Privacy Policy
Effective 12 October 2026. Short version: most tools run entirely in your browser and never send your input anywhere. We only hold personal data if you buy a paid plan, or briefly for security.
1. Who we are
NoFrillzApps (nofrillzapps.com) is operated by ARAFATEC Systems & Services LLP, India, the data controller for the personal data described here. Contact us about privacy at onboarding@nofrillzapps.com.
2. The tools
Processed only in your browser
Formatters, encoders, hash and UUID generators, converters, calculators, image tools and the PDF merger run as JavaScript on your device. What you type, paste or open is not uploaded to us or anyone else.
Tools that query a public API
A few tools need outside data. Your browser contacts the provider directly. The provider sees the request and your IP address, and its own privacy policy applies:
- What Is My IP: ipify and ipwho.is (your IP address, to look up its location)
- DNS Lookup: Cloudflare DNS-over-HTTPS (the domain you look up)
- SSL Checker: Cert Spotter and crt.sh (the domain you check)
- Currency Converter: open.er-api.com (exchange rates only; your amounts stay in your browser)
3. Embedded tools
When a tool is embedded on another website, it behaves exactly as it does here, and that website's own privacy policy also applies. White-label embeds send the site owner's public embed license to our API to check it is valid; like any request, this reveals the visitor's IP address to us (see section 6).
4. The API
Data you send to the API (JSON, text to hash, timestamps, etc.) is processed in memory to produce the response. It is not stored or logged. For each API key we keep usage counters (date, endpoint and number of requests) for 48 hours to enforce limits and show your usage statistics.
5. Paid plans
Payments are handled by Razorpay. Card and UPI details are entered in Razorpay's secure window and never reach us. When you subscribe we store your email address, your Razorpay subscription ID, plan, the key (and, for embed plans, the license) issued to you, its status and when it was created. We use them to deliver and manage your subscription, and to revoke access when it ends. We send your welcome email (containing your key) through Resend.
We keep this record while your subscription is active and for 45 days after it ends, then delete it automatically. If you start a checkout but don't finish it, your email and chosen plan are deleted automatically within 24 hours. Razorpay keeps its own payment records as required by law.
6. Security and abuse prevention
To stop abuse, our API counts requests per IP address. These counters are deleted automatically within two minutes. When something security-relevant happens (a rate limit is hit, an invalid key or license is used, a checkout is started, a payment can't be verified, or a payment-webhook signature fails), we log the event with your IP address. These logs are kept for up to 30 days.
7. Analytics, cookies and local storage
We use Cloudflare Web Analytics to count visits. It sets no cookies and reports only aggregate data such as page views and referring sites. We set no cookies ourselves. Your light/dark theme choice is saved in your browser's local storage and never leaves your device.
We do not currently show ads. If that changes, we will update this policy and, where the law requires it, ask for your consent first.
8. Who processes data for us
- Cloudflare: hosting, content delivery, API servers, storage, logs and analytics
- Razorpay: payments and subscription billing
- Resend: transactional email
These providers may process data in countries other than yours, including the United States, under their own safeguards. We do not sell personal data or share it for advertising.
9. Why we can process it
Where laws such as the GDPR apply, we rely on contract to provide paid plans, and on our legitimate interests for security logging, rate limiting and aggregate analytics. We also rely on legal obligation for records we must keep.
10. Your rights
Depending on where you live, you can ask to access, correct, delete or export your personal data, or object to how we use it. Email onboarding@nofrillzapps.com and we will respond within 30 days. You can also complain to your local data-protection authority.
11. Children
The site is not directed at children, and paid plans are for adults and businesses. We do not knowingly collect personal data from children.
12. Changes
If we change this policy we will update the effective date above. For significant changes affecting paid subscribers, we will also tell you by email.