Privacy Policy

This policy describes how personal data is processed when you use KivLoft. The controller is:

1. Data we process

• Account: Supabase user identifier, email received from Google, public name, avatar URL, role, account status and acceptance timestamps.
• Activity: downloads, reviews, comments, forum posts, reports, favourites and administrative actions.
• Current activity: a random browser session identifier and first/last activity timestamps, used to show current visitor counts.
• Product analytics: the same random browser session identifier, public page pathname without its query string, completed browser-tool type and output count, and timestamps. Account, admin, login, authentication, API and report paths are excluded. These events are not linked to an account, name, email, IP address, user-agent or selected file content.
• Optional first-visit attribution: after you select the separate optional consent checkbox before Google sign-in, the referring URL without query strings or fragments, UTM source and medium, landing-page pathname, country supplied by Cloudflare, user-agent and first-visit timestamp. A random browser identifier deduplicates this record. If you create an account, the record is linked to its identifier to measure where registrations come from. No IP address is stored in this record.
• Aggregate tool totals: a completed-operation total for each browser tool.
• Security and technical: session cookies, request time, error logs, abuse signals and short-lived download events. Infrastructure providers may process IP address and user-agent data in their logs.
• Communications: messages and evidence you send in support, legal or infringement requests.

2. Purposes and legal bases

• Providing accounts, files, community features and requested support: performance of the service agreement.
• Showing current visitor counts and understanding which public pages, files and tools are useful: legitimate interests in operating and improving the service, using limited first-party data only.
• Measuring sources of new registrations with first-visit attribution linked to an account: your optional consent. Refusing does not affect sign-in, registration or downloads.
• Fraud prevention, service security, moderation and legal-claim protection: legitimate interests, balanced against user rights.
• Responding to valid legal requests and preserving required records: compliance with legal obligations.

KivLoft does not use advertising, a newsletter or third-party behavioural analytics.

3. Google sign-in

Google authenticates you and sends the profile fields permitted by the configured OAuth scopes. KivLoft requests only basic identity scopes needed for sign-in. Google processes data under its own terms and privacy information.

4. Processors and recipients

KivLoft uses Cloudflare for hosting, security and email routing; Supabase for authentication, database and storage; and Google for sign-in. These providers process data only as needed to provide their services. Community content is visible to other visitors as determined by its visibility settings.

5. International transfers

Providers may process data outside the European Economic Area. Where required, the relevant provider's contractual safeguards or other lawful transfer mechanism applies.

6. Retention

• Account data: while the account remains active, then deleted or anonymised when no longer needed unless retention is required for a legal claim or legal obligation.
• Comments, reviews and forum posts: until removed, anonymised or no longer needed to operate or defend the service.
• Current activity records: deleted after 14 days.
• Page and tool activity events: deleted after 30 days.
• Optional first-visit attribution: 90 days from the first visit, or until consent is withdrawn. Expired records are removed when new attribution records are collected.
• Security, download and error records: only for the period reasonably necessary for security, troubleshooting and abuse investigations; longer only where a specific investigation or legal obligation requires it.
• Legal acceptances and rights declarations: for the period needed to prove the applicable agreement and defend claims.

7. Cookies and local processing

The service uses necessary session and security cookies. Optional first-visit attribution is enabled only after separate consent before Google sign-in: an HttpOnly cookie holds a random token, and a preference cookie records consent, for up to 90 days. The token is stored only as a hash on the server. Before consent, the initial landing information stays in browser memory and is neither transmitted for attribution nor persisted in cookies or local storage. This memory survives navigation within the site, but is reset by a full reload, closed tab or new visit. You can withdraw consent using the footer button, which deletes the attribution record and its token cookie. A random KivLoft session identifier is kept in local storage so the same browser can be counted once in current activity and first-party product statistics; it is not used for advertising, cross-site tracking or account profiling. Browser tools such as the image converter process selected files locally and do not upload them. KivLoft does not use advertising, newsletter or third-party personalisation cookies.

8. Your rights

Subject to applicable law, you may request access, correction, deletion, restriction, portability or objection, and may withdraw consent without affecting earlier lawful processing. You may also complain to the competent supervisory authority. Requests can be sent to legal@kivloft.com; identity may need to be verified.

9. Automated decisions

KivLoft does not make decisions producing legal or similarly significant effects solely by automated means. Automated abuse signals may prioritise manual review.

10. Age requirement

KivLoft is intended only for people aged 18 or over. The operator does not knowingly create accounts for or collect personal data from anyone under 18.

11. Security

Measures include least-privilege database rules, private storage, time-limited download links, OAuth, security headers, input limits and audit records. No system is risk-free; suspected incidents should be reported promptly.

12. Changes and contact

Changes are identified by version and date. The previously accepted version 1.2 remains available. Privacy questions and rights requests may be sent to legal@kivloft.com.