Privacy

Last reviewed: 8 October 2026.

Tool inputs, files and results

The local file and calculation tools process images, PDFs, tables, audio, video, archives, QR content, passwords and calculations on your device. Their processing code does not upload your files, file names, entered text or generated results. Selecting a file gives the tool access to it on your device; it does not send it to a server. There is no automatic server-processing fallback.

Processing libraries and recognition models are downloaded from this website. OCR and speech recognition request your confirmation before the model download. Recognition then runs on your device. Public website assets can remain in your browser’s cache; the application does not persist your source documents or recognition results there. Photos selected through your device’s camera or file picker are processed in the same local way.

Copying a result places it on your device’s clipboard. Downloading saves it through your browser. Your browser, extensions, operating system, clipboard manager or backup settings may retain that content independently of this website. Resetting a tool releases its current references where possible; it does not guarantee physical erasure from device memory.

Optional browser speech voices

Text to Speech uses voices supplied by your browser or operating system. Local voices are preferred using the browser's localService flag; that report is not an independent guarantee about operating-system services. A voice not reported as local requires your separate explicit confirmation before playback. Its browser/system provider may then receive the text and process it under its own privacy rules. The tool does not send that text to this website's server.

Optional official invoice validation

The invoice reader continues to run in your browser. Its separate official validation starts only after you select one supported XML, confirm the transfer and press the validation button. That XML (up to 4 MiB) is sent over HTTPS to this website and processed in a separate, short-lived Vercel Sandbox in Frankfurt. The sandbox has no outbound network access and does not use AI, advertising or analytics services. The application does not log invoice content or file names. Temporary invoice and report files are deleted and the sandbox is stopped after each attempt; no invoice snapshot or persistent storage is created. Failed cleanup prevents release of a successful result. Hosting connection and operational metadata remain subject to the provider’s own policies; this is not a physical-erasure guarantee.

Official rule messages and downloaded reports may quote invoice values. Review them before sharing. The existing Supabase database in Zurich stores only fixed quota counters, short-lived random capacity tokens and service configuration for this feature, never invoices, names or document hashes. Account login is not required.

HTTP connection check

The Internet quality check sends bounded requests to a fixed endpoint on this website after your action. Hosting necessarily receives connection information such as your IP address. The application returns small challenge responses and calculates timings in your browser. Separate global quota counters and expiring capacity tokens use the existing database; requests do not contain files, account data or arbitrary destination addresses. The optional report is created locally and is not automatically shared.

Device permissions and reviewed reports

Microphone, camera and screen access starts only after your action and the browser's permission or selection. Recordings and snapshots remain in the current tool session until you choose to download them. Stop, reset, session limits and leaving the page release the tool's active resources; browser permissions can be revoked in browser settings. Keyboard and mouse tests observe their focused test area, not other websites or applications.

Support reports use numerical or yes/no observations and written explanations. They exclude recordings, file names, device names, addresses and connection identifiers. Review the exact snapshot before copying it. Pasting it into a chat or sending it elsewhere is your separate decision. If a supported browser offers the optional image-tool agent interface, processing requires your visible confirmation. Sharing its minimal result requires a separate, one-time approval of the displayed values; selecting a file alone grants no agent access to its contents.

Direct device transfer

Creating or joining a connection sends random session credentials, connection descriptions and certificate fingerprints through this website's Vercel server to the existing Supabase database in Zurich. Descriptions can include network addresses or local connection names. This signaling is separate from your optional account and sends no file names or file bytes to either server. Pairing session rows expire five minutes after creation; explicit close deletes that session row. A separate preparation reservation stores only hashed random identifiers and an expiry time, no file contents, for up to ten minutes. A once-per-minute job deletes expired session rows and preparation reservations. Provider logs, transaction records and backups have separate retention; this is not a promise of physical erasure everywhere.

After both sides compare and confirm the peer fingerprints, the sender can offer files over the encrypted browser connection. The receiver sees file names, sizes and types in that offer before deciding. Only the contents of explicitly accepted files or short text (up to 8 KiB in UTF-8) are then transferred directly between the browsers. The initial version uses no STUN/TURN service or relay; restricted networks may prevent a connection. An invitation grants access to the pairing attempt: share it only with the intended recipient. Once received or downloaded, a copy is controlled by that recipient.

Requested public website checks

Starting a website check sends the entered public address and optional DKIM selector to the Vercel server and its configured DNS resolver. The server makes bounded HTTP HEAD and TLS connections to the selected public site and validated redirects. The target sees the hosting server's request. Private addresses, login details, query strings and fragments are rejected; do not enter confidential paths. Browser account cookies, files and page bodies are not forwarded. Results remain in the current page; the application does not persist target addresses or results.

Abuse protection processes your connection IP through Vercel's regional rate limiter. Separate global counters in the Zurich database limit accepted requests without storing visitor IPs, selected target addresses or file data. Network features stop accepting work when their budgets or required infrastructure are unavailable. Technical provider records remain separate from these counters.

Local browser storage

The website remembers favorite tool IDs, recent tool IDs and your selected interface language (English or German) on this browser. CSV Repair, List Compare and the image Upload Fixer can also save a restricted set of output or comparison settings when you explicitly choose Save settings. These contain no files, names, cell contents or pasted text. Delete saved settings inside the tool; restoring them never processes a file automatically. The general tool recommendation shares only the public tool address; project invitations use the separate access links described above. These tool-list preferences do not automatically save tool inputs or results. The sports planner uses the separate automatic saving described below. You can clear the saved tool list from your library, or remove all website data through your browser settings. If storage is unavailable, tools continue to work with temporary state.

Account status

Optional sign-in, registration and password recovery use Supabase. The service receives your email address, credentials, session information and technical connection data to manage your account and protect sign-in. Session cookies maintain your separate session on this website. The free tools do not require an account; separate paid services explain their account requirements before purchase.

Vitali Web Tools, VitaliFinance, Rechnungswesen lernen and Finanzrechner Schweiz use the same account identity. Supabase stores your optional display name in the shared profile; changing it updates your name across these websites. You sign in separately on each website. Password changes affect the shared identity; signing out here ends only this website’s session. Account data are kept to provide the account; contact us to request deletion of the shared account, which also deletes its linked product data.

The shared Supabase project’s primary database is in Central Europe (Zurich), Switzerland. This does not mean that all account processing takes place in Switzerland: website hosting, email delivery and Supabase’s service providers can involve processing abroad. Supabase describes its processing and international transfer safeguards in its Data Processing Addendum and privacy information.

Account confirmation and password-reset emails are sent by Supabase through Resend under the sender name «Vitali Konto», using the sending domain send.rechnungswesen-lernen.ch. Resend processes your email address, email content including the account link, and delivery records in the United States. See the Resend processing and retention information below.

When you are signed in, tool IDs, your favorite selections and the times you last used tools are synchronized through this website’s server to your account in Supabase. This makes your tool list available when you sign in to Vitali Web Tools on another device. Files, file names, inputs, results and saved tool settings are not part of this synchronization. Your selected interface language stays in this browser and is not written to your shared profile. Removing website data from your browser does not delete the account copy of your tool list.

Existing browser-only tool lists are added to your account only when you explicitly choose to add them. Synchronization also stores operation identifiers, timestamps and technical receipts to reconcile repeated or offline changes. When a new change is saved, receipts older than 30 days are removed and their number is limited to 5,000 per account. The current saved tool-list state, including deletion markers that prevent old changes from restoring removed entries, has no automatic expiry and is deleted with your account. These receipts and markers contain tool-list metadata, not file contents or tool inputs.

Contact messages and email delivery

When you submit the contact form, your email address and message are sent to this website’s server and then through Resend to the operator’s mailbox. Your address is used for replying. The form also submits a request identifier and start time to prevent duplicate or abusive submissions; the hosting firewall processes connection data for abuse protection. No attachments are accepted. The application does not record message text in logs or a contact database.

Resend (Plus Five Five, Inc., United States) processes message contents and delivery records in the United States, including when a European sending region is used. Its Data Processing Addendum includes standard contractual clauses for Swiss transfers. Retention and deletion are described in its data protection information. A sending confirmation means the provider accepted the message; it does not prove mailbox receipt.

When you email us, your sender address, message and mail headers are processed by your email provider and the operator’s Apple iCloud mailbox to receive and answer your request. Correspondence is retained for handling the request and any necessary follow-up or legal obligations. You can contact us to request deletion of this correspondence. Apple describes its international processing, including Ireland and the United States, and its transfer safeguards in its privacy policy.

Website delivery and technical logs

Vercel Inc., United States, hosts this website on its Pro plan. Loading pages, libraries or models sends technical request data such as your IP address, requested URL, browser information, time and response status to its infrastructure. These data support delivery, fault diagnosis and protection against abuse. They are separate from the contents processed inside a tool. The official invoice-validation endpoint and its temporary sandbox, as well as the HTTP connection-check endpoint, are configured for Frankfurt, Germany. Other server functions use the project’s default region in the United States; static website assets are delivered through its worldwide network. These execution locations do not confine delivery, security, billing or operational metadata to Frankfurt or Switzerland. Vercel and its service providers may process such records in other countries, including the United States, under the terms linked below.

Vercel processes hosting data under its Data Processing Addendum, including standard contractual clauses for international transfers where applicable, also for Switzerland. Vercel’s handling of technical service data for its own purposes is described in its privacy notice.

The current Pro plan retains runtime logs for one day. This period does not cover every provider security, billing or legal record; Vercel retains those according to their purpose and applicable obligations. The website does not store your tool contents in runtime logs. See the log documentation.

Analytics, advertising and cookies

Public help articles use help.vitaliwebtools.com. Tools, sign-in and contact use vitaliwebtools.com. Opening a tool from an article loads a separate document. The help area has no account session, private tool inputs or account API; the two origins have separate browser storage.

Optional Google Ads purchase measurement is available for the products described below. The application’s general event interface has no collection destination. Tool contents and search queries are not sent to an analytics service. The website uses no session replay or third-party visitor analytics. Local preferences and technical hosting records are separate.

Purposes and legal basis

We process the request and contact data described above to provide a secure website and answer messages. Swiss data protection law applies to the operator. Where the GDPR applies, this necessary processing relies on our legitimate interests in operating the website and handling inquiries under Article 6(1)(f), subject to your overriding rights and interests. Processing required by a legal obligation relies on Article 6(1)(c). We do not use tool content to make automated decisions about you.

Where the GDPR applies, processing necessary to provide the optional account you request relies on Article 6(1)(b). Account-security measures rely on our legitimate interest in preventing unauthorized access, subject to your overriding rights.

Your choices and rights

The free tools’ basic functions are available without signing in. Account synchronization and purchases require an account where stated by the service. You can clear local website storage and contact the operator about personal data handled for website delivery or email correspondence. Depending on the law applicable to your situation, you may request access, correction, deletion, restriction or portability, and object to processing based on legitimate interests. Local-only tool contents cannot be retrieved by the operator. To handle a rights request, we may need information sufficient to identify the relevant records and protect other people’s data.

You may contact the Swiss Federal Data Protection and Information Commissioner or another competent supervisory authority about data protection concerns.

External links

Following an external link opens another provider’s service under its own privacy terms. Links do not transmit the contents of your tool inputs.

Imprint