Privacy Policy

1. Our approach: privacy and security by design

Utility Belt is built around a simple principle: do as much in your browser as possible, collect as little personal data as practical, and never sell what we do collect. We design and review features with privacy and security in mind from the start rather than as an afterthought.

• We minimize what we collect and only keep what we need to run the product.
• We never sell or rent personal data.
• Account features are optional. Most tools work without signing in.
• We maintain an internal process for handling data subject and consumer rights requests (see Submitting a data request).

2. Client-side by default

The marketing tools (calculators, formatters, validators, generators) execute entirely in your browser. Inputs you paste — URLs, CSV rows, campaign parameters, margins, etc. — are not transmitted to our servers as part of normal tool use.

Data leaves your device only when you take an explicit action: saving a run, favoriting a tool, sending feedback, or signing in. Those actions are described below.

3. Data we handle

4. Service providers we rely on

We work with a small number of vendors to operate the service. Each one only sees the data needed for its function:

• Supabase — authentication, database (saved runs, favorites, feedback), and transactional auth emails (e.g. magic links).
• Vercel — hosting and edge delivery of the application.
• Google AdSense — display advertising on pages that include ad slots, where enabled.

We do not sell personal data, and we do not share saved runs, favorites, feedback content, or account email with advertisers.

5. Legal bases (EEA / UK users)

If you are in the EEA or UK, the GDPR / UK GDPR bases we generally rely on are:

• Contract — to provide account features such as saved runs and favorites once you sign in.
• Legitimate interests — to keep the service secure, prevent abuse, and understand aggregate product usage. We balance these interests against your rights.
• Consent — where required, for advertising cookies or similar identifiers, collected through the relevant consent prompt.
• Legal obligation — to respond to lawful requests and meet record-keeping duties.

6. Your rights

Depending on where you live, you may have the right to:

• access a copy of personal data we hold about you;
• correct inaccurate data;
• delete your account and associated data;
• port your data in a machine-readable format;
• restrict or object to certain processing, including direct marketing;
• withdraw consent at any time where we relied on consent;
• not be discriminated against for exercising your privacy rights (California and similar regimes).

California residents have specific rights to know, access, delete, and opt out of the “sale” or “sharing” of personal information. We do not sell personal information. To exercise any of these rights, see Submitting a data request.

7. Submitting a data request (DSAR)

A data request — sometimes called a DSAR (Data Subject Access Request) or consumer rights request — is how you ask us to access, export, correct, or delete information we hold about you, or to restrict how we use it.

To submit one:

1. Open the Feedback page.
2. Choose Privacy / data request as the request type.
3. Tell us what you’re asking for (access, deletion, correction, export, opt-out, etc.).
4. Include the email address associated with your account so we can verify your identity. We may ask one or two follow-up questions to confirm it’s really you before acting on the request.

We aim to acknowledge requests within 7 days and substantively respond within 30 days, in line with common GDPR and CCPA timelines. If a request is unusually complex we may extend that window and will tell you why. There is no charge for routine requests.

8. Advertising & cookies

Some pages reserve space for display ads. Where shown, the ad network may set cookies or similar identifiers under its own policies. In regions that require it, an ad consent prompt will appear before any ad personalization is enabled, and you can change your choice later.

We use a small number of strictly necessary cookies and local storage entries to keep you signed in and to remember preferences such as theme. These are not used for advertising.

9. Security

We apply reasonable technical and organizational measures to protect the data we handle, including row-level security on our database, scoped access controls so users can only see their own saved runs and favorites, encrypted transport (HTTPS), and ongoing review of dependencies and configuration. No system is perfectly secure; if you believe you’ve found a vulnerability, please report it via the Feedback page.

10. Changes to this policy

We may update this policy as the product evolves. Material changes will be reflected by the “Last updated” date above and, where appropriate, an in-app notice. Continued use after a change constitutes acceptance.

11. Contact

Privacy questions, complaints, or data requests can be sent through the Feedback page using the Privacy / data request option. We read every message and route privacy matters to the person responsible for them.