1. Who We Are & Scope

Data Fiduciary: Siddhartha Kaithwar, India
Website: toolkitpro.co.in
Contact: support@toolkitpro.co.in

This policy applies to all users of ToolKit Pro, including visitors who use the app as a guest, registered account holders, and users who interact with any embedded tools (Calculator, Chess, Currency Converter). It applies to personal data collected digitally through our website.

2. Data We Collect & Why

We collect only what is necessary for the service (data minimisation principle under DPDP Act, Section 6):

2a. Data You Provide Voluntarily

• Name & Email Address — when you register an account (used for authentication via Supabase)
• Password — hashed and stored securely via Supabase Auth; we never see your plain-text password

2b. Data Collected Automatically

• Usage/Analytics Data — pages visited, device type, browser type, operating system, session duration — collected via Google Analytics for app improvement
• IP Address & Log Data — collected by our hosting provider (GitHub Pages) and analytics services for security and performance monitoring
• Advertising Identifiers — cookies and similar signals used by Google AdSense for ad personalisation (you may opt out — see Section 4)

2c. Data Stored Locally on Your Device

• Calculator History & Preferences — stored in your browser's localStorage; this data never leaves your device and is not accessible by us
• Login Session — session token stored in localStorage to keep you logged in
• Theme Preference — dark/light mode setting stored locally

Purpose of Processing: All data is collected solely for operating the service, ensuring security, displaying advertisements to keep the service free, and improving user experience. We do not sell your personal data.

3. Legal Basis for Processing

Under the DPDP Act 2023, we process your personal data on the following lawful bases:

• Consent (Section 7, DPDP Act) — You provide free, specific, informed consent when you register an account or accept our Cookie Notice. You may withdraw consent at any time by deleting your account.
• Legitimate Use — Processing necessary for operating the service, security monitoring, and fraud prevention
• Legal Obligation — Where required by applicable Indian law

For GDPR purposes (EU/EEA users), our lawful bases are consent (Article 6(1)(a)) for advertising cookies, and legitimate interests (Article 6(1)(f)) for analytics and security.

4. Google AdSense & Advertising

ToolKit Pro displays advertisements served by Google AdSense (Google LLC, USA). Google may use cookies, web beacons, and similar technologies to serve ads based on your prior visits to this and other websites.

What Google may collect: browsing behaviour, interests, approximate location, device information, and interactions with ads.

You can control ad personalisation:

• Visit Google Ads Settings to opt out of personalised ads
• Visit optout.aboutads.info for industry-wide opt-out
• Use your browser's cookie settings to block third-party cookies

Google's use of your data is governed by Google's Privacy Policy.

5. Cookies & Tracking Technologies

We use the following categories of cookies:

• Strictly Necessary Cookies — login session management, security tokens. These cannot be disabled as the service requires them.
• Preference Cookies — remembering your theme (dark/light mode) and settings. You can clear these via browser settings.
• Analytics Cookies — Google Analytics collects anonymised usage data to help us understand how our app is used. You can opt out via Google Analytics Opt-out.
• Advertising Cookies — Google AdSense places cookies for personalised advertising. You can opt out as described in Section 4.

You can also instruct your browser to refuse all cookies or delete existing ones. Note that disabling cookies may affect certain features.

6. Data Storage, Retention & Security

Storage

• Account data (name, email, hashed password) is stored on Supabase servers (hosted on AWS, region: auto-assigned)
• App preferences and calculator history are stored locally in your browser's localStorage — on your device only
• The website is hosted on GitHub Pages (Microsoft, USA)

Retention Periods

• Account data: Retained as long as your account is active. Deleted within 30 days of an account deletion request
• Analytics data: Retained by Google Analytics per Google's default retention (14 months)
• Server logs: Retained for a maximum of 90 days by hosting providers
• Local data (localStorage): Stored on your device until you clear your browser data

Security Measures

• All data transmission is encrypted via HTTPS (TLS 1.2+)
• Passwords are hashed using Supabase's bcrypt-based authentication — never stored in plain text
• Access to user account data is restricted to the site administrator only
• We follow responsible disclosure principles for security vulnerabilities

Despite our best efforts, no internet transmission is 100% secure. Please use a strong, unique password for your ToolKit Pro account.

7. Third-Party Services & Data Processors

ToolKit Pro integrates the following third-party services to deliver its functionality. Each service may collect and process data per their own privacy policies. By using ToolKit Pro, you acknowledge these integrations.

🗄️ Database & Authentication

📢 Advertising

📊 Analytics

🌐 Web Hosting

📧 Email Communication

🤖 AI Assistant

💱 Currency Exchange Rate APIs

We do not sell, rent, or share your personal data with any third party for their own marketing purposes. All third-party processors are bound by data processing agreements or their published privacy policies.

8. Children's Privacy (Under 18)

In compliance with the DPDP Act 2023 (Section 9), ToolKit Pro does not knowingly collect or process personal data of children under the age of 18 years without verifiable parental consent.

If you are under 18, please do not register an account or provide any personal information. You may use the app as a Guest without creating an account.

If a parent or guardian believes their child under 18 has provided us with personal data, please contact us immediately at support@toolkitpro.co.in and we will delete the data within 30 days.

9. Your Rights as a Data Principal

Under the DPDP Act 2023 (Sections 11–14) and applicable international laws, you have the following rights:

To exercise any of these rights, email us at support@toolkitpro.co.in with subject line "Data Principal Rights Request". We will respond within 30 days as required by the DPDP Act.

EU/EEA users (GDPR): You additionally have the right to data portability (Article 20) and the right to lodge a complaint with your local supervisory authority.

California residents (CCPA): You have the right to know, delete, and opt out of the sale of personal information. We do not sell personal information.

10. Cross-Border Data Transfers

Your data may be transferred to and processed in countries outside India, including the United States (Supabase/AWS, Google, GitHub, Zoho) and the European Union. These transfers occur because our third-party service providers operate globally.

We ensure that such transfers comply with applicable law. For transfers from India, we rely on data processing agreements with our service providers. For EU data, standard contractual clauses (SCCs) or adequacy decisions apply.

11. Changes to This Policy

We may update this Privacy Policy when required by changes in law, new features, or updated processing activities. When we make material changes, we will:

• Update the "Last updated" date at the top of this page
• Display a notice in the app or on the website for at least 14 days

Your continued use of ToolKit Pro after any changes constitutes your acceptance of the updated policy. If the changes require re-consent under the DPDP Act, we will seek your explicit consent before processing.

12. Grievance Officer & Contact

In accordance with DPDP Act 2023 and the Information Technology Act, 2000, the details of the Grievance Officer are: