Privacy policy

We keep what we need to run your account and nothing to sell. If you use Toolnaut without signing in, your answers, stack and progress stay in your own browser. If you sign in, we store your account and a copy of your stack and progress so they follow you to other devices. If you buy a plan, we keep a record of the payment.

We do not sell data. We do not run advertising. We do not use advertising trackers.

Everything is stored in your browser's local storage: your intake answers, your persona and recommended stack, tools you save, roadmap progress, your day streak, community posts and drafts, and display preferences such as theme and sky. None of it is sent to us, and clearing your browser data deletes it permanently.

Sign-in is handled by Supabase, with Google or a one-time link sent to your email. We receive your email address, display name and profile picture. There is no password to store.

While you are signed in, we also store on our servers: your intake answers and whether you finished the intake, your chosen avatar, the tools in your stack and your saved tools, and which roadmap steps you have completed. This is what lets your progress follow you to another device. Community posts, your streak and display preferences stay in your browser only.

Payments are processed by Razorpay. We never see or store your card number, UPI PIN or bank login. We keep a record of each payment: the plan, the amount, its status, the dates, and Razorpay's order and payment reference numbers. Razorpay also sends us payment notifications, which can include the email address, phone number and payment method used; we keep these so payments and refunds can be reconciled.

New-tool alerts are off until you turn them on in Settings. When they are on, we store your email address and the categories you chose. Every alert has an unsubscribe link.

Account deletion codes are sent to your account's email when you ask to delete your account. We store only a scrambled form of the code, never the code itself, and it expires after 10 minutes.

Supabase stores your account and synced data. Razorpay processes payments. Resend delivers our emails.

NVIDIA (NVIDIA API Catalog) powers the assistant. When you type an answer in your own words during the intake, or send a message to the in-app assistant, that text is sent to be answered. Your name, email and account id are not attached.

Google Analytics receives anonymous product-usage events, such as which pages you view, which buttons you press, and milestones like finishing the intake. It does not receive your name, email, account id or anything you type.

Sentry receives a technical report when a page crashes, describing the error and the page it happened on, so we can fix it. Reports are configured not to include your IP address, name or email.

Vercel hosts the site and, like any web host, processes standard request logs, including IP addresses.

You can delete your account yourself: Settings → Delete account. We email a code to confirm it is you, then permanently erase your account, profile, intake answers, stack, saved tools, roadmap progress, alert settings and sign-in.

Payment records are the one exception. Indian tax law requires businesses to keep transaction records, and refunds and disputes must still be traceable, so we keep them after deletion with your name, email, phone number and payment-method details removed.

If you never signed in, clearing your browser data removes everything.

No advertising cookies. Google Analytics sets its own first-party cookies to recognise repeat visits, and signing in stores a session token so you stay signed in. Neither is used to advertise to you.

Toolnaut is not directed at children under 13, and we do not knowingly collect their data.

Questions about your data, or a request we can help with: info@toolnaut.xyz