels never appear in it.

  • Legal basis: my legitimate interest in running and securing the site.
  • Retention period: 30 days.

Your choices about cookies

If you visit the site from the European Economic Area, the United Kingdom or Switzerland, a consent message appears on your first visit. It is provided by Google, whose consent management platform is certified by IAB Europe (TCF). It lets you consent, not consent, or manage your options purpose by purpose and partner by partner. Until you consent, Google Analytics does not load, and ads are not personalised.

You can change your mind at any time with the "Manage cookies" button at the bottom of every page. If you withdraw your consent, audience measurement stops at once, without reloading the page, and the Google Analytics cookies are deleted.

Google saves your choice in an FCCDCF cookie, kept for 13 months, and measures how its message is shown with an FCNEC cookie, kept for 365 days (see Google's list of advertising cookies).

Elsewhere in the world, this message is not shown and these services load directly.

Summary of cookies and local storage

  • FCCDCF (Google's cookie): remembers your choices in the consent message, 13 months.
  • FCNEC (Google's cookie): measures how the consent message is shown, 365 days.
  • label-maker and label-maker-<category> (local storage): label in progress, 12 hours.
  • Firebase Authentication session (IndexedDB): anonymous identifier, until you clear your browser data.
  • Google Analytics cookies (_ga and _ga_…), only if you accept: audience measurement, duration set by Google.
  • Google AdSense cookies, set by Google on its own domains: advertising, within the limits of your choices, duration set by Google.

Recipients

I neither sell nor rent your data. It is processed by me and by the following providers, only for the purposes described above:

  • Google Cloud France SARL: hosting and running the site with Firebase (Hosting, Cloud Functions, Cloud Firestore, Cloud Storage, Authentication, Cloud Logging);
  • Google Ireland Limited and Google LLC: the consent message (Google's consent management platform), audience measurement (Google Analytics) and advertising (Google AdSense);
  • OVHcloud: the email sending service through which contact form messages are forwarded to me.

Guestbook messages (name, message, date) are public.

Storage locations and transfers outside the European Union

The Cloud Firestore database is located in the European Union, and the function that receives the forms in Frankfurt (Germany). Label images are stored in Google Cloud Storage, in the European Union. The function that makes these images, however, runs in the United States: your label settings, text included, are processed there.

Google LLC is based in the United States, and data may be transferred there, in particular for making labels, audience measurement and advertising. These transfers are covered by the EU–US Data Privacy Framework, which Google has joined, and by the European Commission's standard contractual clauses.

Your rights

You have the right to access, rectify and erase your data, to restrict its processing, to object to it and to data portability. Where processing is based on your consent, you can withdraw it at any time.

To exercise these rights, write to me through the contact form. As the site has no user accounts, tell me what will help me find your data (for example the email address you used or the message concerned). I will reply within one month.

If you believe your rights have not been respected, you can lodge a complaint with the CNIL, the French data protection authority: https://www.cnil.fr.

Changes

I may update this page, for example when the site changes. The date of the last update is shown at the top of the page.