Privacy policy

Velra Tools (“we”, “us”) operates https://velra.tech. You can reach us at hello@velra.tech. This policy explains what we collect, why, and what you can do about it.

This is the most important thing on this page. Every file tool on this site — image compression, social image resizing, PDF to image conversion, favicon generation, logo upload in the invoice generator, and colour extraction from an image — runs entirely inside your browser using JavaScript and the Canvas API.

Your file is read from disk into your browser’s memory, processed there, and offered back to you as a download. It is never transmitted to us, never written to a server, and never seen by any third party. There is no upload step to intercept and nothing for us to retain. Closing the tab discards it.

Signing in is optional. Every tool works fully without an account. If you do sign in with Google, Google shares the following with us and we store it:

• Your email address — used to identify your account.
• Your name, as it appears on your Google account — shown in the header.
• Your profile picture URL — shown in the header.
• A Google account identifier — used to link your sign-ins to one account.

We do not receive or store your Google password. We do not request access to your Gmail, Drive, contacts, calendar or any other Google service. The only scope we ask for is your basic profile and email address.

Every completed tool action writes one row to our database recording which tool was used and when. For visitors who are not signed in, that row has no user attached — it is a counter, and it cannot be traced back to you. We use these counts to decide which tools to improve.

If you are signed in, the row is linked to your account and, for the tools that support saving, also stores the parameters needed to reopen your work. Concretely, that means:

• Invoices and quotes: line items, client and business details you typed, dates, currency, totals and notes.
• QR codes: the content you encoded and the colour settings.
• UTM links: the destination URL and campaign parameters.
• Colour palettes: the colour values.
• File tools: filenames, file sizes and the settings you chose — never the file itself, and never the image.
• Timesheets: the hours and rates you entered.

Two deliberate exclusions. Generated passwords are never recorded in any form — we log only that a password was generated and its length. Uploaded logos and images are never stored, even for signed-in users.

The suggestion form stores what you typed — the idea, any context you added, and your email address if you chose to give one. If you are signed in it is linked to your account so we can reply.

The email address is used for one thing: telling you when the tool exists. It is not added to a mailing list, not used for marketing, and not passed to anyone. Ask us and we will delete the suggestion.

Some features keep data in your browser’s local storage rather than on our servers. This never reaches us and stays on the device you used:

• Your theme and design preference.
• Your UTM link history, when you are not signed in.
• Whether you dismissed the “buy me a coffee” card.
• Which tools you have already given feedback on, so we do not ask twice.

Clearing your browser data removes all of it.

We use a session cookie when you sign in, to keep you signed in. It is essential to that feature and is not used for tracking. We do not set analytics cookies of our own.

Our advertising partner sets its own cookies from inside the ad frame — see the next section. Those are not ours and we cannot read them.

This site is funded by advertising. Our advertising partner is Adsterra, a third-party ad network. Ads are loaded inside an isolated frame on the page, and Adsterra and its own partners may collect data through that frame independently of us:

• Your IP address and the approximate location derived from it.
• Your browser, operating system, device type, language and time zone.
• Which page on this site the ad appeared on, and whether you interacted with it.
• Cookies and similar identifiers, set by Adsterra or its partners, used to select ads and to avoid showing you the same one repeatedly.

This happens under Adsterra’s own privacy policy, not ours. We do not control what they collect and we do not receive it. To limit interest-based advertising generally, the industry opt-out pages at youronlinechoices.eu (EU), aboutads.info (US) and optout.networkadvertising.org cover most networks; a tracking-protection setting or content blocker in your browser is more reliable than any of them.

We run display banners only. No popunders, no interstitials, no notification prompts and nothing that follows you down the page — this is a deliberate restriction and not something we intend to relax.

We do not share the contents of your files, your saved generations, or your email address with advertisers. There is nothing to share — the files never reach us.

We expect to move to Google AdSense once this domain is approved. When that happens this section will name Google instead, Google and its partners will use advertising cookies on the same basis described above, and you will be able to control personalisation at myadcenter.google.com. We will update the date at the top of this page when it changes.

We use a small number of service providers, each for one purpose:

• Hostinger — the virtual private server this site runs on, in Europe. Standard web server logs, including IP addresses, are processed there for security and abuse prevention.
• Supabase — managed PostgreSQL in Mumbai (ap-south-1). Holds account records, generation metadata and suggestions, encrypted at rest.
• Google — sign-in only. We use Google OAuth to authenticate you and request nothing beyond your basic profile and email address.
• Adsterra — advertising, as described above.
• Zoho Mail — our email. Anything you send to us is stored there.
• Ko-fi — donations. If you donate, Ko-fi handles the transaction and we never see your payment details.

We do not use Google Analytics or any other analytics product. The per-tool counters described above are our own and stay in our own database.

Account records and saved generations are kept until you delete them or delete your account. Anonymous usage rows — the ones with no user attached — are deleted automatically after 90 days by a nightly job; we only ever report on the last 30 days, so keeping them longer would be data we do not use. Server logs are retained by our host under their own policy, typically for a matter of days.

You can delete any individual saved generation, or all of them at once, from your dashboard.

To delete your account entirely, email hello@velra.tech from the address you signed up with and ask us to. We will remove your account record and everything linked to it within 30 days and confirm when it is done. You do not need to give a reason.

Depending on where you live, you may also have the right to access a copy of your data, correct it, restrict how we use it, or object to that use. Email us and we will action it. If you are in the UK or EU and you are not satisfied with our response, you may complain to your national data protection authority.

This site is not directed at children under 13, and we do not knowingly collect data from them. If you believe a child has provided us with personal data, contact us and we will delete it.

If we change this policy we will update the date at the top of this page. Material changes affecting how we handle personal data will be announced on the site.