Privacy Policy (Datenschutzerklärung)

The short version

This website sets no cookies, runs no analytics, embeds no trackers, and loads nothing from third-party servers. All fonts, images, and videos are served from this domain. Personal data is processed only where you actively hand it to us: the support form (your email address and the text you write), the launch notification form (your email address), and — in the app, if you subscribe to it — Valutorio Sync (the contents of the vaults you choose to sync). Plus the server log data every web server technically requires to deliver a page.

1. Controller (Verantwortlicher)

Lovre Crncevic
Sudermannstr. 2A
60431 Frankfurt am Main, Germany
Email: lovre@crncevic.org

See the imprint for full legal notice information.

2. Hosting and server log files

When you visit this website, the hosting provider automatically processes technical connection data: the IP address of the requesting device, date and time of the request, the requested URL, the referrer URL, the browser identification (user agent), and the HTTP status code. This processing is technically necessary to deliver the website and to ensure its stability and security.

Legal basis: Art. 6 (1) (f) GDPR — our legitimate interest in providing and securing this website. Log data is not merged with other data sources and is not used to identify individual visitors. It is retained only for as long as the hosting provider's standard log rotation keeps it, then deleted automatically.

This website is hosted on Amazon Web Services (Amazon Web Services EMEA SARL, Luxembourg): content is delivered via Amazon CloudFront and the support system runs in the AWS Frankfurt region (eu-central-1). CloudFront serves pages from edge locations worldwide; the data described in sections 3, 4 and 6 below is stored in the EU (Frankfurt). AWS is certified under the EU-U.S. Data Privacy Framework, and we have a data processing agreement with AWS incorporating the EU Standard Contractual Clauses.

3. Support ticket form

If you open a support ticket at /support/, we process: your email address, the subject and message text you write, and — for abuse prevention only — a short-lived, hour-bucketed record keyed to your IP address that rate-limits form submissions. Your ticket is created only after you confirm your email address via the verification link we send (double opt-in); an unconfirmed ticket and its content are deleted automatically after 24 hours. Confirmed tickets and their conversation are retained until the issue is resolved and then for up to 12 months, so recurring problems stay diagnosable, after which they are deleted. We send email strictly about your ticket: the verification link, a confirmation, and reply notifications — nothing else, no lists.

Legal basis: Art. 6 (1) (b) GDPR — processing necessary to handle your request — and, for the rate-limiting records, Art. 6 (1) (f) GDPR (our legitimate interest in preventing abuse of the form). Ticket data is stored in the AWS Frankfurt region; verification and notification emails are sent via Amazon SES from the same region.

4. Launch notification email form

If you submit your email address through the "notify me at launch" form, that address is used for exactly one purpose: to send you occasional updates about Valutorio, including the launch announcement. Legal basis: Art. 6 (1) (a) GDPR — your consent. You can withdraw consent at any time via the unsubscribe link contained in every email, or by writing to the address above; withdrawal does not affect the lawfulness of processing before the withdrawal.

5. No cookies, no analytics, no third-party content

This site sets no cookies of any kind and uses no analytics or tracking services. No content is loaded from third-party servers: fonts, images, and videos are all hosted on this domain. There are outbound links to other websites (for example to sources cited on the comparison pages); this privacy policy does not apply to those external sites, and no data is transmitted to them unless you click such a link.

6. The Valutorio app

The Valutorio macOS app is distributed through the Mac App Store and stores your notes locally on your device. Without a Valutorio Sync subscription, the app transmits none of your notes to us. Purchases are processed entirely by Apple under Apple's own terms and privacy policy — we receive no personal purchase data from Apple beyond aggregate, non-identifying statistics.

If you subscribe to Valutorio Sync and turn it on for a vault, the contents of that vault (your note files and their metadata) are transmitted to and stored on our infrastructure in the AWS Frankfurt region (eu-central-1), encrypted in transit (TLS) and at rest, for the sole purpose of synchronizing your devices and providing your personal MCP endpoint. The MCP endpoint gives access to exactly your synced notes and only to bearers of your personal access token, which you can reveal, rotate, and revoke in the app at any time. We do not read, analyze, or share your note content; access by us is limited to what is technically required to operate the service. Turning sync off stops transmission; ending your subscription and deleting your synced vaults removes the stored copies. Legal basis: Art. 6 (1) (b) GDPR — performance of the subscription contract.

7. Your rights

Under the GDPR you have the right to access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20), and objection to processing based on legitimate interest (Art. 21). You also have the right to lodge a complaint with a supervisory authority (Art. 77); the authority responsible for us is the Hessischer Beauftragte für Datenschutz und Informationsfreiheit, Wiesbaden. To exercise any of these rights, email the address in section 1.

8. Changes to this policy

If the website gains features that process personal data differently (for example a different form provider), this policy will be updated before that change goes live. The current version is always at this address.

Last updated: September 2026.