Privacy Policy

MV Tools provides browser-based and server-assisted utilities. This policy explains what data may be processed when you use the service.

Some tools run entirely in your browser. For these tools, your input is not intentionally sent to the MV Tools server.

You may create an account with an email address, password, and optional display name. Passwords are stored as hashes, not plaintext. Login sessions are used to keep you signed in and may be revoked from the account page.

MV Tools may send verification codes, password reset emails, and account or security messages. These emails are used only for service operation and account security.

If you send feedback through the feedback form or by email, MV Tools may keep your message, email address if provided, related page, locale, IP address, and user agent so we can respond, fix issues, and prevent abuse.

Some tools require server processing. Submitted content, URLs, keys, passwords, or files may be transmitted to the server only to complete the requested operation.

Generated files are temporary. The default retention period is 30 minutes.

To protect the service, MV Tools may process IP address, user agent, timestamps, login attempts, verification failures, and similar security or abuse-prevention information.

MV Tools does not intentionally store uploaded files, generated files, encryption passwords, private keys, plaintext, or decrypted output in a database beyond what is needed to complete the requested task.

Infrastructure logs may include IP address, request path, user agent, timestamps, status codes, and error information. These logs are used for troubleshooting, security, and abuse prevention.

With your permission, MV Tools uses Google Analytics to measure page views, language, device type, approximate region, and limited interactions such as starting a tool, reaching a result, downloading a result, or saving to cloud storage. Google Analytics may set cookies such as _ga.

MV Tools does not send tool inputs, submitted URLs, file names or contents, email addresses, cloud account details, or result links to Google Analytics. You can refuse or withdraw permission at any time through Cookie settings in the footer.

Requests may pass through DNS, CDN, hosting, or proxy providers. Target websites may receive requests from MV Tools infrastructure.

If you connect Google Drive or Dropbox, MV Tools stores the provider type, provider account ID, email or display name, granted scopes, token expiry, and encrypted access or refresh tokens. A file is sent only when you manually choose to save it.

Removing a connection requests provider authorization revocation and then deletes stored credentials and folder mappings. Files already uploaded remain in your cloud account. Google and Dropbox apply their own policies, and limited security logs may be retained.

You may request or start account deletion when that feature is available. Account deletion removes or disables core account data, but limited logs may be retained temporarily for security, abuse prevention, or legal reasons.

You can use browser-only tools without sending data to the server, delete your account, revoke sessions, and contact hi@mv.tools for privacy or deletion questions.

Do not submit sensitive information unless you understand that server-assisted tools require transmission to the server.

MV Tools offers optional Google, Apple and Microsoft sign-in. The provider supplies a stable account identifier and may supply an email address and name; Apple may supply a private relay address. We use this information to create an account after your confirmation, connect an account, authenticate you, and send necessary account or security notices. Microsoft sign-in is associated with its stable identity, and a matching email alone does not automatically connect an existing account.

We store the provider identifier and email association needed for login. We do not store your provider password or sign-in OAuth access or refresh tokens in the account database. Temporary authorization state is removed after completion or expiry. Successful third-party sign-in does not guarantee delivery of MV Tools email to the supplied address. Each provider processes authentication under its own policies.

For server API tool requests, MV Tools may record a user or anonymous identifier, tool name, request and output byte counts, IP address, success or failure, failure reason, and timestamp. These records support quotas, service operation, aggregate usage reporting, security, and abuse prevention.

The tool-usage record does not intentionally contain the submitted file contents, plaintext inputs, or generated file contents. Usage and security records may be retained for as long as reasonably needed, including limited records that remain after account deletion.

Use these tools only for public or authorized content. Do not submit private, internal, access-controlled, or sensitive URLs. You are responsible for copyright, privacy, terms-of-service, and other permissions related to content you request.

For a transfer, the server uses a short-lived, user-specific transfer configuration to copy the single file and paths you select between your connected cloud accounts. Temporary task state and path or file metadata may be held in server memory and are cleaned after completion or failure, normally within about 1 hour. The file is transferred to the cloud providers you selected; provider policies and permissions apply. Disconnecting an account removes its stored credentials, and deleting your MV Tools account removes its Cloud Transfer accounts and user-created app records.

MV Tools maintains an account traffic balance and ledger of credits, debits, reserved amounts, system reasons, related tool or temporary task identifiers, manual adjustment notes, check-in state, and timestamps. This data is used to show balances and activity, avoid duplicate charges, operate requested transfers, resolve service issues, and prevent abuse. Traffic records do not intentionally contain file contents.

For quota and abuse controls, MV Tools may use hashed visitor and IP identifiers and Cloudflare may process IP address and browser or security signals under its own policies. To prevent repeated new-account rewards, MV Tools permanently retains a one-way hash of a normalized account email after an account is deleted. This hash cannot be used to recover the email address and is kept separately from the deleted account; it prevents the same email from receiving the account-creation traffic or new-account check-in reward again. The former balance cannot be accessed.

When checkout is available, Waffo Pancake acts as the merchant of record and processes the payment. MV Tools receives only the information needed to deliver and support the purchase, such as the account identifier, order reference, package, price and currency, payment status, provider transaction identifiers, and timestamps. MV Tools does not receive or store full card numbers or payment credentials.

We use purchase records to credit service traffic after verified payment confirmation, provide support and refunds, prevent fraud or duplicate crediting, meet accounting or legal obligations, and resolve payment disputes. Transaction records are retained only as long as reasonably necessary for those purposes and applicable obligations.

A refund request and its stated reason, eligibility and review status, refund outcome, and related order references are processed with the purchase record. We use this information to review eligibility, provide support, prevent abuse or duplicate crediting, and address payment disputes. This process does not collect or store full payment credentials.

We store your node settings, encrypted connection credentials and cumulative usage statistics to provide this feature. Your proxy provider processes connection information and requested content under its own policies. Deleting a node or account removes saved credentials; billing and refund records may be retained as required. Waffo processes recurring payments; MV Tools does not store full card details.

Connecting an iCloud photo library is separate from signing in to MV Tools with Apple; Apple sign-in alone does not grant access to your photos. When you explicitly connect a library, MV Tools processes your Apple Account email, selected region, authentication responses and session credentials, album and file information, previews, and the photos and videos needed for your requested export. This information is used to authenticate the connection, browse your library, prepare exports, and operate the service securely.

Your Apple Account password and verification codes are used for the requested authentication and are not persistently stored or written to application logs. Saved session credentials and cached photo metadata are encrypted. A connection awaiting verification expires after 15 minutes; a verified connection expires after 12 hours. Cached photo metadata expires no later than its connection. Disconnecting removes the current session and its metadata cache, but does not remove existing exports before their normal expiry.

Authentication requests may use a proxy to establish HTTPS connections to Apple; the proxy provider may process connection metadata. Photo and video files are read by MV Tools servers without that authentication proxy. If you choose to save an export to a connected cloud account, its files and necessary file information are sent to the selected provider, whose privacy practices apply.

Exported files, ZIP archives, manifests, and export task information are temporary. They expire 24 hours after the export task is created, become unavailable for download, and are subject to automatic cleanup. Successful export settlement also creates an account traffic record containing the task reference, charged bytes and time; these records follow the traffic-record retention described in this policy and do not contain photo contents, Apple passwords or verification codes. Exporting does not delete or modify your originals in iCloud.

This policy may be updated as the service changes.