Privacy Policy

What this policy covers #

This policy applies to the websites, web apps, browser tools, bots, APIs, proxies and other hosted services that we run and that link to this page (the “services”). This includes services on our domains (currently viperadnan.com and its subdomains) and on any other domain or address we use, sites hosted on our code hosting accounts, and services we publish under other names or organizations.

Services may be added, renamed, moved to a different domain or address, changed, limited or shut down at any time without notice. This policy covers whichever services are running at the time, wherever they're hosted. Our domains can change too; the current version of this policy is the one the services link to.

It does not cover:

• Copies of our open-source code run by someone else. Whoever runs that copy decides what it collects and is solely responsible for it.
• Third-party services you connect to or reach through the services, such as messaging platforms, sign-in providers or APIs you add your own key for. Their own terms and privacy policies apply, and we aren't responsible for their practices.
• The platforms our code is published on, when you browse or contribute to a repository.

A service may publish more details about its own data handling, in its interface, documentation or description. Those details add to this policy, and where they're more specific, they apply to that service.

Who we are #

The services are run by Adnan Ahmad, an independent software developer based in New Delhi, India (“we”, “us”, “our”). If the services are later run through a company, or together with other maintainers, “we” includes them, and this policy continues to apply.

We decide how and why personal data is processed in the services, which makes us the data controller under the GDPR and the Data Fiduciary under India's Digital Personal Data Protection Act, 2023.

Adnan Ahmad
New Delhi, India
[email protected]

Adnan Ahmad is also the contact for questions and grievances under Indian law, at the same address. We haven't appointed an EU or UK representative, because our processing is occasional and low risk (GDPR Article 27(2)).

What we collect #

What a service collects depends on what it does, and many collect nothing. The table lists the kinds of personal data a service may process.

When a bot or relay passes your messages or requests on, it processes the content to do what you asked, and doesn't keep it unless the feature needs to.

You don't have to give us any personal data, and there's no legal requirement to. Some features can't work without it: an account needs an email address, and a bot needs your platform user ID to reply to you. If you don't provide it, you can't use that feature.

The services aren't designed to collect sensitive data, such as health, religious or biometric information, so please don't submit it. We don't buy personal data.

How we use it #

We don't sell personal data or use it for advertising. The services don't make decisions about you based solely on automated processing that have legal or similarly significant effects.

Cookies and local storage #

Services use cookies where they're needed to work, for example to keep you signed in. Many tools save settings, caches or tokens in your browser's local storage so they work without a server; that data stays on your device unless you use a feature that sends it somewhere.

The services don't use advertising or cross-site tracking cookies, so there's no cookie banner. Clearing your browser data removes what's stored. If a service ever needs non-essential cookies, it will ask first.

We don't allow third parties to track you across sites through the services. Providers whose resources a page loads, described in Who receives data, may log technical data under their own policies. Because the services don't track you across sites, Do Not Track and Global Privacy Control signals don't change how they behave.

Who receives data #

• Service providers that host and run the services, such as hosting, content delivery, database, email, analytics and error-reporting providers. They process data on our behalf under their own terms; some, like code hosting platforms that serve websites, may log visitors' IP addresses for security.
• Platforms you use a service through, such as messaging apps for bots. They receive what you send under their own policies.
• Third-party services you connect. When you link an account or add your own key, the service sends your requests to that provider on your behalf.
• Resources loaded by a page, such as fonts, scripts, images, embedded media and public APIs. Loading them shares your IP address and browser details with whoever serves them.
• Authorities and others, where the law requires it, or where it's reasonably needed to protect the rights, safety or property of users, the public or us, or to enforce our terms.
• A successor, if a service or this project is transferred, for example to a company or another maintainer. The successor must keep protecting the data in line with this policy.

Google user data #

Where a service accesses Google user data through Google APIs, its use and transfer of that information will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Where a service is a browser extension published in the Chrome Web Store, it follows the Chrome Web Store User Data Policy, including its Limited Use requirements.

International transfers #

We're based in India, and our service providers may store or process data in other countries. Where a transfer needs safeguards under the law that applies to you, we rely on those the provider offers, such as Standard Contractual Clauses or a data processing agreement. Transfers from India follow any restrictions set by the Government of India.

How long data is kept #

We keep personal data only as long as it's needed for the purpose it was collected for, then delete or anonymize it within a reasonable time. In general:

• Accounts and saved data are kept until you delete them or ask us to. Copies in backups are removed as those backups expire.
• Bot data is kept until you remove the bot, delete your configuration or ask us to.
• Technical logs are kept for a short time, for security and troubleshooting.
• Messages to us are kept as long as needed to deal with them.
• When a service shuts down, the personal data it holds is deleted.

We may keep data longer where the law requires it, or to establish, exercise or defend legal claims.

Security #

We take reasonable technical and organizational measures to protect personal data, such as encrypted connections, hashed passwords and limited access. No method of transmission or storage is completely secure, so we can't guarantee absolute security. You're responsible for keeping your own passwords, keys and devices secure.

If a breach affects your personal data, we'll notify you and the relevant authorities where the law requires it. To report a vulnerability, see the security policy.

Your rights #

Depending on where you live, you can ask us to:

• tell you what personal data we hold about you and give you a copy
• correct, complete or update it
• delete it
• restrict or object to how it's used
• send it to you in a portable format
• withdraw consent you've given, as easily as you gave it
• let someone else act for you if you die or can't act yourself (a right under India's DPDP Act)

Many services let you do this yourself, for example by deleting your account or removing a bot from a chat. Otherwise, email [email protected] from the address on your account, or include details that identify you in the service, such as your username or user ID. We may need to confirm it's you, and may decline requests that are unfounded, excessive or not allowed by law.

We respond within the time the law requires: within one month under the GDPR, and grievances under the DPDP Act within 90 days.

If you're in India, you can ask for this notice in English or in any language listed in the Eighth Schedule to the Constitution of India.

If you're not satisfied, you can complain to the Data Protection Board of India or, in the EU or UK, to your local data protection authority. We'd appreciate the chance to resolve it with you first.

Children #

The services aren't directed at children. Don't use a service that needs personal data if you're under 13, or under the age of digital consent where you live (18 in India), unless a parent or guardian has agreed. We don't knowingly collect data from children; if you think we have, email us and we'll delete it.

Changes #

We may update this policy at any time. The effective date at the top shows when it last changed, and past versions are kept in the public history of this page. Where a change materially affects how your data is used, we'll make reasonable efforts to let users of the affected services know, and ask for consent again where the law requires it.

Contact #

For anything about privacy or your data, email [email protected]. For security issues, use [email protected].

These addresses are on our current domain. If the domain changes, use the addresses in the latest version of this page. If an email bounces, see “Can't reach us?” at the bottom of this page.