Privacy policy

Short version: We collect very little, share nothing, and respect every right you have under GDPR, India's DPDP Act, and CCPA.

Effective date: 18 May 2026 · Last updated: 18 May 2026

1. Who we are

Aravind Labs ("we", "us", "our") is a one-person AI studio based in Bengaluru, India, operating aravindlabs.tech and its subdomains including (but not limited to):

Toolvana at toolvana.aravindlabs.tech — 196+ free privacy-first browser tools
Phantom at phantom.aravindlabs.tech — open-core developer tooling
VisionX at vision.aravindlabs.tech — AI vision playground
Other experimental projects under the Aravind Labs umbrella

This policy covers all properties under the aravindlabs.tech domain. Contact: hello@aravindlabs.tech.

2. What we collect

2.1 Data you actively provide

Files and text processed in our browser tools: These never leave your device. Our tools run entirely client-side using JavaScript and WebAssembly. We have no upload endpoint for tool inputs.
Email correspondence: If you email us, that email and attachments are visible to us. We use them only to respond.
Account data (Phantom only): For Phantom Pro licensing, we collect email and payment confirmation from Razorpay. We do not see credit card numbers.

2.2 Automatic collection

Server access logs: standard request metadata (IP, timestamp, URL, referrer, user agent). Rotated every 7 days, used only for troubleshooting.
Anonymous analytics: We may use privacy-preserving page-view counters (Plausible / self-hosted Umami). No cookies, no individual identifiers.

2.3 Third-party services

Some properties use third-party services that may collect their own data per their own policies:

Google AdSense (only after consent) — serves ads on selected browsing pages. Uses cookies for ad personalization and frequency capping. Google's policy. Opt out at Google Ad Settings.
Google Fonts & CDN providers (jsDelivr, cdnjs, unpkg) — may log standard request metadata.
Razorpay (Phantom only) — payment processing; their privacy policy applies during checkout.
NVIDIA NIM, Pollinations.ai — third-party AI inference; only the user prompt is sent, no personal identifiers.

3. Cookies and similar technologies

By default we set no cookies. After you accept on the consent banner (where applicable), the following may be set:

al_consent / tv_consent — your consent choice (no personal data)
al_theme / tv_theme — light/dark preference
Tool-specific localStorage — settings stored only in your browser
Google AdSense cookies (__gads, __gpi, IDE) — set by Google after consent

You can revoke consent anytime via the "Manage cookies" footer link or by clearing site data.

4. How we use information

To operate and maintain the sites and services.
To diagnose technical issues and prevent abuse.
To respond to support emails.
To process Phantom Pro license payments and provide license keys.
(With consent) to display contextual or personalized ads via Google AdSense.

We do not sell data, share with brokers, or profile you across other sites.

5. Advertising disclosures (AdSense)

When ads are enabled (with your consent), we participate in the Google AdSense program. Per Google's requirements:

Third-party vendors, including Google, use cookies to serve ads based on your prior visits to this and other websites.
Google's use of advertising cookies enables it and partners to serve ads based on your visits.
You may opt out of personalized advertising at Google Ad Settings or aboutads.info.
For users in the EEA, UK, and Switzerland, Google operates under the IAB Transparency & Consent Framework. Ads will not be served until consent is provided.

6. Your rights

6.1 EU / EEA / UK (GDPR / UK GDPR)

Right to access, rectify, and erase your data.
Right to restrict or object to processing.
Right to data portability.
Right to withdraw consent at any time.
Right to lodge a complaint with a supervisory authority.

6.2 India (DPDP Act, 2023)

Right to be informed about processing of your personal data.
Right to correction and erasure.
Right of grievance redressal — contact hello@aravindlabs.tech.
Right to nominate another person to exercise your rights.

6.3 California (CCPA / CPRA)

Right to know what personal information is collected.
Right to delete personal information.
Right to opt out of "sale" / "sharing" — we do not sell or share.
Right to non-discrimination for exercising these rights.

To exercise any right, email hello@aravindlabs.tech with subject "Privacy Request". We respond within 30 days.

7. Data retention

Server access logs: rotated every 7 days, then deleted.
Email correspondence: retained up to 2 years for support continuity.
Phantom Pro license data: retained for the duration of the license + 7 years for accounting compliance.
Your localStorage data: retained in your browser until you clear it.

8. Children's privacy

Our services are not directed to children under 13. We do not knowingly collect personal information from children under 13. If a child has provided personal info, contact us for immediate deletion.

9. Security

All sites are served over HTTPS (TLS 1.3) with HSTS. The server is patched regularly. Because tool inputs run client-side, there is no server-side breach risk for your files.

10. International transfers

Our infrastructure is in India. CDN endpoints (Google Fonts, jsDelivr) and ad networks (Google AdSense) may transfer data outside your country under standard contractual clauses.

11. Changes to this policy

We may update this policy from time to time. The "Last updated" date reflects the most recent version. Material changes will be flagged on the homepage for at least 14 days.

12. Contact

Privacy questions, requests, or complaints:

Email: hello@aravindlabs.tech
Subject prefix: [Privacy]
Response time: within 30 days