Privacy Policy

1 About This Policy

ShiftTools ("ShiftTools", "we", "us") provides browser-based utility tools at shifttools.in (the "Service"). It is operated from India by an individual operator. You can reach us at [email protected]. This policy explains what personal data we handle, why, and what choices you have. For the purposes of India's Digital Personal Data Protection Act, 2023 (DPDP Act), we act as the data fiduciary for the personal data described here.

2 The Short Version

• Files you open in our tools (images, video, audio, PDFs, certificates, HAR files, JSON, subtitles, photos) are processed inside your browser and are not uploaded to us.
• Some features do use our servers or third parties. These are listed in Section 4.
• We do not sell your personal data.
• The Service is for people aged 18 and over.

3 Data Processed Only on Your Device

Most tools run locally using your browser's memory, processor and graphics hardware. Your files, passwords, keys and certificates stay on your device and are not sent to us. Closing or refreshing the tab clears them from memory. The QR Scanner and Audio Analyzer use your camera or microphone only after you grant permission in your browser. The feed is processed locally, is not recorded by us, and you can revoke the permission at any time in your browser settings.

4 Features That Involve Servers or Third Parties

4.1 Contact and Support Forms (with email verification)

When you contact us or raise a support ticket, we collect your name, email address, inquiry category, affected tool, urgency, and your message. To confirm that you own the email address, we send a one-time verification code through our email provider, Resend. We also send you a confirmation receipt. Messages reach us through Resend and Cloudflare Email Routing. Please do not include passwords, ID numbers, or other sensitive data in your message.

4.2 URL Shortener

When you create a short link, we store the destination URL, the alias (custom or generated), creation time, last-accessed time, click count, and your chosen expiry in Cloudflare's storage. This record contains no name or email. Do not shorten links that contain personal data or secrets, because anyone with the short link can follow it. Our hosting provider still processes request metadata such as IP addresses to deliver and protect the service (see 4.7).

4.3 Shiftdrop and Chatter (Peer-to-Peer)

Files and messages travel directly between participants' browsers over encrypted WebRTC connections, and we do not store them. A signaling server briefly handles room codes, display names and connection data (SDP/ICE details, which can include IP addresses) so devices can find each other. Other participants in a room can see your display name and may be able to see your network address. Public STUN or relay servers may also be used to set up connections.

4.4 Microsoft Store Downloader

The Store link or Product ID, release ring and architecture you enter are sent to our backend, which requests download links from Microsoft's services. The files themselves download directly from Microsoft's servers.

4.5 Crypto Live Radar

Your browser connects to third-party exchange or charting services to receive market data. These providers can see your IP address and browser details under their own policies.

4.6 AI Background Remover

Your browser downloads an AI model file once from a third-party host and may cache it. Your images are not uploaded.

4.7 Website Delivery and Security Logs

We host the Service on Cloudflare. Cloudflare processes IP addresses and request metadata to deliver pages, block abuse and keep the Service secure.

4.8 Analytics

Where required we ask for your consent, then use Google Analytics (GA4) to measure page views, approximate region, device type and browser. We do not use it to identify you personally, and we do not send it your files or tool inputs.

4.9 Advertising

We may display ads, including through Google AdSense. Google and its partners may use cookies and similar technologies to show and measure ads (see Section 6). Ads are not shown inside your files or tool processing.

4.10 Fonts, Libraries and Other Third-Party Resources

Some pages load fonts, scripts, AI models or map content from third-party hosts. These hosts can see your IP address and browser details when your browser requests those resources.

5 Browser Storage

We do not have accounts or logins. Some tools save settings or recent history in your browser's localStorage or IndexedDB, such as favorite tools, theme, watermark settings, short-link history, and recent results. This data stays on your device until you clear it in your browser settings.

6 Cookies and Similar Technologies

Our own tools don't need cookies to work. Analytics and advertising technologies may set cookies or read device identifiers. Where the law requires, we ask for your consent through a banner, and you can change your choice at any time using our Cookie Settings or through your browser.

Third-party vendors, including Google, use cookies to serve ads based on your visits to this and other websites. Google's use of advertising cookies enables it and its partners to show ads based on your browsing. You can opt out of personalized advertising at adssettings.google.com or aboutads.info/choices, and learn more at policies.google.com/technologies/partner-sites. You can opt out of GA4 with the Google Analytics Opt-out Browser Add-on.

7 Why We Use Data and Our Legal Bases

We use data to operate and secure the Service, verify emails, answer your messages, run the short-link and peer-to-peer features, understand traffic, and show ads. Where the GDPR/UK GDPR applies, our bases are consent (analytics, ad cookies), legitimate interests (security, abuse prevention, running the Service), and steps you request (support, short links). Under the DPDP Act we rely on your consent or on legitimate uses the Act permits, such as responding to your request or preventing misuse.

8 Who We Share Data With

• Cloudflare: hosting, storage, email routing, security.
• Resend: sending verification and confirmation emails.
• Google: analytics and advertising.
• Microsoft: only for Store lookups you request.
• Exchange and data providers: only for the Crypto tool.
• Other participants: in rooms you join.
• Authorities: if the law requires or to protect rights and safety.

We do not sell or rent your personal data.

9 International Transfers

Our providers operate globally, so your data may be processed outside India, including in the United States. We rely on the safeguards offered by these providers and by applicable law.

10 Retention

• Contact and support messages: up to 12 months, or sooner on request.
• Verification codes: valid only briefly.
• Short links: removed automatically after your chosen expiry (default 20 days without a click; options of 24 hours, 7 days, 30 days, or until deleted).
• Peer-to-peer signaling data: only while a room or connection is active.
• Analytics: according to our GA4 retention setting.
• Hosting logs: held by Cloudflare under its own policies.

11 Security

We use HTTPS, security headers and encrypted peer-to-peer connections. No system is completely secure. If a personal-data breach affecting you occurs, we will notify you and the authorities as required by law.

12 Your Rights

Depending on where you live, you may have the right to access, correct or delete your personal data, withdraw consent, object to or restrict processing, and receive a copy. Under the DPDP Act you may also nominate someone to exercise your rights and seek grievance redressal. Email [email protected] from the address you used; we may ask you to verify it. We aim to respond within 30 days. If you are in the EEA/UK, you may complain to your data protection authority. California residents may request to know or delete data and opt out of any sale or sharing; we do not sell personal information, and ad partners may use cookies as described in Section 6.

13 Children

The Service is intended for people aged 18 and over. We do not knowingly collect personal data from children and do not direct advertising to them. If you think a child has sent us data, email us and we will delete it.

14 Changes to This Policy

We may update this policy as the Service changes. The "Last updated" date shows the current version.

15 Contact, Grievance Redressal & Support

For questions, privacy requests, or support, you can reach us directly at [email protected].