Privacy

What this website collects

The workalio.app website has no accounts, no sign-in and no tracking cookies. We count page views, and one anonymous event each time a tool finishes its job or a page of this website finishes checking a file you dropped on it. A tool's event carries the name of the tool and what it finished; a page's event says only that a check ran, and whether it ran on an import-error reference page or on a tool page — not which page, not which file, and not what the check found. None of them carries a cookie, an identifier or any part of your file. Cloudflare, which already serves these pages, counts the views. Your theme choice stays in your own browser. Your language is kept in a cookie holding a language code and nothing else. The contact form is the only thing on this site that sends us something you wrote: your email address and your message reach our support mailbox by email, along with the language you were reading in and the time it arrived. It is rate-limited by IP address so it cannot be used to send mail in bulk. Some pages here read a file as well: the import-error reference pages and several tool pages check one you drop on them, in the page itself rather than in a tool. Nothing from that file reaches us, and the next section says how those pages read it.

What is read in your browser

Every WorkAlio tool reads a file you hand it. Calendar Timesheet reads a calendar file you export — an .ics from Google Calendar, Outlook, Apple Calendar or anything else that exports the format. Worklog Report reads a worklog CSV you export from Jira. E-Invoice Viewer reads an invoice as XML or PDF. E-Invoice Converter reads a PDF invoice — XML is what it writes, not what it reads. CRM Import Check, Accounting Import Check and Attendance Report Merge each read a spreadsheet or a delimited file you drop on them. Pages of this website read a file as well: the import-error reference pages carry a drop zone, and a spreadsheet or delimited file you drop there is checked in the page you are reading, by the same code the matching tool uses. Several tool pages carry one too. Each takes the kind of file its tool takes and shows a short answer on the page — for example what kind of invoice it is, or how many rows or attendees the file holds and how many problems it would run into. That answer can include names or values read from the file, such as a seller's name, an invoice total or a meeting's title; they are shown on your screen and nowhere else, and the full result is what the tool itself is for. The one on the E-Invoice Converter tool page looks only at whether a PDF already has an e-invoice embedded in it as XML and, if it does, which kind — it does not read the text printed on the invoice, and it converts nothing. In every case the file is read by code running in your browser. No tool connects to Google, Microsoft, Atlassian, Apple, your CRM or your accounting system, and neither does the check on those pages; none of them can reach anything you have not handed it.

How that file is used

For one purpose: to produce the thing on screen. Calendar Timesheet calculates the duration of each event and groups the hours into categories you define. Worklog Report totals the hours in a Jira export by project, by person and by issue. E-Invoice Viewer renders the invoice and checks it against the EN 16931 rules. The other tools write the file you asked for, merge the ones you gave them, or list what an import file would fail on. A file dropped on a reference page is used for one thing as well: to answer whether the error that page describes is in it. A file dropped on a tool page is used only for the short answer that page shows — on the E-Invoice Converter tool page, whether a PDF already carries an embedded e-invoice, and which kind. Nothing is used to build a profile, nothing for advertising, nothing to train any model, and nothing is sold.

Who it is shared with

Your file is shared with nobody. It is never transmitted, so no analytics vendor, advertising network or subprocessor could receive it. Cloudflare serves the pages, as it would any website, and never sees what you open in them. The one exception is a contact-form message, delivered to our support address and nowhere else. Pressing play on a tool page's demo video hands your browser to YouTube's player, and what that player then loads carries nothing of your file; the last section says what those requests do carry.

How it is protected

By never leaving your computer. The pages are served over TLS and carry a content security policy that governs what the page itself may load. The policy on this page admits our own origin and Cloudflare's two analytics hostnames — one serves the measurement script, the other receives the anonymous page-performance data — and no other host at all. None of them receives your file or anything read from it.

What your browser enforces is that reach — the page itself cannot load from anywhere else. Two things it does not enforce. One is that your file stays put, because our own origin is one the policy permits: your file is never sent because no code here sends it, which is a promise our code keeps rather than a rule the browser applies. The other is network error reporting, which no content security policy governs: Cloudflare's edge asks your browser to report requests to this site that fail — only the ones that fail — to a Cloudflare reporting address. Those reports describe the request that did not complete; nothing read from your file is in them.

There is no server holding your data, no database, no logs containing it, and no credential of yours for anyone to steal.

Only the tool pages of this website that carry a demo video are served a slightly wider policy: theirs also admits the host the player is loaded from. No other page of this site admits it — this one has no video, and its policy names no video host at all — and neither do the tools themselves, which are served their own policy with no video host in it. Where it is admitted, our policy stops at the edge of the player: pressing play loads YouTube's player into a frame of its own, and from that point it is YouTube's document rather than ours — our policy does not govern what it loads, and we neither control nor count those requests. Nothing of yours is in them — no file, no file name, no result. The section on who else is involved says what they do carry.

How long it is kept

Your file is not kept. The file you drop exists in the page's memory while you are using it and is gone when you close the tab. On your side, the only things that persist are your own preferences, your categorisation rules and any change you make by hand to a single entry, which is saved under that entry's identifier from your file, such as a Jira issue key or a calendar event's ID. They live in your browser's storage and are never sent to us. On ours, the only thing of yours is a contact-form message, which stays in our support mailbox; we delete it on request, and the next section says how. The page-view and outcome counts described above are kept as well, and neither carries an identifier or any part of your file.

Deleting it

We never receive what you open — in a tool or on a page here — so there is nothing for us to delete. Closing the tab discards the file; clearing your browser data removes your rules, your preferences and those changes, since your browser is the only place they exist. The one thing we hold is a contact-form message, and we delete it if you ask — write to support@workalio.app.

Who else is involved

Cloudflare serves the pages, counts the page views and the anonymous events described above, and delivers contact-form messages to our support address. Tool pages that have a demo video embed it from YouTube, and while you are reading the page nothing is requested from YouTube or Google: what you see before you press play is a still image served from our own domain. Pressing play hands your browser to YouTube's player, loaded from youtube-nocookie.com, the address YouTube publishes for what it calls privacy-enhanced embedding — a description of the host, not a promise that nothing is stored. From then on the player loads whatever it loads from Google's own hosts, and those requests are neither controlled nor counted by us. Every one of them tells Google your IP address and your browser's user agent, and the ones that fetch the video tell it which video you opened; YouTube is Google's service, governed by Google's own privacy policy, and what happens to those requests once they arrive is not something we control. Nothing of yours is in any of them: no file, no file name, no result. Apart from Cloudflare, and from YouTube once you press play, there is no analytics vendor, no error-reporting service receiving your content, and no advertising network.