The short version: the documents you watermark are processed entirely inside your browser. They are never uploaded to us or to anyone else. To run the site we do use a small set of third-party cookies for analytics and advertising — described in full below — which are switched off until you allow them through the consent banner.
This Privacy Policy explains how Kavrylo ("Kavrylo", "we", "us") handles information when you visit kavrylo.me (the "Service"). By using the Service you agree to the practices described here. If you do not agree, please do not use the Service.
1 Your documents stay on your device
Kavrylo is a client-side tool. When you add a watermark to a photo, ID card, passport, driver's license or PDF, the file is loaded and processed using your browser's own capabilities (the Canvas API and JavaScript PDF libraries).
- No upload. Your file is never transmitted to our servers or to any third party. It never leaves your device.
- No storage. We do not keep, copy or back up your documents. When you close or refresh the page, the file is gone from memory.
- No access. Because the file is never sent anywhere, neither we nor our service providers can ever see it.
As a result, the content of your documents falls entirely outside the scope of the data collection described in the rest of this policy.
2 Information we do process
While your documents stay local, visiting the website itself involves limited technical data, handled through the third-party tools listed in Section 4:
- Usage and device data — collected through Google Analytics only after you consent: pages viewed, approximate (city-level) location derived from your IP address, browser and device type, referring website, and how you move through the site.
- Advertising data — collected through Google AdSense to display and measure ads. By default ads are non-personalized; they are only personalized if you consent through the banner.
- Consent data — a record of the cookie choices you make in the consent banner, so we can honour them on future visits. This is set regardless of your choices because it is what makes your choices work.
- Server logs — our host may keep standard access logs (such as IP addresses) for security and operation. See Section 4.
We do not ask you to create an account, and we do not knowingly collect names, postal addresses or payment details through the Service.
3 Cookies and similar technologies
We use cookies and similar technologies for consent management, analytics and advertising. Only the consent record is strictly necessary. Analytics and advertising cookies are blocked until you consent — we apply Google Consent Mode with all analytics and advertising storage set to "denied" by default, and only switch them on once you accept them in the banner.
| Service | Provider | Purpose | Category | Typical retention |
|---|---|---|---|---|
| CookieYes | CookieYes | Stores and remembers your cookie consent preferences. | Necessary | Up to 1 year |
| Google Analytics | Measures audience and how visitors use the site (e.g. _ga, _ga_*). Set only after consent. |
Analytics | Up to 2 years | |
| Google AdSense | Delivers ads, caps frequency and measures performance; personalizes ads only with consent. | Advertising | Up to ~13–24 months |
Exact cookie names and lifetimes are set by each provider and may change. For the most current list, see the providers' own documentation.
Managing your choices
When you first visit, our consent banner (CookieYes) lets you accept or decline analytics and advertising cookies, with "reject" as easy as "accept". You can change your decision at any time by reopening the consent settings from the banner, or by clearing cookies in your browser. Most browsers also let you block or delete cookies through their settings.
4 Third-party services
We rely on a few external providers to operate the site. Each acts under its own privacy policy:
- Google (Google Ireland Ltd. / Google LLC) — Google Analytics and Google AdSense, for audience measurement and advertising. We also load web fonts from Google Fonts; when a page loads, this makes a request to Google's servers that includes your IP address.
- CookieYes — cookie-consent management.
- Neocities (500 Westover Dr #2147, Sanford, North Carolina 27330, United States) — website hosting. Neocities may keep standard server access logs (such as IP addresses) for security and operational purposes.
- UptimeRobot — uptime monitoring for our public status page.
We do not sell your personal data for money. Note that showing personalized ads through Google may, under some laws (such as California's CPRA), be treated as "sharing" for cross-context behavioural advertising — which is exactly what the consent banner lets you control. We otherwise only share data with the providers above to the extent needed for the purposes described here.
5 Legal bases for processing
Where the EU General Data Protection Regulation (GDPR) applies, we rely on the following legal bases:
- Consent — for analytics and advertising cookies, and for personalized ads. You can withdraw consent at any time, with the same ease as giving it.
- Legitimate interests — for keeping the site secure and operational (e.g. server logs held by our host), where those interests are not overridden by your rights.
6 International transfers
Some providers, including Google and Neocities, are based in or process data in the United States. Where data is transferred outside the European Economic Area, those providers rely on appropriate safeguards such as the EU Standard Contractual Clauses or applicable data-transfer frameworks (including the EU–US Data Privacy Framework).
7 Data retention
Your documents are not retained at all, as explained in Section 1. Cookie and analytics data are kept for the periods shown in Section 3, or until you withdraw consent or clear your cookies, whichever comes first. Server access logs held by our host are kept for its own limited operational periods.
8 Your rights
Subject to applicable law, you may have the right to:
- Access the personal data we hold about you;
- Request correction or deletion of that data;
- Object to or restrict certain processing;
- Withdraw consent for cookies at any time;
- Request portability of your data where applicable.
To exercise any of these rights, contact us at contact@kavrylo.me. If you are in the European Union, you also have the right to lodge a complaint with your local data protection authority.
9 Children
The Service is not directed at children, and we do not knowingly collect personal data from children under the age required by local law. If you believe a child has provided us with data, please contact us so we can address it.
10 Changes to this policy
We may update this Privacy Policy from time to time. When we do, we will revise the "Last updated" date at the top of this page. Significant changes may be highlighted on the site. Continued use of the Service after changes take effect constitutes acceptance of the updated policy.
11 Contact & legal information
For any question about this policy or your data, or to identify the data controller for the Service, reach us using the details below.