Privacy Policy

UTILS-NITTISH is a set of utility tools: file storage backed by Google Drive and Cloudinary, a text-snippet keeper, and a QR code generator. Every tool has two modes:

• Global mode — no account required. Anything you upload, save, or generate in Global mode is stored with no login and is visible to every visitor of the site, not just you. Treat Global mode as a public shared space, not private storage.
• Personal mode — requires sign-in. Content you save in Personal mode is only shown to you (and site admins) within the app.

Account holders (sign-up/sign-in):

• Name, email address, and a bcrypt-hashed password (email/password sign-up).
• Name, email, and profile picture URL from Google (Google sign-in).
• Optional profile fields you choose to fill in (university, degree, branch).
• Consent record: timestamp and version of the Privacy Notice / Terms you accepted at sign-up (stored on your user record).
• OAuth session data: Google sign-in stores provider tokens in our database as required by NextAuth to keep you signed in (refresh/access tokens where applicable).
• Security and request metadata: IP address and browser user-agent on authentication and certain account actions (also written to security audit logs — see below).

Contact form (no account required):

• Name, email address, subject, and message text you submit on the Contact page.
• These are emailed to us via Gmail SMTP; we do not store them in our application database.

Security audit logs (account-related events):

• Event type (e.g. login success/failure, account created/deleted, password reset, consent accepted), optional user id and email, IP address, user-agent, and small JSON metadata where relevant.

Content you create (Global or Personal mode):

• Files you upload (stored via Google Drive or Cloudinary), their titles, and folder names.
• Text snippets you save.
• QR code values you generate.
• An optional per-file access password, if you set one (stored hashed, not in plain text).

We do not require or intentionally collect sensitive personal data (financial details, government ID numbers, health information). Do not upload such data yourself, especially not in Global mode — see Section 5.

• Service delivery — storing, organizing, and returning the files, text snippets, and QR codes you create; honoring Global vs Personal mode scope.
• Authentication and account management — sign-up, OTP verification, login (email/password or Google), password reset, profile updates, and account deletion.
• Communication — transactional emails (OTP, password reset) and responding to contact-form messages.
• Security and abuse prevention — IP-based rate limiting, security audit logging, and investigating unauthorized access.
• Legal compliance — maintaining records we are required to keep (e.g. security logs) and responding to lawful requests where applicable.
• AI query tool (if you use it) — your query text is sent to Google's Gemini API to generate a response. Query results are cached briefly (about 60 seconds) on our server to avoid duplicate requests.

We do not use your personal data for targeted advertising. We do not sell or rent personal data. We do not collect precise geolocation from your device; the app context may hold a location value for UI purposes only and we do not send it to our servers.

Consent — For registered accounts, we rely on your consent to process personal data needed to provide Personal mode and account features:

• Email/password sign-up: you tick an unchecked box agreeing to the Terms and Privacy Notice (version 2026-09-26) before we create your account; consent version is stored when you complete OTP verification.
• Google sign-up or sign-in: clicking "Continue with Google" under the visible notice on the sign-up or login page is your affirmative action; for new Google users we record consent at account creation with the current notice version.

You may withdraw consent at any time by deleting your account (see Section 7). Withdrawal does not affect processing that already occurred lawfully before withdrawal.

Certain legitimate uses — Without consent, we may process limited personal data where permitted under the DPDP Act, including for security of our systems and prevention of fraud or abuse (e.g. rate limiting, security audit logs on login and sensitive account events). This processing is narrow and not used for marketing.

Global mode without an account — Content you add in Global mode is not tied to a user account (userId is null in our database). Using Global mode does not require the account consent flow; you should not place personal data there because it is public (see Sections 1 and 5).

Two things you should know plainly before using this app for anything you care about the privacy of:

• Global uploads are public and permanent by default. There is currently no automatic expiry or cleanup of Global-mode files, text, or QR codes — they persist until manually deleted by an admin or the person who created the containing folder.
• A per-file password only gates access through this app's own interface — it does not fully lock down the underlying file. Files are stored on Google Drive or Cloudinary, and the direct storage link returned by those services is not currently restricted by your in-app password. Anyone who obtains that direct link (e.g. if it were shared, logged, or guessed) could access the file without going through the app or the password. We are addressing this at the storage layer in a future update; until then, do not rely on the in-app password as strong protection for sensitive files, and do not upload anything you would not be comfortable being accessed via a leaked or guessed direct link.

We use the following third-party service providers. Each only receives the data needed to perform its function:

• Google — for Google sign-in (OAuth), Google Drive file storage (via a service account), and the Gemini AI query tool.
• Cloudinary — for storing and serving files uploaded through the Cloudinary tool.
• Neon (PostgreSQL) — our database host, where account and content metadata is stored.
• Upstash (Redis) — used only for rate limiting; no content is stored there.
• Gmail SMTP — used to send OTP, password-reset, and contact-form emails.
• Vercel — hosting infrastructure for the application.

These providers act as data processors or infrastructure hosts. Their servers may be located outside India (including the United States and other regions). Where personal data is transferred abroad, it is only for the purposes described in this notice and subject to contractual or standard safeguards offered by those providers.

We do not sell or rent personal data to third parties.

Under the DPDP Act, you may have the right to:

• Access — obtain a summary of personal data we hold about you and the processing activities concerning it (contact us; much account data is visible on your profile page).
• Correction — update name and optional profile fields on your profile page, or ask us to correct inaccurate data.
• Erasure — delete your account and Personal-mode content from your profile page, or request erasure by email.
• Withdraw consent — by deleting your account when processing is consent-based.
• Grievance redressal — raise a complaint with us using the contact in Section 13; we will address grievances in line with applicable law.
• Nominate — where the Act allows, you may nominate another individual to exercise your rights in the event of your death or incapacity; contact us to do so.

Deleting your account removes your account record and everything you saved in Personal mode. It does not remove content you contributed to Global mode, since Global content is a shared public space rather than data tied to your account — if you need a specific Global item removed, contact us and we will remove it manually.

• Account data is retained until you delete your account.
• Personal-mode content is retained while your account exists, and deleted with it.
• Global-mode content has no automatic expiry (see Section 5).
• Pending sign-ups (NonVerifiedUser) — name, email, hashed password, and OTP are kept only until OTP expiry, then removed by scheduled cleanup.
• Password-reset and email-verification tokens are kept only until they expire, then removed by scheduled cleanup (along with expired login sessions).
• Security audit logs are retained for at least one (1) year to help detect unauthorized access, then deleted or archived as we reasonably determine.
• Contact-form submissions are retained only as long as needed in our email inbox to handle your request.

Cookies (server-set): We use essential cookies only — including NextAuth session cookies to keep you signed in and cookies used for CSRF protection during authentication. We do not set advertising, analytics, or third-party tracking cookies on this site.

Browser local storage: We store preferences and performance data on your device only; it is not transmitted to us except when you make normal API requests that reflect your chosen mode:

• themeMode — light/dark theme.
• dataMode — Global vs Personal workspace preference (signed-in users).
• nittish-client-cache:v1:* — short-lived cached API list responses for faster reopen.
• pane-widths:* — resizable panel layout preferences.
• Per-tool sort and folder-selection keys — your sort order and last-selected folder per tool.
• textUtils:draft — draft text in the word counter (browser only).
• tabNavStats:v1:* — local tab navigation stats for prefetch (browser only).

You can clear cookies and local storage in your browser settings; doing so may sign you out and reset on-device preferences. We do not operate a separate marketing cookie banner because we do not use non-essential cookies for ads or cross-site tracking.

Passwords are hashed (bcrypt) and never stored in plain text. Per-file access passwords are also hashed. We use rate limiting to reduce automated abuse of authentication and upload endpoints. See Section 5 for a specific, current limitation around direct storage links. No system is perfectly secure, and we cannot guarantee absolute security, but we take reasonable technical measures to protect your data as required under the DPDP Rules.

UTILS-NITTISH is not directed at individuals under 18 years of age. We do not knowingly collect personal data from children. If you believe a child has provided personal data to us, contact us and we will take appropriate steps to delete it.

We may update this notice as the service or law evolves. Material changes will be reflected by updating the version date at the top (2026-09-26 format). Sign-up consent records the version you accepted; continued use after an update may require renewed consent where the law requires it.

For privacy questions, rights requests, or grievances about how we process your personal data under the DPDP Act, contact our grievance channel (Data Fiduciary contact):

Nittish Baboria — Grievance / Privacy — nittishbaboria123@gmail.com

Please include enough detail for us to verify your account (e.g. registered email) and describe your request. We aim to respond within reasonable timelines as required under applicable rules.