Skip to content
mtool
Theme

Privacy Policy

How we handle personal data when you use mtool's tools, account and website.

Last updated:

1. Who we are

The controller of your personal data is Arsenii Ovsianykov, a sole trader, at ul. 3 Maja 22/2c, 40-096 Katowice, Poland. For anything about your data, email hello@mtool.io. Our registration details are in the Imprint.

2. What we process

Tools.

  • Most tools process your input and results in your browser and send nothing to our servers. Each tool page says where the tool runs.
  • A tool that uses our servers explains what it sends before you use it.
  • Some tools use features of your browser or device, such as speech. These may involve the provider of that feature.
  • When you share or export a result, it goes where you send it.

Visiting the website. When you open a page, our hosting provider and our servers process:

  • your IP address;
  • the page address;
  • the time;
  • your browser's details;
  • the referring page.

We need this to deliver the website and keep it secure.

Analytics. We count visits and tool use with Umami, which we run ourselves. See section 5.

Your account.

  • Account data. We keep:
    • your email address;
    • an internal account ID;
    • whether your email is verified;
    • your name, if Google provides it;
    • when the account was created and last updated.
  • Google sign-in. If you sign in with Google, Google gives us your email address, name and Google account ID. We keep the ID to recognise your Google sign-in. We don't keep your Google profile picture or Google's access tokens.
  • Email sign-in. We send a one-time link that works for 10 minutes. We store a fingerprint (hash) of the link, never the link itself. Our email provider receives your email address and the message with the link, in order to deliver it.
  • The sign-in record. While you sign in, we keep a short-lived record with:
    • that fingerprint;
    • the Terms version you accept and its language;
    • the time;
    • the page to return to afterwards.
  • Favourites and Terms. We keep your favourite tools, each with the time you saved it. We also keep a record of the Terms you accepted: version, language and time.
  • Sessions. For each device where you are signed in, we keep when you signed in and when you last used your account, recorded at most once a day. We keep the browser and operating system names, and an approximate location (city and country) that our hosting provider works out from your IP address at sign-in, when these details are available. We keep neither the IP address nor the full browser string in the session. You can see your sessions and end them on the account page. A session is deleted when you sign out of it, end it on the account page or delete your account. A session ends after up to 30 days without use and no later than 90 days after sign-in; expired sessions are deleted within 3 days.
  • What's required. An email address is needed to have an account. Google sign-in is optional. Tools that don't need an account work without one.
  • Age. Accounts are for people aged 18 or older.

Security. To prevent abuse, we keep request counters based on IP addresses, keyed fingerprints of email addresses, and account IDs.

Messages to us. When you write to us, we process your email address, your message, and any account details we need to help you. Our mailbox runs on Google Workspace.

3. Why we process it, and the legal basis

All legal bases refer to the GDPR.

Delivering the website and keeping it secure

Data
IP address, page address, time, browser details, referring page
Legal basis
Legitimate interest in running a reliable and secure website: art. 6(1)(f)

Providing your account: sign-in, account features, data download, deletion and service emails

Data
Account data, Google link, sessions and sign-in records, favourites
Legal basis
Performing our contract with you: art. 6(1)(b)

Keeping a record of the Terms you accepted

Data
Terms version, language and time
Legal basis
Legitimate interest in being able to show what was agreed: art. 6(1)(f)

Preventing abuse and protecting accounts

Data
Request counters, keyed email fingerprints, account IDs, security records; session browser and operating system names, approximate city and country, sign-in and last activity times
Legal basis
Legitimate interest in preventing abuse and unauthorised access: art. 6(1)(f)

Understanding how mtool is used, and improving it

Data
Analytics records (section 5)
Legal basis
Legitimate interest in understanding use, finding failures and improving the tools: art. 6(1)(f)

Diagnosing faults

Data
Server and application logs
Legal basis
Legitimate interest in keeping the service working: art. 6(1)(f)

Backing up and restoring the service

Data
Encrypted database backups; a list of deleted account IDs with deletion times
Legal basis
Legitimate interest in recovering from failures without bringing deleted accounts back: art. 6(1)(f)

Answering your messages

Data
Your email address, your message, relevant account details
Legal basis
Performing our contract, where the message is about your account: art. 6(1)(b). Otherwise, legitimate interest in replying: art. 6(1)(f)

Handling complaints and privacy requests

Data
Contact details, the request, information needed to confirm your identity
Legal basis
Complying with our legal obligations: art. 6(1)(c)

Remembering settings and tool state in your browser

Data
See section 4
Legal basis
Where personal data is involved, legitimate interest in providing the features you use: art. 6(1)(f)

4. Cookies and browser storage

  • Cookies are small pieces of data that your browser sends with requests to our website.
  • localStorage keeps data in your browser between visits.
  • sessionStorage keeps data only while the tab is open.

We use only what's needed for the features you use: signing in, keeping your account secure, and remembering the settings and tool state you choose. These don't require your consent.

Optional cookies and similar technologies, such as those of third-party analytics or marketing services, are used only with your consent. When we use them, we'll ask before they're set. You can then change your choice at any time in Cookie settings, at the bottom of the page.

__Host-mt.session

Type
Cookie
Purpose
A random session key that keeps you signed in. Page scripts can't read it.
Lifetime
30 days, renewed while you use the account. The server stops accepting the session no later than 90 days after sign-in.

mt.signed-in

Type
Cookie
Purpose
Tells the page to check whether you're signed in. It isn't a secret.
Lifetime
Same as the session cookie

mt.state

Type
Cookie
Purpose
For security, links a Google sign-in to the browser that started it.
Lifetime
Up to 5 minutes

NEXT_LOCALE

Type
Cookie
Purpose
Your interface language.
Lifetime
Up to 1 year

theme

Type
localStorage
Purpose
Your light or dark theme.
Lifetime
Until you change it

mtool:preferred-output-locale:v1

Type
localStorage
Purpose
Your preferred language for generated output.
Lifetime
Until you change it

Keys starting with mtool: or mtool-

Type
localStorage
Purpose
Settings and progress of the tools you use, such as generator settings or training progress.
Lifetime
Until you reset or change them

mt.pending-favourite

Type
localStorage
Purpose
The tool you asked to save while signed out, and the page to return to.
Lifetime
Up to 1 hour

mt.google-sign-in

Type
sessionStorage
Purpose
The page to return to after Google sign-in.
Lifetime
Up to 5 minutes

mt.signed-in-notice

Type
sessionStorage
Purpose
Shows the "signed in" notice once.
Lifetime
Up to 30 seconds

mt.favourites: followed by your account ID

Type
sessionStorage
Purpose
A copy of your favourites, so that pages show them faster.
Lifetime
Until you close the tab or sign out

If our hosting provider needs to check that a visitor isn't an automated attack, it may set a short-lived security cookie.

Some entries stay in your browser after they expire, until the site next checks them or you clear your browser data.

You can delete cookies and browser storage in your browser settings. This removes your settings and tool progress, and may sign you out. It doesn't delete your account or your favourites. If you block cookies, you can't sign in.

5. Analytics

We use Umami, an analytics tool we run ourselves on our server in Germany.

  • Requests go through our own domain.
  • Analytics records stay on our server. Only our hosting providers, listed in section 6, process them, on our instructions.
  • Umami sets no cookies and stores nothing in your browser.

What a record contains. For each page view and tool action, we store a record with:

  • the time;
  • the page;
  • the referring site;
  • your language;
  • your browser and operating system;
  • your device type and screen size;
  • your approximate location: country, region and city.

Identifiers. Records are grouped by session and visit identifiers. Our server derives them from your IP address and browser details, and they change at least once a month. Your IP address isn't stored in the analytics database.

Actions we record. These include starting a tool, copying or downloading a result, the steps of signing in, and saving or removing a favourite. They never include:

  • your account ID or email address;
  • what you type or upload;
  • your results;
  • file names.

Page addresses. Before page addresses and referrers are recorded, we remove the query string and the part after "#". The one exception is a marker showing that a page was opened from a shared link.

We use analytics on the basis of our legitimate interest in understanding how mtool is used, finding failures and improving the tools. You can object at any time; see section 9. We delete analytics records after 25 months.

6. Who receives your data

We use the providers below. Each processes data only on our instructions, under a data processing agreement, unless stated otherwise.

Vercel Inc.

What it does
Hosts and delivers the website, works out the approximate sign-in location from your IP address, and forwards account requests to our server. For its own security and service operations, Vercel is also an independent controller of some technical data, under its privacy notice.
Where
Worldwide network; USA

Hetzner Online GmbH

What it does
Runs our server, account database and analytics.
Where
Falkenstein, Germany

Resend (Plus Five Five, Inc.)

What it does
Sends sign-in and account emails.
Where
USA

Google

What it does
Google Workspace hosts our mailbox. For Google sign-in, Google Ireland Limited or Google LLC, depending on where you live, is the controller of your Google Account under Google's privacy policy. It gives us the details listed in section 2.
Where
EU and USA

Backblaze, Inc.

What it does
Stores our database backups. They are encrypted before upload, and Backblaze can't read them.
Where
Amsterdam, Netherlands; its support may access the service from the USA

We may also disclose data to public authorities when the law requires it.

7. Transfers outside the EEA

Our servers are in Germany and our backups are in the Netherlands. Vercel, Resend and Google may process data in the United States, and Backblaze may access its service from there.

These transfers rely on two safeguards:

  • the European Commission's Standard Contractual Clauses in our providers' data processing agreements;
  • where a provider is certified, the EU–US Data Privacy Framework.

You can ask us for a copy of the safeguards.

8. How long we keep data

Account data

How long
Until you delete your account

Google link

How long
Until you unlink Google or delete your account

Favourites

How long
Until you remove them or delete your account

Record of the Terms you accepted

How long
Until you delete your account

Sessions

How long
Deleted when you sign out of the session, end it on the account page or delete your account. A session ends after up to 30 days without use, and no later than 90 days after sign-in. Expired sessions are deleted within 3 days.

Sign-in records

How long
Deleted once used, or within 2 days after the link expires

Abuse-prevention counters

How long
Up to 2 days

Browser storage

How long
See section 4

Analytics records

How long
25 months

Request logs at Vercel

How long
1 day

Logs on our servers

How long
Up to 30 days

Emails sent through Resend, and their delivery logs

How long
30 days at Resend

Correspondence, complaints and privacy requests

How long
3 years after the matter is closed. Longer only if needed to establish, exercise or defend legal claims.

Encrypted backups

How long
Up to about 5 weeks

List of deleted accounts, used when restoring a backup

How long
Up to about 12 weeks

Account data downloads

How long
Not kept: the file is created when you download it

When you delete your account, we delete it at once, together with its favourites, Terms record, sessions and Google link, and sign you out on all devices.

  • Copies remain in encrypted backups until those expire.
  • We keep a list of deleted account IDs and deletion times, and apply it to a restored backup before it goes back into service. This way, a restored backup doesn't bring a deleted account back.
  • Deleting your account doesn't delete security records, past correspondence or data in your browser. Their own periods apply.

9. Your rights

Under the GDPR, you have the right to:

  • access your personal data and get a copy;
  • have inaccurate data corrected;
  • have data deleted or its processing restricted, where the GDPR allows;
  • receive the data you gave us in a machine-readable format and have it sent to another controller, where the GDPR allows;
  • withdraw consent at any time, where we rely on consent, without affecting earlier processing.

Right to object. You can object at any time, on grounds relating to your situation, to processing based on our legitimate interests, including analytics. We then stop, unless we can demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or need the data to establish, exercise or defend legal claims.

How to use your rights. Email hello@mtool.io. We may ask for information to confirm your identity.

  • Analytics records aren't linked to your name, email or account, so we may need more details from you to find them.
  • We reply within one month. For complex or numerous requests, this can be extended by up to two more months. If so, we tell you why within the first month.

Your account data. On your account page, you can download it as a file: your email address, account creation date, sign-in methods, favourites, Terms record and stored sessions with their browser, operating system, city, country, sign-in and last activity times. You can still ask for access to other data we hold.

Complaints. You can complain to the President of the Personal Data Protection Office (UODO) in Poland, at uodo.gov.pl, or to the data protection authority where you live or work.

We don't make decisions about you based solely on automated processing that have legal or similarly significant effects on you.

10. Changes to this policy

We update this policy when our processing changes. The date at the top shows the current version. Before we use your data for a new purpose, we tell you, and we ask for consent where it's required.