Privacy Policy
Last updated: October 8, 2026
1. Controller
petuja.tools is operated by petuja Systems UG (haftungsbeschränkt). Full provider and contact details are available in the central imprint.
2. Principles
We process personal data only where necessary for secure website operation, communication or a tool function requested by you. Many converters, calculators and generators run entirely in your browser. Server-side functions process only the data required for the respective request.
3. Website access and server logs
When you access the website, technically required data such as IP address, date and time, requested URL, referrer, browser information and HTTP status may be processed. This supports delivery, error analysis, attack prevention and abuse protection. The legal basis is Art. 6(1)(f) GDPR. Server logs are retained only as long as required for operation and security or where legal obligations require longer retention.
4. Local storage
The website uses local browser storage for language, color mode and optional clock-tool settings. These values remain on your device and are not sent to us. Certain forms and security-sensitive functions use technically necessary session cookies for CSRF protection, session management and form limits; they expire when you close the browser. For the Gravatar Checker, the server keeps a counter and reset time in the session, limiting it to 10 requests per 60-second window. This storage is not used for tracking.
5. Visit counts and request limits
For individual tool view counts and abuse protection, we use pseudonymous IP identifiers. For IPv4, only the /24 network prefix is used before HMAC generation; for IPv6, the address is protected with HMAC. View-count identifiers are deleted after 60 minutes through technical cleanup. QuickAI and the Gravatar Checker use separate IP counters in the existing API-limit store. The Gravatar Checker limits requests to 20 per pseudonymous IP identifier per hour. Each API counter stores a pseudonymous IP identifier, request count, reset time and expiry, but no email address, Gravatar hash or avatar. QuickAI records expire after six hours and Gravatar IP records after one hour; cleanup runs every 15 minutes and removes records on the next run. Older records without an expiry are removed after six hours and no later than the next cleanup run. This processing supports secure, proportionate operation and is based on Art. 6(1)(f) GDPR.
6. DNS and IP tools
For DNS, MX, BIMI, reverse-DNS and similar network tools, the entered domain or IP address is passed to the server DNS resolver. The tools do not open an HTTP connection to the submitted domain; in particular, the BIMI checker does not download referenced logos or certificates. Inputs are not stored as a separate tool history.
7. Gravatar Checker
When you use the Gravatar Checker, your email address is trimmed, lowercased and hashed with SHA-256 only in your browser. The plain-text address is not sent to petuja.tools for this lookup. Our backend receives only the resulting pseudonymous hash; our server uses it for the lookup you requested and fetches any matching image from Gravatar. Your browser receives the validated image from petuja.tools and does not connect directly to Gravatar for this lookup. Automattic, the provider of Gravatar, receives the hash and technical connection data for the request, including our server’s IP address. According to its privacy policy, Automattic may also process data outside the EEA. We do not store the hash or avatar as lookup history. For details, see the Automattic Privacy Policy.
8. Contact forms
If you contact us through a form, we process the content you enter, the related page URL, your optional email address and technical security data. The message is transmitted to our mailbox using TLS transport encryption and is not stored in the website database. We use the data only to handle your request and retain it in the mailbox only as long as needed for processing, evidence and legal obligations.
9. Cloudflare Turnstile
Our contact forms use Cloudflare Turnstile to detect automated spam and abuse. Cloudflare may process, in particular, IP address, browser and device information, interaction data, the page URL and a verification token. The legal basis is Art. 6(1)(f) GDPR. More information is available in the Cloudflare Privacy Policy.
10. QuickAI, AI SVG Generator and OpenRouter
When you actively use QuickAI or the AI SVG Generator, the text or prompt you enter, the requested AI action and the required technical parameters are sent server-side to OpenRouter. OpenRouter forwards the request to a selected model provider and returns the response to your browser. The application sets data_collection: deny, zdr: true and require_parameters: true on every request; it sends no browser headers, IP address, email address, session ID or trace identifier to OpenRouter. OpenRouter may still process technical metadata such as model, provider, token counts, cost and latency; depending on the provider, processing outside the EU or EEA may be possible. We do not store prompts or responses in the website database or AI metrics; only aggregate technical counters for requests, models, providers, tokens and costs without content are kept there. Do not enter sensitive or confidential data.
11. Recipients and international transfers
Recipients of personal data may include hosting and email providers, Cloudflare, Google Ireland Limited and, depending on the AdSense service, Google LLC and listed advertising partners when the consent interface or ads load, and Automattic when you actively use the Gravatar Checker. The exact hosting and email providers and applicable safeguards for transfers outside the EU or EEA are determined by the contracts and provider documentation in use. Except for tool requests you explicitly initiate, external links are only opened when you select them; their respective providers are responsible for their content and privacy practices.
12. Your rights
Subject to the GDPR, you have the right of access, rectification, erasure, restriction of processing, data portability and objection to processing based on legitimate interests. You also have the right to lodge a complaint with a data protection supervisory authority.
13. Updates
We update this privacy policy when functions, providers or legal bases change.
14. Google AdSense, advertising and consent management
We use Google AdSense on petuja.tools. For users in the EEA, the provider is generally Google Ireland Limited; depending on the service, Google LLC and the advertising partners listed in the consent interface may be additional recipients. When the AdSense code loads, data needed to deliver the consent interface may already be sent to Google, in particular the IP address, browser and device information, requested page, referrer, time and security data. With your consent, Google and its advertising partners may use cookies or comparable storage technologies and process page views, consent choices and ad interactions for personalized or non-personalized advertising, audience measurement, reporting and fraud prevention. The legal basis for consent is Art. 6(1)(a) GDPR and Section 25(1) TDDDG. Processing necessary for transmission, security and abuse prevention may be based on Art. 6(1)(f) GDPR. If you decline, we do not permit personalized advertising or cookie-based non-personalized advertising; at most, limited ads supported by Google without consent may be delivered in accordance with the selected AdSense settings. Data may also be processed outside the EEA, subject to the transfer mechanisms and safeguards described by Google. Retention depends on the purpose, consent status and settings of the providers involved. You can change your choice at any time with effect for the future through “Privacy and cookie settings” in the footer. Learn more about how Google uses data on partner sites, the Google Privacy Policy and Google Ads Settings.
1. Controller
petuja.tools is operated by petuja Systems UG (haftungsbeschränkt). Full provider and contact details are available in the central imprint.
2. Principles
We process personal data only where necessary for secure website operation, communication or a tool function requested by you. Many converters, calculators and generators run entirely in your browser. Server-side functions process only the data required for the respective request.
3. Website access and server logs
When you access the website, technically required data such as IP address, date and time, requested URL, referrer, browser information and HTTP status may be processed. This supports delivery, error analysis, attack prevention and abuse protection. The legal basis is Art. 6(1)(f) GDPR. Server logs are retained only as long as required for operation and security or where legal obligations require longer retention.
4. Local storage
The website uses local browser storage for language, color mode and optional clock-tool settings. These values remain on your device and are not sent to us. Certain forms and security-sensitive functions use technically necessary session cookies for CSRF protection, session management and form limits; they expire when you close the browser. For the Gravatar Checker, the server keeps a counter and reset time in the session, limiting it to 10 requests per 60-second window. This storage is not used for tracking.
5. Visit counts and request limits
For individual tool view counts and abuse protection, we use pseudonymous IP identifiers. For IPv4, only the /24 network prefix is used before HMAC generation; for IPv6, the address is protected with HMAC. View-count identifiers are deleted after 60 minutes through technical cleanup. QuickAI and the Gravatar Checker use separate IP counters in the existing API-limit store. The Gravatar Checker limits requests to 20 per pseudonymous IP identifier per hour. Each API counter stores a pseudonymous IP identifier, request count, reset time and expiry, but no email address, Gravatar hash or avatar. QuickAI records expire after six hours and Gravatar IP records after one hour; cleanup runs every 15 minutes and removes records on the next run. Older records without an expiry are removed after six hours and no later than the next cleanup run. This processing supports secure, proportionate operation and is based on Art. 6(1)(f) GDPR.
6. DNS and IP tools
For DNS, MX, BIMI, reverse-DNS and similar network tools, the entered domain or IP address is passed to the server DNS resolver. The tools do not open an HTTP connection to the submitted domain; in particular, the BIMI checker does not download referenced logos or certificates. Inputs are not stored as a separate tool history.
7. Gravatar Checker
When you use the Gravatar Checker, your email address is trimmed, lowercased and hashed with SHA-256 only in your browser. The plain-text address is not sent to petuja.tools for this lookup. Our backend receives only the resulting pseudonymous hash; our server uses it for the lookup you requested and fetches any matching image from Gravatar. Your browser receives the validated image from petuja.tools and does not connect directly to Gravatar for this lookup. Automattic, the provider of Gravatar, receives the hash and technical connection data for the request, including our server’s IP address. According to its privacy policy, Automattic may also process data outside the EEA. We do not store the hash or avatar as lookup history. For details, see the Automattic Privacy Policy.
8. Contact forms
If you contact us through a form, we process the content you enter, the related page URL, your optional email address and technical security data. The message is transmitted to our mailbox using TLS transport encryption and is not stored in the website database. We use the data only to handle your request and retain it in the mailbox only as long as needed for processing, evidence and legal obligations.
9. Cloudflare Turnstile
Our contact forms use Cloudflare Turnstile to detect automated spam and abuse. Cloudflare may process, in particular, IP address, browser and device information, interaction data, the page URL and a verification token. The legal basis is Art. 6(1)(f) GDPR. More information is available in the Cloudflare Privacy Policy.
10. QuickAI, AI SVG Generator and OpenRouter
When you actively use QuickAI or the AI SVG Generator, the text or prompt you enter, the requested AI action and the required technical parameters are sent server-side to OpenRouter. OpenRouter forwards the request to a selected model provider and returns the response to your browser. The application sets data_collection: deny, zdr: true and require_parameters: true on every request; it sends no browser headers, IP address, email address, session ID or trace identifier to OpenRouter. OpenRouter may still process technical metadata such as model, provider, token counts, cost and latency; depending on the provider, processing outside the EU or EEA may be possible. We do not store prompts or responses in the website database or AI metrics; only aggregate technical counters for requests, models, providers, tokens and costs without content are kept there. Do not enter sensitive or confidential data.
11. Recipients and international transfers
Recipients of personal data may include hosting and email providers, Cloudflare, Google Ireland Limited and, depending on the AdSense service, Google LLC and listed advertising partners when the consent interface or ads load, and Automattic when you actively use the Gravatar Checker. The exact hosting and email providers and applicable safeguards for transfers outside the EU or EEA are determined by the contracts and provider documentation in use. Except for tool requests you explicitly initiate, external links are only opened when you select them; their respective providers are responsible for their content and privacy practices.
12. Your rights
Subject to the GDPR, you have the right of access, rectification, erasure, restriction of processing, data portability and objection to processing based on legitimate interests. You also have the right to lodge a complaint with a data protection supervisory authority.
13. Updates
We update this privacy policy when functions, providers or legal bases change.
14. Google AdSense, advertising and consent management
We use Google AdSense on petuja.tools. For users in the EEA, the provider is generally Google Ireland Limited; depending on the service, Google LLC and the advertising partners listed in the consent interface may be additional recipients. When the AdSense code loads, data needed to deliver the consent interface may already be sent to Google, in particular the IP address, browser and device information, requested page, referrer, time and security data. With your consent, Google and its advertising partners may use cookies or comparable storage technologies and process page views, consent choices and ad interactions for personalized or non-personalized advertising, audience measurement, reporting and fraud prevention. The legal basis for consent is Art. 6(1)(a) GDPR and Section 25(1) TDDDG. Processing necessary for transmission, security and abuse prevention may be based on Art. 6(1)(f) GDPR. If you decline, we do not permit personalized advertising or cookie-based non-personalized advertising; at most, limited ads supported by Google without consent may be delivered in accordance with the selected AdSense settings. Data may also be processed outside the EEA, subject to the transfer mechanisms and safeguards described by Google. Retention depends on the purpose, consent status and settings of the providers involved. You can change your choice at any time with effect for the future through “Privacy and cookie settings” in the footer. Learn more about how Google uses data on partner sites, the Google Privacy Policy and Google Ads Settings.