Privacy policy

The controller within the meaning of the General Data Protection Regulation (GDPR) and other data protection provisions is:

tinytools.cc c/o GAM Pappelallee 64, 10437 Berlin Email: [email protected]

TinyTools is designed to process as little personal data as possible. Visitors do not need an account, and most tools process input only locally in your browser. Text, files, passwords and QR code content you enter are not sent to us and not stored.

Personal data is any information relating to an identified or identifiable natural person. We only process data where this is permitted by law.

This website is hosted by our hosting provider. When you visit the site, the server automatically processes technical connection data transmitted by your browser. This includes:

• IP address of the requesting device
• date and time of the request
• requested page or file and amount of data transferred
• HTTP status code
• browser type and version, operating system, referrer URL

The processing is technically necessary to deliver the website, to ensure its stability and security and to defend against attacks. The legal basis is Art. 6(1)(f) GDPR (legitimate interest in secure and functional operation). Log data is deleted after a short period unless needed to investigate a security incident.

Where required, a data processing agreement under Art. 28 GDPR is in place with the hosting provider.

Calculators, generators and text, developer, image and PDF tools work entirely in your browser wherever technically possible. Your input and files do not leave your device and nothing is transmitted to us or to third parties. We therefore have no access to this content.

Some features can only be provided with the help of our server, for example fetching and delivering a file based on a link you enter. In that case the link or identifier you enter is transmitted to our server and used there only for the duration of processing. The server retrieves the content from the respective provider; our server's address, not yours, is transmitted to that provider. Intermediate results are deleted after delivery. The legal basis is Art. 6(1)(b) GDPR (providing the function you requested). You are responsible for being entitled to use the content and for complying with the respective provider's terms of use.

To understand which tools are used and to improve the service, we count tool usage. Only the following information is stored:

• the identifier of the tool
• the type of event (for example “used” or “API call”)
• the time
• for QR codes, additionally the type of code (for example URL or WiFi)

Not stored are your input, the content of QR codes, IP addresses, device or browser identifiers, cookies or any other features that would allow recognition. The statistics therefore contain no personal data. Should processing nevertheless be assumed, the legal basis would be Art. 6(1)(f) GDPR. No information is stored on or read from your device for this purpose.

We ourselves only use storage and access functions that are necessary for the use of the website you expressly requested. Under § 25(2) no. 2 TDDDG no consent is required for these:

• Cookie “tt_lang”: stores the language you selected (lifetime up to 1 year).
• Your browser's local storage (“tt:favorites”, “tt:recent”): stores your favorites and recently used tools. This data stays on your device only and is not sent to us. You can delete it at any time in your browser settings.
• Your browser's local storage (“tt:consent”): stores your cookie choice (consent or rejection) with a timestamp for up to 6 months so that we do not ask again and can prove consent (Art. 7(1) GDPR).
• Administrators receive a technically necessary session cookie when signing in to the admin area.

Any personal data processed in this context is based on Art. 6(1)(f) GDPR (legitimate interest in a user-friendly presentation). The embedded advertising service Google AdSense additionally sets its own cookies (see section 9). Google Analytics only sets cookies after your consent (see section 10).

When you call our public API, the address of the requesting client is held only transiently in memory to enforce a limit on requests per minute and to prevent abuse. It is not written to disk, the database or logs and is discarded after a short time. Calls are counted anonymously per endpoint (see section 6). The legal basis is Art. 6(1)(f) GDPR (protection against abuse and overload).

To finance the free service we show ads from Google AdSense (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland; parent company Google LLC, USA). Cookies and similar technologies may be used to deliver, measure and, where applicable, personalize ads. Personal data such as the IP address may be transmitted to Google, including to the USA.

The integration is based on our legitimate interest in financing the service (Art. 6(1)(f) GDPR). You can switch off personalized advertising in Google's ad settings at https://adssettings.google.com and block or delete cookies in your browser. Transfers to the USA rely on the EU Commission's adequacy decision (EU-US Data Privacy Framework) or standard contractual clauses. More information: https://policies.google.com/technologies/ads

We check locally in your browser whether an ad blocker prevents ads from being delivered and show a notice if so. This creates an invisible test element on the page and sends a request to Google's ad server. The result is neither stored nor transmitted to us.

We use Google Analytics 4, a web analytics service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (parent company Google LLC, USA). It helps us understand which pages are used, from which countries and on which devices, and how visitors find our site.

Cookies (for example “_ga”, with a lifetime of up to 2 years) are set and data such as pages viewed, approximate location, device and browser information and a pseudonymous identifier is processed. IP addresses are not logged or stored in Google Analytics 4. We have disabled personalized advertising features and Google signals. Data may be transferred to the USA (EU-US Data Privacy Framework / standard contractual clauses).

Google Analytics is only loaded with your consent (§ 25(1) TDDDG, Art. 6(1)(a) GDPR), which you can give via the banner on your first visit. You can withdraw or change it at any time with effect for the future via “Cookie settings” in the footer of every page; the Google Analytics cookies are then deleted. Without consent Google Analytics is not loaded and no data is sent to Google. Alternatively you can prevent collection with the browser add-on at https://tools.google.com/dlpage/gaoptout.

To deliver this website quickly and securely we use Cloudflare (Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA). Requests to our website are routed through Cloudflare's servers. Cloudflare processes technical connection data, in particular the IP address, to cache content, defend against attacks and create statistics. Cloudflare may set technically necessary cookies for this.

The legal basis is our legitimate interest in secure and high-performing operation (Art. 6(1)(f) GDPR). Transfers to the USA rely on the EU-US Data Privacy Framework or standard contractual clauses. A data processing agreement is in place with Cloudflare.

If you contact us by email, we process your details (email address, message content) to handle your request. The legal basis is Art. 6(1)(f) GDPR, or Art. 6(1)(b) GDPR if the request concerns a contract or pre-contractual measures. Data is deleted once it is no longer needed for its purpose and no statutory retention duties apply.

Recipients of personal data are only our hosting provider as processor and, if advertising is enabled, the advertising provider named above. Data is not passed on to third parties beyond this unless we are legally obliged to do so. Transfers to third countries only take place where the requirements of Art. 44 et seq. GDPR are met.

We store personal data only as long as necessary for the respective purpose. Server log files are deleted after a short time. The anonymous usage statistics contain no personal data and are kept for analysis. Statutory retention periods remain unaffected.

You have the following rights with regard to your personal data:

• Right of access (Art. 15 GDPR)
• Right to rectification (Art. 16 GDPR)
• Right to erasure (Art. 17 GDPR)
• Right to restriction of processing (Art. 18 GDPR)
• Right to data portability (Art. 20 GDPR)
• Right to withdraw consent given, with effect for the future (Art. 7(3) GDPR)
• Right to lodge a complaint with a supervisory authority (Art. 77 GDPR)

To exercise your rights, an informal message to the contact details above is sufficient.

Where we process data on the basis of legitimate interests (Art. 6(1)(f) GDPR), you have the right to object at any time, on grounds relating to your particular situation, to the processing. We will then no longer process the data unless we can demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or the processing serves to establish, exercise or defend legal claims.

For security reasons this website uses SSL/TLS encryption. You can recognize an encrypted connection by “https://” and the lock symbol in your browser's address bar. We also take appropriate technical and organizational measures to protect your data. No automated decision-making, including profiling, takes place.

We update this privacy policy when our service or legal requirements change. The version published here applies.