Privacy policy

Last updated: May 2026

Buncha.tools (“we”, “our”, “us”) is a one-person workshop based in Brisbane, Australia. This policy explains what data we collect, how we use it, who we share it with, and your rights — including how to opt out of advertising personalisation or request deletion.

What we collect

Account data

When you create an account, we collect your email address and an encrypted password — or, if you sign in with Google, your Google profile email and name. Authentication is handled by Supabase (our hosted database provider).

Usage data

We log AI-tool usage against your account (which tool, when) so we can apply the daily quota for free and registered users. We do not log the contents of your prompts, files, or tool inputs.

Newsletter subscribers

If you sign up to the weekly newsletter, we store your email address along with a confirmation timestamp and your one-click unsubscribe token. Signup is double-opt-in: we never add you to the list until you click the confirmation link in the email we send you. Every digest email carries a one-click unsubscribe that takes effect immediately. We never share the subscriber list with third parties.

In-browser data

Most tools run entirely in your browser. Files you upload, text you paste, and tool outputs never leave your device. The exceptions are AI tools (which send your prompt to Anthropic) and the image upscaler (which sends your image to Replicate); both are sent server-to-server with no logging on our side beyond the usage row above.

Analytics & advertising

Subject to your consent choices below, we use Google Analytics 4 to understand which tools are popular, and Google AdSense to serve ads that help cover the cost of running the site. Both can drop cookies that identify your browser. If you decline consent (or your region requires opt-in and you haven’t opted in), both run in anonymised mode with no personalising cookies.

Cookies and tracking

We use three categories of cookies and similar storage:

Strictly necessary

Login session, premium-tier flag, mobile-bypass cookie, anti-abuse rate-limit counters. These do not require consent under GDPR or US state laws and cannot be disabled without breaking the site.

Functional (first-party)

Your saved tools, recents, favourites, bunches, recipes, business profile, kick counter history, and the like. Stored in your browser’s localStorage — never sent to our servers unless you explicitly choose “sync to my account” on a tool that supports it.

Analytics & advertising (consent required where applicable)

Google Analytics 4 (measurement ID G-MBDH11SS4P) and Google AdSense (publisher ID pub-3471956419070725). These are gated by Google Consent Mode v2: until you grant consent through the banner, both run with personalisation disabled and no identifying cookies. You can change your choices at any time via the “Privacy preferences” link in the footer.

Third-party processors

We rely on the following third-party services to run the site. Each is bound by their own privacy policy and applicable data- processing agreements:

• Vercel — site hosting, edge middleware, CDN. Receives the IP address and user agent of every visitor.
• Supabase — authentication, user accounts, AI usage rows, saved bunches. Hosted in the EU.
• Stripe — payment processing for premium subscriptions. We store a Stripe customer ID; card details never touch our servers.
• Anthropic — text-based AI tools (blog generator, summariser, etc). Your prompt is sent to Anthropic; outputs are returned to you and not stored on our side.
• Replicate — server-side image upscaler (Real-ESRGAN). Your image is sent to Replicate for processing and the result is returned to your browser.
• Google (Analytics + AdSense + Privacy & Messaging CMP) — site analytics, ad serving, and the consent dialog itself. Gated by Consent Mode v2 as described above.
• Nodemailer / SMTP — transactional email (welcome emails, premium receipts, newsletter confirmation and weekly digests). Your email address is shared with our outbound SMTP provider for delivery. We do not use a separate ESP for the newsletter list — the same SMTP path handles every outgoing email type.

Legal basis (GDPR & UK GDPR)

For visitors in the EEA, UK, and Switzerland, we rely on the following lawful bases under GDPR Article 6:

• Contract — for account management, premium subscriptions, and tool delivery.
• Legitimate interests — for security, abuse prevention, and aggregate analytics that cannot identify you.
• Consent — for personalised advertising and any analytics that uses identifying cookies. Consent is collected via the Google CMP banner and can be withdrawn at any time.

US state privacy rights

If you are a resident of California, Colorado, Connecticut, Virginia, Utah, or another US state with comparable privacy legislation, you have the right to opt out of the “sale” or “sharing” of your personal information for cross-context behavioural advertising. Personalised advertising via AdSense is treated as a “sale/share” for the purposes of these laws. To opt out, click “Privacy preferences” in the footer and decline personalised advertising — or set the Global Privacy Control signal in your browser, which we honour automatically.

Data retention

Account data is retained for as long as your account is active. AI usage rows are retained for 30 days for quota enforcement, then aggregated. Tool inputs and outputs are not retained on our servers at all. You can delete your account from /account; on deletion all associated rows are removed within 30 days.

Your rights

You have the right to access, correct, export, restrict, or delete your personal data, and to withdraw consent at any time. For most requests you can act yourself from /account or via the “Privacy preferences” footer link. For anything else, email hello@buncha.tools and we will respond within 30 days (GDPR) or 45 days (CCPA).

Children

Buncha.tools is not directed at children under 13 (under 16 in the EEA / UK). We do not knowingly collect personal data from children. If you believe a child has provided personal data here, contact us and we will delete it.

Changes to this policy

We may update this policy from time to time. Material changes will be flagged on the homepage news rail. The “Last updated” date at the top reflects the most recent revision.

Contact

Privacy questions, data-subject requests, regulator notices — hello@buncha.tools.