Privacy notice
Updated 17 September 2026.
Buddy Code Tools is in pre-launch development. The legal operator details must be confirmed before public launch. For privacy questions, contact info@buddycode.tech.
Your tool inputs
The current browser tools process files, text, calculations and microphone audio on your device. These inputs are not uploaded to Buddy Code Tools. Microphone access requires permission. Recordings remain temporary; exported files are saved by you. The interval timer can save a preset in your browser when you choose to save it.
Protected API calls are different: submitted inputs are sent to the server to calculate a response. Application metrics exclude request bodies and results. API execution is disabled by default and requires approved access when enabled.
Accounts and email
We store your display name, email address, salted password hash, session records and verification status to provide and protect your account. Passwords are not stored in plain text. Verification and recovery links expire and their tokens are stored as hashes. If configured, Resend receives the recipient address and transactional email content to deliver those links.
If you choose Google sign-in, Google handles authentication and we store its account identifier, your name and verified email. Google tokens are not retained. We do not automatically link existing password accounts by email.
Comments, reports and support
Your display name, comment and posting date are public. Email addresses and reports are not public. Authorised moderators can read reports and hide or restore comments. When enabled, new public comments and display names are also emailed to the operator through Resend for review. Moderation decisions are logged. Support emails contain the information you choose to send and are handled through our support mailbox.
Cookies and measurement
An essential HttpOnly session cookie keeps you signed in for up to seven days. Google sign-in uses short-lived security cookies. When enabled in production, Vercel Web Analytics and Speed Insights measure page use and performance. Tool events contain a tool identifier and broad referral category, not tool inputs. Homepage engagement events contain only reviewed link or section identifiers; section visibility does not prove reading and contact clicks do not prove an enquiry. Account and API pages are excluded, and URL queries and fragments are stripped. No advertising scripts are currently installed.
Purposes and service providers
We use account data to provide the service you request, and security/moderation records to prevent abuse and protect users. Optional product measurement helps us understand whether tools work. Before public launch, the operator must confirm the applicable lawful bases, analytics settings and any consent requirements for the deployment.
Hosting and database providers process service data on our behalf. The platform supports Vercel hosting and Neon PostgreSQL storage; the actual providers, processing locations and international transfer safeguards must be confirmed for the production deployment. Google is involved only when you choose its sign-in option. Email delivery is involved when you request account emails.
Retention
Account records and comments remain while the account and discussion are maintained, unless removed through a reviewed request. Hidden comments, reports and moderation history are retained for follow-up; hiding is not deletion. A production retention and backup-deletion schedule must be set before launch.
Sessions expire after seven days. Reset links expire after 30 minutes and verification links after 24 hours; expired token records are cleaned when new links are issued. Rate-limit records expire by their configured windows. Provider logs and backups have their own retention settings.
Your choices and rights
You can use the browser tools without an account, stop microphone access, and clear locally saved preferences through your browser. Contact us to request access, correction, deletion, restriction or portability of personal information, or to object to processing where applicable. These rights depend on your location and circumstances. We may verify your identity. You may raise concerns with your local data protection authority; in the UK, this is the Information Commissioner’s Office.