Privacy Policy
Last Updated & In Effect: September 2026 • Effective Jurisdiction: India & Worldwide
Our Core Privacy Commitment: 100% Client-Side Processing
BoringTools operates on a strict “Zero Server Storage” and “Client-First” architecture. Your images, PDFs, videos, calculations, and sensitive files are processed locally inside your web browser using WebAssembly (WASM) and client-side JavaScript. Your user files never reach our servers, are never logged, and are never saved to any database.
DPDP Act 2023 — Multilingual Privacy Summary
Section 5(3) Notice in Accessible Plain Language
“Under Section 5(3) of India's Digital Personal Data Protection Act, 2023 (DPDP Act), you have the right to access this privacy notice in English or any language specified in the Eighth Schedule to the Constitution of India.”
1. 100% Client-Side Privacy
All files, images, documents, and calculations are processed directly inside your web browser (via WebAssembly and local JavaScript). No tool data is ever uploaded, stored, or inspected on our servers.
2. Limited Personal Data Processed
We collect only essential data: your email address if you voluntarily create an account (via Supabase), transient IP logs for CDN DDoS mitigation, and your device preferences in local browser storage.
3. Children & Minor Protection (18+)
Under Section 2(f) and Section 9 of the DPDP Act, BoringTools is restricted to individuals aged 18 and older. We strictly prohibit tracking, behavioral monitoring, or targeted advertising directed at minors.
4. Your Data Principal Rights
You have the right to access a summary of your data, correct inaccuracies, request complete erasure, nominate a representative in case of death or incapacity, and seek redressal for grievances (Sections 11–14).
5. Grievance Redressal Mechanism
Grievance Officer: Ayush Sharma | Email: grievance@boringtoolsai.com | Response: Acknowledged within 48 hours; substantive resolution within 30 days. If unsatisfied, you may appeal to the Data Protection Board of India (DPBI).
1.Statutory Framework & Scope
This Privacy Policy is formulated in strict accordance with the provisions of the Digital Personal Data Protection Act, 2023 (“DPDP Act”) of India and applicable electronic privacy regulations. For the purposes of the DPDP Act:
- Data Fiduciary: BoringTools (“we”, “us”, or “our”), accessible at boringtoolsai.com, determining the purpose and means of personal data processing.
- Data Principal: You, the natural person accessing or utilizing BoringTools to whom personal data relates.
- Digital Personal Data: Any data by or in relation to which you as an individual can be identified, rendered in digital form.
2. 100% Client-Side Architecture (Zero File Retention)
Unlike traditional cloud software platforms that ingest user files onto centralized backend servers, BoringTools is engineered from the ground up for edge execution:
Local Browser Execution
Image compression, PDF merging, audio extraction, OCR parsing, and mathematical calculations execute within your browser sandbox via WebAssembly (WASM).
Zero Cloud Uploads
Your files, documents, and inputs are never transmitted to our backend infrastructure, third-party cloud buckets, or external AI models for storage.
No Keystroke or Screen Replay
We strictly refrain from using intrusive tracking suites (such as Hotjar, Clarity, or FullStory). We do not record keystrokes or record screen sessions.
Ephemeral Memory Lifetime
Any temporary RAM allocated by your browser to process a file is instantly freed when you close or refresh the browser tab.
3. Categories of Personal Data Processed
In accordance with Section 4 and Section 5 of the DPDP Act, personal data is processed solely for lawful purposes where you have given consent or for legitimate uses specified by law:
| Category | Data Items | Purpose & Legal Basis |
|---|---|---|
| Authentication & Account | Email address, encrypted password hash (managed via Supabase Auth) | User authentication, subscription entitlement, and security. Processed only when an account is registered. |
| Network & Security Logs | Transient IP address, user-agent string, timestamp, request URL | DDoS mitigation, rate-limiting, and web application firewall security via Vercel edge infrastructure. |
| Local Browser Storage | localStorage / sessionStorage keys (theme dark/light, recent tool history) | Convenience and UI persistence. Stored exclusively on your device; never sent to server databases. |
| Usage Telemetry | Aggregated page views, performance metrics via Vercel Analytics | Privacy-friendly, cookieless metrics to identify broken tools and maintain system uptime. |
| Advertising & Monetization | Advertising identifiers & non-personalized cookie tags (Google AdSense) | Ad serving in compliance with user preferences and strict exclusions for children's data. |
4.Children's Privacy & 18+ Age Requirement (Section 9)
Statutory Mandate under Section 2(f) and Section 9 of the DPDP Act:
Under Indian law, a “child” is defined as an individual who has not completed 18 years of age. BoringTools is intended exclusively for adults aged 18 and older.
- No Account Creation for Minors: Individuals under the age of 18 are not permitted to register accounts or purchase subscriptions on BoringTools.
- Prohibition of Behavioral Tracking: As mandated by Section 9(2) and Section 9(3) of the DPDP Act, BoringTools does not engage in tracking or behavioral monitoring of children, nor does it serve targeted advertisements directed at minors.
- Immediate Data Deletion: If we obtain actual knowledge that personal data of an individual under 18 has been collected without verifiable parental or guardian consent, we will take immediate steps to permanently delete such information from our authentication stores.
5. Rights of the Data Principal (Sections 11–14)
Under Chapter III of the DPDP Act, 2023, you enjoy statutory rights regarding your digital personal data:
A. Right to Access Information (Section 11)
You have the right to obtain a summary of personal data being processed by us, a description of processing activities, and the identities of all third-party Data Processors with whom personal data has been shared.
B. Right to Correction and Erasure (Section 12)
You have the right to request correction of inaccurate or misleading personal data, completion of incomplete data, updating of obsolete data, and total erasure of personal data that is no longer necessary for the purpose for which it was collected.
C. Right of Grievance Redressal (Section 13)
You have the right to readily accessible grievance redressal provided by BoringTools in respect of any act or omission regarding personal data rights and fiduciary obligations.
D. Right to Nominate (Section 14)
You have the right to nominate, in accordance with applicable rules, any other individual who shall, in the event of your death or incapacity, exercise your rights as a Data Principal.
E. Right to Withdraw Consent
Where processing is based on consent, you may withdraw your consent at any time with the same ease as it was given. Following withdrawal, we will cease processing unless otherwise permitted or required by law.
6.Grievance Redressal Mechanism & Officer Details
In compliance with Section 13 of the DPDP Act and the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, users may direct any privacy inquiries or grievances to the project maintainer:
Escalation to Data Protection Board of India (DPBI)
If you do not receive an acknowledgement or resolution from our Grievance Officer within 30 days, or if you are unsatisfied with the resolution provided, you have the statutory right under Section 13(3) and Chapter V of the DPDP Act to register a complaint directly with the:
Established by the Central Government of India under Section 18 of the Digital Personal Data Protection Act, 2023.
Official filings can be submitted through the DPBI digital portal once operationalized per official government gazette.
7.Third-Party Data Processors & Transfers
We work with select enterprise service providers who act as Data Processors under strict confidentiality obligations:
- Supabase Inc. — User authentication and subscription status records. Data is encrypted at rest and in transit.
- Vercel Inc. — Global CDN routing, serverless edge compute, and privacy-preserving aggregated telemetry.
- Google AdSense — Programmatic advertising displayed in accordance with user consent and strict age boundaries.
Cross-border transfers of personal data are conducted strictly in compliance with Section 16 of the DPDP Act and Central Government blacklists/guidelines.
8.Data Security & Retention Standards
Under Section 8(5) of the DPDP Act, BoringTools employs robust reasonable security safeguards to prevent personal data breaches:
- TLS 1.3 / HTTPS encryption across all browser-to-server traffic.
- Row-Level Security (RLS) on Supabase databases to isolate user profile data.
- Strict minimization: User tool files are never logged, cached, or transferred to disk.
- Zero retention of non-registered visitors' calculation or tool outputs.
9. Policy Modifications
We may update this Privacy Policy from time to time to reflect changes in regulatory standards or tool functionality. Material updates will be highlighted on this page with an updated “In Effect” date. Continued usage of BoringTools constitutes your acknowledgment of the updated policy.
10.Contact & General Inquiries
For general feedback, feature requests, or queries regarding our client-side tools, visit our Contact Page. For privacy notices and statutory Data Principal rights, email grievance@boringtoolsai.com.