Privacy policy

sdev.in is an independent site based in India. It has no newsletter. The tools do their work inside your browser, so the files and text you put into them are not sent to this site's servers. The same goes for captures made with the sdev browser extensions: they stay on your device.

You never need an account to use the courses, the tools or the free features of the extensions. An account is only needed to buy and use Pro, and you create it by signing in with Google. sdev.in then keeps your name, email address and Google profile picture, your plan and your payment records, and uses them only to run your account. No password is created or stored for you.

Apart from that, the site collects anonymous usage statistics (its own counts and Google Analytics), daily request counts per IP address to keep it safe from copying and floods (see how your data is protected), and whatever you choose to send through the contact form or by email. Pages may also show ads from Google AdSense (see advertising). Nothing is sold.

Every tool on this site (PDF, image, JSON, text, encoding, typing and the rest) runs as JavaScript in your browser. Your files, documents, images and text stay on your device. They are not uploaded, stored or logged by sdev.in, and nobody at sdev.in can see them. The tools that need the sdev.in server are What is my IP and the Instagram saver, described below.

Problem reports. Every tool has a Report a problem button. Nothing is sent until you press Send. A report holds the tool's name, what you pick as wrong, your note, any email address you add, your browser, your screen and window size, and the page address without what follows ? or #. While their boxes are ticked it also holds a picture of the window, the options you picked on the page (lists, tick boxes and buttons, never the text you typed or the files you opened) and this tab's recent error log. You can see each of these before sending, untick any of them, and cover parts of the picture with grey boxes; password boxes are covered for you. The error log lives only in this tab, with page addresses cut down to the site's name and personal details removed. Your IP address is not stored. Reports are kept for up to 180 days and used only to fix problems; reports our spam check flags are kept for 30 days and then removed.

Tool ratings. After you save a file, a small card may ask how the tool was, at most once per tool every 60 days. Nothing is sent unless you press one of its buttons. A rating holds the tool's name, Loved it or Could be better, and any note you choose to write (500 characters at most). Your IP address is not stored: to keep one rating per tool per person each day, we keep a scrambled code made from it, the tool and the date, which changes every day and cannot be turned back into your address. Ratings are kept for up to 1 year and used only to improve the tools; notes our spam check flags are kept for 30 days and then removed.

Fetching a web address. A few tools let you type a URL so they can load a page or image for you, for example the editor's import, HTML to PDF, the meta tag and Open Graph checkers, the QR code logo picker and the image converter. Browsers block most sites from being read directly, so in those cases the request is sent through a public CORS proxy run by a third party. That third party sees the URL you entered and the request from your browser. The proxies currently used are api.allorigins.win, proxy.corsfix.com, api.codetabs.com, corsproxy.io and r.jina.ai. Nothing you fetch is sent to sdev.in.

Instagram saver. To read a public Instagram post, the Instagram saver sends the post link you paste to the sdev.in server, which asks Instagram for that post's public embed page and returns its pictures, video and caption. The pictures and video then come to your browser through the sdev.in server on links that stop working after an hour. Instagram sees a request from the sdev.in server, not from you. sdev.in does not store the link, the post or the files; it keeps the answer in memory for up to 20 minutes so the same post is not fetched twice, and the request log described under your account applies.

What is my IP. To show your public IP address, the page asks the sdev.in server which address your visit came from. The server looks up the rough place (country, region and city) in a database kept on our own server, sends both back to your browser and keeps neither: these requests are left out of the request log and the web server's access log. To stop floods, the server counts requests by a scrambled code made from your address. The page can only ask about your own address. The address checker, the time zone check and the list of what sites can see work in your browser and send nothing. The "hide" choice is kept in this browser; the address itself is not. IP geolocation by DB-IP (CC BY 4.0).

Engines, models and fonts downloaded on demand. A few tools need a larger engine that is fetched only when you use it, then kept in your browser so it is not downloaded again. Text recognition (Image to text, OCR PDF and the OCR panel in Text case) loads the Tesseract engine and language files from cdn.jsdelivr.net. The background remover downloads its AI model from Hugging Face (huggingface.co and its hf.co download servers) after you press Remove background. Typed signatures, Text on photo, the collage maker and some design tools load handwriting and display fonts from Google Fonts (fonts.googleapis.com and fonts.gstatic.com). These services see an ordinary download request from your browser, including your IP address. Your images, documents and text are never sent to them.

Camera and microphone. The webcam and microphone tests and Scan to PDF ask the browser for permission and show or play the stream locally. The camera starts only when you press Start camera and stops when you leave the page. Nothing is recorded to a server, and the ten second test clip is kept in memory only until you leave the page.

Accounts are created and signed in with Google ("Continue with Google") on sdev.in or in an sdev extension. Google tells sdev.in your name, email address, profile picture and a Google account id, after you agree on Google's screen; sdev.in gets no access to your Gmail, contacts, files or anything else in your Google account, and never learns your Google password. Google knows that you signed in to sdev.in, under Google's own privacy policy. These are stored on the sdev.in account server:

• your name, email address, profile picture link and Google account id;
• sign-in records: which browser signed in and when, kept while that sign-in is active and for up to 30 days after, so you can see and end sign-ins and so misuse can be spotted;
• your plan (Free or Pro), its status and renewal date;
• the browsers and devices where you use Pro: a random install id made by the extension or app, a label such as "Chrome on Mac", and when it was last used (Pro works on 3 browsers or devices at a time for each extension or app);
• if you save designs, name lists or online checks in the certificate, card or stamp makers, those, described under saved designs and certificate checks;
• if you use the flashcards while signed in, your study progress there, described under flashcard and course progress;
• payment records, described under Payments below.

This data is used only to sign you in, keep your account secure, provide Pro and send you emails about your account: payments, renewals, cancellations, and changes to these policies. There are no marketing emails.

Logs. For security and support, the account server keeps three logs for 90 days: a log of requests to it (the time, what was asked for, the result, your IP address and browser, and your account id when you are signed in), a log of server errors, and a log of the emails it sends (the address, the kind of email and whether it was delivered, but not the message itself). A few people who run sdev.in can see these logs and your account details, only to keep the service safe and to help when you ask. What they do there, such as changing a plan or blocking an account, is recorded and kept for 2 years.

Email delivery. Account emails are sent through Twilio SendGrid, which receives your email address and the message only to deliver it, under its own privacy policy. Open and click tracking are switched off, so SendGrid does not track whether you read an email or follow its links.

The legal basis is your consent when you create the account and the contract when you buy Pro. You can withdraw consent at any time by deleting your account. You can also remove sdev.in from the apps connected to your Google account in your Google account settings; that stops new sign-ins but does not delete the sdev.in account, so delete it here too.

Scripts loaded only when you need them. The Google sign-in button is loaded from accounts.google.com only on the sign-in, account and Pro pages, and only there does Google see your visit. Razorpay's payment window is loaded from checkout.razorpay.com only when you press Get Pro. Your Google profile picture is shown from Google's image servers (googleusercontent.com) on the account page and in the extension, without telling Google which page you are on.

Team accounts. The few people who run sdev.in sign in with an email, a password stored only as an Argon2id hash, and a code from an authenticator app. Their sign-ins are recorded in the same way.

Pro is paid through Razorpay Software Private Limited, a payment company regulated in India. Your card, UPI, net banking or wallet details are entered on Razorpay's secure checkout and handled by Razorpay under its own privacy policy. sdev.in never sees or stores your card number or bank details.

From Razorpay, sdev.in receives and keeps: the payment and subscription ids, the amount, currency, date and status of each payment, the payment method type (for example "card" or "UPI") and the invoice. Payment records are kept for 8 years because Indian tax law requires it; if you delete your account they are kept without your name or email.

Support contributions. On the Support page, payments in rupees go through the same Razorpay checkout window as Pro, with no account needed. sdev.in keeps the amount, the name and message if you type them, whether you marked the message private (then only you and sdev see it), whether it is monthly, and the Razorpay order, subscription and payment ids. Your name (or "Someone" if you leave it empty), the amount and a message that is not private appear under Recent supporters on the Support page. Card payments from other countries open a Buy Me a Coffee page instead, under its own privacy policy; it tells sdev.in the amount and the name and note you enter there, which we keep (not your email). Card and bank details always stay with the payment provider.

The Full Page Screenshot extension captures, edits and saves pages entirely on your device. Captures, edits, saved sets and settings are kept in the extension's own storage in your browser and are never uploaded, except a picture you choose to add to a problem report. The extension reads a page only when you ask it to capture that page.

If something goes wrong, you can choose to send a problem report from the Full Page Screenshot or Screen Recorder extension. The report holds the extension version, your browser, the site's name, the layout facts of the page (the sizes and positions of its menus and panels, never the page's text), what you pick as wrong, your note, any email address you add, and the extension's recent error log. The full page address and the picture are sent only while those boxes are ticked, and you can untick them before sending. The error log is kept on your device for 7 days, with page addresses cut down to the site's name and personal details removed, and you can see it before sending. Your IP address is not stored. Reports are kept for up to 180 days and used only to fix those problems. Feedback notes sent from the extensions are kept for up to 180 days too and used only to improve them.

If you sign in from the extension, it talks to the sdev.in account server to sign you in and, about once a day, to renew its Pro licence. That request sends only the random install id, a label such as "Chrome on Mac" and the product name. The licence is checked on your device, so Pro keeps working offline for up to 7 days. Signing out removes the account details from the extension.

Winnow, the sdev photo-culling app for computers and phones, works on your photos only on your device. Your photos, their previews, ratings, labels and folders are never uploaded, and nobody at sdev.in can see them.

The app talks to the sdev.in account server only when you sign in and to fetch and renew your Pro licence, the same way the extensions do. To sign in, the app shows a short code and opens this site, where you approve it while signed in to your account; the app never sees how you sign in. The licence request sends only a random install id made by the app, a device label such as "MacBook Air" and the product name. Signing out removes the account details from the app.

Tools with a Settings file button can save your choices, or a document such as a resume, to a .sdev file on your device and open it again later. The file is made and read in your browser and is never uploaded. If you lock it with a password, it is encrypted (AES-256) with a key made from that password; the password is never stored or sent anywhere, so it cannot be recovered if you forget it. Without a password, anyone who has the file can read it. Passwords, tokens and uploaded files are not put in settings files.

After a download, Send to Drive or an app hands the file to your device's own share sheet, where you pick an app you already use, such as a cloud drive, mail or chat. Where the browser cannot do that, the page opens the storage site you choose in a new tab so you can add the file yourself. Either way the upload is done by that app or site with your own sign-in; sdev does not connect to these services, see your files or learn where you sent them. Only a count of sends and the kind of place picked is noted for site statistics.

The certificate, ID card, badge, visiting card and stamp makers work in your browser. Your designs, lists of names and photos stay on your device: the working design is kept in your browser's own storage (IndexedDB) so it is there when you come back, and it never leaves the device unless you choose one of the two things below.

Saving to your account. When you are signed in and press Save, the design (its layout, text, colours and any pictures or logos you placed on it) is stored on the sdev.in account server so you can open it on another device. A list of names is stored only if you save that list. Photos matched from a folder are never uploaded.

Online checks. If a design has a check QR code and you turn on the online check when downloading, then for each person the name, the issue date, the optional end date, the details printed on the certificate, the "for" and "issued by" text you typed, and a random check code are stored on your account. Anyone who opens that check link or scans the QR code sees exactly those details and whether the certificate is valid, expired or withdrawn; they never see your name or email. Check pages are marked so search engines do not index them.

Deleting. Delete a saved design, list or check record at any time and it is removed at once; a deleted check link shows "Not found". Deleting your account removes all of them. Records are kept until you delete them or your account.

Misuse. If a check record is reported as false or misused, we may withdraw or delete it. We share a record and the account behind it with the police or a court only when the law requires us to. The rules for using these makers are in the terms.

The flashcard maker and the interactive courses (such as the DSA course) work in your browser. Your decks, how well you know each card, and the stars and steps you reach in each course chapter are kept in your browser's own storage, and nothing is sent anywhere while you are signed out.

Signed in. When you use the flashcards while signed in, your own decks (their names and the text on the cards), how well you know each card and when it is next due, the days you studied (your streak, daily goal and badges), your best Match times and the stars, points and furthest step of each course chapter are stored with your account, so the same progress is there on your other devices. Files you open to make cards are read on your device and never uploaded.

Deleting. Delete a deck and it is removed from your account too. Deleting your account removes all of your flashcard progress; it is included when you download your data. Signing out leaves the copy in this browser as it is.

Final tests and certificates. The final test needs you to be signed in. When you start one, our server picks the questions and keeps that draw for up to 30 minutes; your answers are sent to be checked and are not stored. We keep when you last took each topic's test and its score, so a failed test waits an hour. Practice tests run only in your browser. When you pass, we keep a certificate record: the name you choose to print, the topic, your score and the date, under a short id. Anyone with that id or link can see the name, topic, score and date on the public check page; your email is never shown. Deleting your account deletes your certificates and test records, and they are included when you download your data.

On the rasi palan, calendar and Today pages you can pick your rasi, birth star, city and language. These choices are kept only on your device, in your browser's own storage (localStorage). They are never sent to our servers, and they are not put in analytics events, addresses or logs.

The public rasi palan pages are the same for every visitor: the page does not change based on who you are. Your own rasi is picked out on your device after the page loads. Clearing your browser's site data removes these choices.

All traffic uses HTTPS. Google sign-ins are checked on the server against Google's signing keys, sign-in tokens are stored only as hashes, sign-ins expire and are renewed with one-time tokens, and a copied token stops working once it is used. Team accounts need a password and an authenticator code, and attempts to guess them are rate limited. Access to the server and database is restricted and they are backed up.

Keeping the site safe from copying and floods. To spot programs that copy the site or flood it, the website server counts, for each IP address and day, how many pages and files it asked for and of which kind, how many were refused or slowed down, how evenly they were spaced, and the browser name it sent. It does not keep which pages you opened, anything after ? in an address, or anything you type or open in the tools. An address that asks for many pages without ever loading the site itself, which every real browser does, may be blocked for a while; a blocked visitor sees a page with their address and how to ask us to open it again. These counts and blocks are kept for 90 days, and the anonymous analytics below are never linked to them.

If a breach ever affects your personal data, you will be told by email without undue delay, and the Data Protection Board of India will be informed as the law requires.

sdev.in, the Winnow site and app, Refly and Agam count how they are used, so we know what to improve. Each page sends small anonymous counts to sdev.in's own server: the page and tool you opened, short event names such as a tool run or an export (with a few plain details such as the output format, never your content, file names or text), how long the page was in use, your device type, language, time zone and screen size, and the site you came from (its name only, not the full address). A link shared from the site's share button carries a short tag (such as ?s=em for email) naming the kind of app it was sent through; that is counted too, and the tag is taken off the address as the page opens. When you add your own font or paper photo to Text to handwriting, we count the font's name and file type, never the file itself; your files stay on your device. A random visitor id and a session id, kept in your browser's local storage, tell repeat visits apart. They are not linked to your account, and the server stores them only in scrambled (hashed) form.

Your IP address is used only to look up your country and state or region (the Pro page uses the country the same way, to show prices in rupees or dollars), with a database kept on our own server, and is then discarded. It is never stored or logged with these counts. Your browser's user agent is reduced to the browser and system name (for example Chrome on Windows) and is not stored either. The individual events are deleted after 30 days; after that only daily totals per tool, country and region are kept, with no visitor ids in them. The note of when a visitor id was first and last seen, used to tell new visitors from returning ones, is deleted 400 days after the last visit. IP geolocation by DB-IP (CC BY 4.0).

The site also uses Google Analytics 4 to count page views and to see which tools get used. It records the page you visited, an approximate location derived from your IP address, your browser and device type, and the same short event names. On sdev.in it runs in your browser and sets cookies on the sdev.in domain to tell repeat visits apart. On pages that can't load it (the Winnow app, Refly and Agam), sdev.in's server passes the anonymous counts above to Google Analytics instead: the random visitor id, the country, the device, browser and system type, never your IP address. Google processes this data on our behalf under its own terms.

If your browser sends Do Not Track or Global Privacy Control, nothing is counted: the server drops these counts at once, before anything is stored or passed on. Content blockers and browser privacy settings that block analytics are respected too, and every site works exactly the same without it.

sdev.in pages may show ads served by Google AdSense. To show and measure them, Google and its partners load a script from pagead2.googlesyndication.com and may use cookies or similar identifiers to show ads based on your earlier visits to this and other websites. Ads never see the files, text or pictures you use in the tools; those stay in your browser. Ads appear only outside the tools: in the guide below a tool, in the empty margin beside a tool on wide screens, between groups in lists, between passages on reading pages and at the end of a page. They never appear inside a tool, practice, study or drawing area, and never in a window that opens over the page, such as the one after a download. On Agam they appear only on its home page and on shared shelves and books, never in the reader or among your own books.

To keep the ads fair to advertisers, this browser notes when you open an ad, kept only here with the time of each click. If ads are opened several times in one day, this browser shows no ads for 7 days. Our analytics counts these clicks like other page events.

Some design makers (certificates, invitations, the family tree and the meal poster) put a small "Made with sdev.in" mark on free downloads. If you tap Remove sdev.in mark and then Watch and remove, one short video ad from Google Ad Manager plays, loaded from securepubads.g.doubleclick.net only at that moment. Afterwards your downloads have no mark for 5 minutes; the time is kept only in this browser. If no video can play, the file is clean anyway. Pro members never see these videos. Health, baby, children and family tools never show them.

Visitors in the European Economic Area, the United Kingdom and Switzerland are asked once, through Google's consent message, whether ads may use cookies; the choice is remembered and can be changed at any time from Privacy and cookie settings at the foot of every page. Visitors in US states with privacy laws see a "Do not sell or share my personal information" link from Google instead, which turns off personalised ads for them.

You can turn off personalised ads in Google's Ads Settings, and read how Google uses data from sites that use its services in How Google uses information from sites or apps that use our services. Content blockers that block ads are respected, and every tool works the same without them.

Some pages show a few "Sponsored links" to products on amazon.in, and the buying guides list products by need. As an Amazon Associate, sdev.in earns from qualifying purchases made after following one of these links, at no extra cost to you. These are plain links: the page loads nothing from Amazon, and Amazon learns nothing about you unless you click. When you click, Amazon may set its own cookies to know the visit came from sdev.in; its own privacy notice applies there.

We count clicks on these links by the product name only, in the same anonymous way as other page events. We never send Amazon what you did in a tool. The links appear only on the website, never inside the browser extensions or in files you download.

Some preferences are saved in your browser's local storage so they are still there the next time you visit. This includes your light or dark theme, recently used tools, drafts in the editor and text tools, typing lesson progress and results, recent entries in the QR code and Google review link tools, and your Thirukkural progress (learning streak, memorized kurals, flashcard schedule, quiz best scores and reading settings) and your Kolam progress and creations (streak, watched and saved designs, practice stars and the designs you make in Create). It also keeps a count of finished tool jobs and a few dates, so the small support note and the rating card show only now and then.

The Thirukkural listen buttons use your device's own text-to-speech voice. Most voices run on the device; a few browsers offer online voices, and those send the text being read to the browser maker's speech service. The share buttons open WhatsApp or your device's share sheet only when you press them.

This data lives only in your browser and is never sent anywhere. You can remove it at any time by clearing site data for sdev.in in your browser settings.

The site also installs a service worker that caches pages and scripts so they load faster and work offline. It stores no personal data.

Sign-in cookie. When you sign in on the website, the account server sets one cookie, sdev_rt, on api.sdev.in. It holds a random sign-in token, cannot be read by scripts, is sent only to the account server, and lasts up to 30 days or until you sign out. It is strictly necessary for staying signed in and is not used for tracking. To show your first name in the menu without asking the server, the site also keeps just that first name in local storage (sdev-account); it is removed when you sign out.

The courses, tool and extension pages show YouTube videos. Thumbnails are loaded from YouTube's image servers when a page is shown, and a video player is only loaded from youtube-nocookie.com after you press play. From that point YouTube may set its own cookies and collect data under Google's privacy policy.

The Google review link tool can show a map preview from Google Maps, and pages link out to Google Maps, the App Store, Google Play and similar services. Those sites have their own policies once you follow a link.

The tutorial videos on the sdev.in YouTube channel are uploaded with YouTube API Services, by a script that only the people who run sdev.in use, and only for the sdev.in channel. It uploads our own videos with their titles, descriptions, thumbnails and captions, and adds them to our own playlists. It does not ask visitors to sign in with YouTube, and it does not read, collect, store or share any data about you or your YouTube account. The only things it keeps are the ids and links of our own videos.

Watching our videos on YouTube is covered by the YouTube Terms of Service and the Google Privacy Policy. You can see and remove the apps that can use your Google account at any time in your Google account settings.

When you send a message through the contact form, the account server stores your name, email address, the topic, your message, the page you came from, and your IP address and browser. The IP address and browser are kept to stop spam and abuse; a message is checked automatically for spam (links, sending speed and similar signs) before anyone reads it.

Messages are kept for 1 year, and ones marked as spam for 30 days, then deleted automatically. A notification with your message is emailed to the sdev.in inbox through Twilio SendGrid so it can be answered. Only the people who run sdev.in can read messages, and your address is used only to reply to you. You are never added to a mailing list, and no automatic reply is sent.

If you write to hello@sdev.in instead, the message and your address are kept for as long as needed to reply and follow up. Either way, you can ask for your messages to be deleted at any time.

The site is not aimed at children under 13 and does not knowingly collect any information from them. You must be 18 or older to create an account or buy Pro. If you believe a child has created an account, email us and it will be deleted.

If you have an account, the Account page lets you see and correct your details, download everything stored about you as a file, end sign-ins, remove browsers from Pro, cancel Pro and delete your account. Deleting it removes your profile, sign-ins and devices at once and cancels any subscription; only payment records are kept, without your name or email, as the tax law requires.

Under India's Digital Personal Data Protection Act 2023, and similar laws such as the GDPR, you can ask for access to, correction of and erasure of your personal data, withdraw consent, nominate someone to act for you, and raise a grievance. Email hello@sdev.in; you will get a reply within 30 days. If you are not satisfied with the answer, you can complain to the Data Protection Board of India.

To stop analytics, turn on Global Privacy Control or Do Not Track in your browser, or use a content blocker or your browser's tracking protection. To remove saved settings, clear site data for sdev.in. Contact-form messages and email correspondence are removed on request.

When a tool starts talking to a new service, the analytics setup changes or the account service changes how it uses data, this page is updated and the date at the top moves. Account holders are emailed about important changes before they take effect.

Questions about this policy go to hello@sdev.in or through the contact page. sdev.in is responsible for your data and handles grievances at the same address. See also the terms and conditions and the refund and cancellation policy.