Privacy Policy

Powertoolz is owned and operated by Logic Overdrive (Mumbai, India). Throughout this policy, “we”, “us”, and “our” refer to Logic Overdrive.

For privacy questions, write to [email protected].

In line with the Digital Personal Data Protection Act, 2023 (India), our Grievance Officer is Ketan Parajia, reachable at [email protected].

Registered office: Logic Overdrive, Mumbai, India

We collect the minimum data needed to run the service.

• Account data. Email address and/or phone number (via OTPless, our authentication provider), your name, and an optional company name.
• Tool runs you save.When — and only when — you click “Save” on a tool, we store the input and output of that run as JSONB in our database, tagged with your account and any project you assigned it to.
• Server logs. Your IP address (for rate limiting and abuse prevention), user agent, request path, and timestamp. Retained for 30 days, then deleted.
• Cookies. One httpOnly authentication cookie holding a JWT session token. We do not set advertising or third-party tracking cookies, and we do not embed analytics SDKs that exfiltrate personal data.

• CSR and DKIM private keys. Generated entirely in your browser using the Web Crypto API and the node-forge library. The private key never leaves your device.
• JWT tokens you decode. Decoded client-side in your browser. The token string is never sent to our servers.
• API Workspace request bodies and headers. Each request you fire is handed to a single-use Docker container that has no persistent storage and is destroyed after responding. We do not log request URLs, headers, bodies, or response bodies unless you explicitly click Save.
• Image bytes. Image Tools resizes, compresses and converts entirely in your browser using the Canvas API. Your image bytes are never uploaded.
• SQL Playground data. Your queries and the underlying data run in a SQLite WebAssembly instance inside your browser. Nothing is transmitted.
• Plaintext passwords. If you use the legacy email + password flow, your password is hashed with bcrypt before storage. We never hold the plaintext.

We use the data described in Section 2 for these purposes only:

• To authenticate you and keep you signed in
• To save and share content that you deliberately save or share
• To enforce rate limits and prevent abuse
• To detect and respond to security incidents
• To send service-related email (security alerts, account changes, policy updates)

We do not profile users for advertising. We do not sell access to your data. We do not use your saved runs to train any machine-learning model.

We do not sell user data. We do not run ad networks.

The sub-processors we use to operate the service:

We sign a Data Processing Agreement (or equivalent) with each sub-processor. We will publish material changes to this list at least 30 days before they take effect.

Hosting is in the European Union (Hetzner, Germany). Authentication uses an India-based provider (OTPless). Cloudflare and Google operate globally. Where data is transferred outside your country of residence, we rely on Standard Contractual Clauses or equivalent legal safeguards approved by the data-protection regulator in that country.

Regardless of where you live, you may exercise the following rights with respect to your account and the data you saved:

• Access — get a copy of the personal data we hold about you
• Export — download your saved runs and account information in JSON
• Correct — update inaccurate information
• Delete — close your account and remove your data
• Object or restrict — limit how we process your data in specific cases
• Withdraw consent — for any processing we perform on the basis of consent

Users in the European Economic Area (GDPR), India (DPDP Act 2023), California (CCPA / CPRA), Canada (PIPEDA, Quebec Law 25), and the United Arab Emirates (PDPL) have these rights enshrined in law. We apply them universally — you receive the same treatment regardless of where you live, rather than being tiered by jurisdiction.

To exercise any right, email [email protected]. We respond within 30 days. If we need to verify your identity for a sensitive request, we will tell you what we need.

You also have the right to lodge a complaint with the data-protection authority in your jurisdiction. Indian users may contact the Data Protection Board of India.

• Webhook payloads — 24 hours for anonymous use, 7 days for logged-in use. Stored in Redis with a TTL so they are erased automatically.
• Mock server configurations — 24 hours anonymous, 30 days logged-in. Same TTL mechanism as above.
• Saved tool runs — kept until you delete them.
• Server access logs — 30 days, then deleted.
• Account deletion — when you ask us to delete your account, we run a 30-day soft-delete grace period (in case you change your mind), then permanently purge your account, projects, saved runs and shared links.

Powertoolz is not intended for users under 16. Please do not create an account if you are under 16. If we learn that we hold data about a child under 16, we will delete it.

How we protect the data we do hold:

• TLS 1.2 / 1.3 only, with HSTS enabled on the production domain
• Host firewall (UFW) restricts inbound traffic to ports 22, 80, 443
• Database (PostgreSQL) and cache (Redis) are bound to localhost only
• Fail2ban guards SSH against brute-force attempts
• The API Workspace tool runs each request inside a one-shot Docker container with --cap-drop=ALL, no host network access, a 30-second hard timeout, and no persistent storage
• Passwords (legacy login) are hashed with bcrypt
• JWT-based sessions with a 7-day expiry
• We will notify affected users without undue delay in the event of a personal-data breach, in line with applicable law (including 72-hour notification under GDPR and 6-hour reporting to CERT-In under Indian law)

We will post material changes here and notify logged-in users by email at least 30 days before they take effect. We keep prior versions of this policy on request.

• [email protected] — privacy questions and rights requests
• [email protected] — DPDP Act grievances (India)
• [email protected] — legal correspondence and notices

This Privacy Policy was last updated on May 7, 2026.