Home Text Data Developer Files Media Utilities

Privacy Policy

1. Controller and Contact

The controller responsible for data processing on this website (Art. 4(7) GDPR) is:

Konvi.ch
Christian Pfnür
Büdnergasse 4
14552 Michendorf
Germany
Email: info@konvi.ch

See also our Imprint for further legal details.

2. Hosting

This website is hosted on a virtual server (VPS) provided by ComputeBox, located in Bremen, Germany. ComputeBox processes data on our behalf strictly as our hosting provider (technical infrastructure only) and does not access the content of your tool inputs. We do not use a CDN (content delivery network) — all pages, scripts, styles, fonts and other assets are served directly from our own server. No requests are made to Google Fonts or any other third-party font, script, or asset service. No optional backup feature offered by our hosting provider is enabled for this virtual server.

3. Technical Server Logs

Like virtually every web server, our server automatically records certain technical information for every request it receives, for example: IP address, date and time of the request, the requested URL, HTTP status code, amount of data transferred, referrer, browser/user-agent string, and (if present) the X-Forwarded-For header.

IP address data contained in these logs is anonymized by our web server itself before a log line is ever written to disk — this happens at the point of logging, not as a later or optional step. For IPv4 addresses, the last octet is replaced with 0 (e.g. 203.0.113.42 becomes 203.0.113.0); for IPv6 addresses, everything beyond the network prefix is removed (e.g. 2001:db8:1234:5678:90ab:cdef:1234:5678 becomes 2001:db8:1234:5678::). This applies to every IP address our server records, including the X-Forwarded-For header field if a request happens to include one. Full IPv4 addresses are not stored.

These logs are used exclusively for:

  • Diagnosing and fixing technical errors, and
  • Capacity and resource planning.

We also generate aggregated usage statistics from these already-anonymized logs using a self-hosted, cookie-free analytics tool (GoAccess) that we operate ourselves on our own infrastructure, accessible only to us behind a password. GoAccess only ever processes address data that our web server has already anonymized as described above — it never receives, and therefore cannot store, a full IP address. This tool is used solely to understand overall traffic patterns for the purposes listed above. We do not use Google Analytics or any other third-party analytics or tracking service, and no tracking cookies or third-party scripts are loaded for this purpose.

Server logs, already anonymized as described above, are processed exclusively for error analysis and resource planning and are deleted after 14 days at the latest. The aggregated GoAccess statistics produced from them are kept on an ongoing basis for resource planning, since they never contained full IP addresses to begin with. Server logs are processed on the legal basis of our legitimate interest (Art. 6(1)(f) GDPR) in operating a secure and reliable website.

4. Local Processing in Konvi Tools

Konvi.ch provides browser-based tools for text, data, developer, file, media and utility tasks. Unless stated otherwise on a specific tool's page, text and files you enter or drop into a tool are processed entirely inside your own browser using JavaScript (and, for some tools, WebAssembly) — they are not uploaded or transmitted to our server or to any third party.

Some tools (for example the OCR and e-invoice validation tools) load additional engine or model files (JavaScript/WebAssembly binaries) from our own server the first time you use them, so the tool can run locally in your browser; these downloads contain only program code, never your document content, and are cached by your browser to avoid repeated downloads.

The contact form is the one deliberate exception to local-only processing on this site — see Section 6 below.

5. Browser Storage (Theme & Language)

We use your browser's localStorage to remember a small number of technical preferences on every page load:

  • Theme preference (konvi-theme): stores whether you prefer light or dark mode.
  • Language preference (konvi-lang): stores your interface language. Currently, English is the only fully available language on Konvi.ch; additional languages may be added in the future.

The theme preference (konvi-theme) is written only when you actively click the theme toggle button — it is never set automatically just because you visited a page. The language preference (konvi-lang) is not currently written by any page (English is the only fully available language today). Neither value ever contains any personal information, unique identifier, or tracking value. You can clear them at any time through your browser settings.

Some tools additionally use short-lived browser storage for their own functionality, for example a sessionStorage entry used to pass output from one tool to another when you use the "send to another tool" feature (removed automatically once read, and cleared when you close the browser tab), and a browser cache used by the OCR tool to store its own engine/language-model files (not your documents) so they don't need to be re-downloaded on your next visit. This site also uses a Service Worker and the browser's Cache Storage to cache static assets (CSS/JS/images) for offline use and faster loading; this cache never contains your tool inputs or file content.

We do not set any cookies.

6. Contact Form and Attachments

If you use our contact form, the information you actively choose to submit is sent to our server so that we can respond to you. This is the one place on Konvi.ch where data you provide leaves your browser.

  • Your name and email address are voluntary — you are not required to provide them.
  • Your message and, if you choose to add one, a file attachment (e.g. a log file or screenshot) are transmitted to help us understand and respond to your request.

Before transmission, your form data and any attached file are encrypted in your browser using a hybrid RSA/AES-256 encryption scheme: a random AES-256 key is generated for your submission, used to encrypt your message and file locally, and is itself encrypted with our public RSA key. Only our server holds the corresponding private key needed to decrypt this content. Please do not include passwords, private keys, one-time/TOTP secrets, or unnecessary personal data belonging to third parties in your message or attachment.

The information submitted through the contact form, and any attachment, is used exclusively to process and answer your request. Any temporary file created on our web server while handling an attachment is deleted automatically immediately after the request has been forwarded internally, regardless of whether that forwarding succeeds. Once your request has been finally answered, the received request and any attachment are deleted; this final deletion is a manual step carried out by whoever answers your request, not an automated function of the website.

We process contact-form submissions on the legal basis of your consent (Art. 6(1)(a) GDPR) and, where your message concerns a technical issue with the site, our legitimate interest in maintaining and fixing our service (Art. 6(1)(f) GDPR).

7. Recipients and Processors

Aside from ComputeBox as our hosting/infrastructure provider (Section 2), we do not share data collected through this website with any other third party, and we do not use any third-party analytics, advertising, or tracking service. We do not sell or rent any data.

8. Storage Duration

  • Theme/language preferences: remain in your browser's local storage until you clear them yourself or clear your browser data.
  • Tool-chaining and similar temporary browser storage: cleared automatically after use or when you close the browser tab.
  • Cached engine/model files and static assets: remain in your browser's cache until it is cleared or evicted by the browser.
  • Server logs: already anonymized (last IPv4 octet / IPv6 host suffix removed) at the moment they are written; deleted automatically after 14 days at the latest; see Section 3.
  • Contact form submissions: temporary attachment files on the web server are deleted automatically immediately after forwarding; the received request itself is deleted manually once finally answered; see Section 6.

9. Your Rights

Under the GDPR, you have the right to request access to, rectification of, or erasure of your personal data, to request restriction of or object to processing, and to data portability, insofar as these rights apply. To exercise any of these rights, please contact us using the details in Section 1.

10. Right to Lodge a Complaint

You have the right to lodge a complaint with a data protection supervisory authority, in particular in the EU member state of your habitual residence, place of work, or the place of the alleged infringement. The supervisory authority responsible for us is the Landesbeauftragte für den Datenschutz und für das Recht auf Akteneinsicht Brandenburg (LDA Brandenburg).

11. Changes to This Policy

We may update this privacy policy from time to time, for example to reflect changes to our tools, hosting, or legal requirements. The current version always applies; the date below shows when it was last updated.

Last updated: 2026