Privacy Policy

This policy applies to all tools published under Bag Of Holding Tools, including Manuscript Builder. All tools share the same account system, so one policy covers all of them. It explains how your personal data is collected, processed and retained, in accordance with French Law no. 78-17 of 6 January 1978 ("Informatique et Libertés") and Regulation (EU) 2016/679 ("GDPR").

"Personal data" means any information that can identify you directly or indirectly, such as your email address.

The data controller is the Site's publisher: an individual acting on a personal and non-commercial basis, publishing under the pseudonym mKzz in accordance with article 1-1, II of the French LCEN ("We"). Their full details are held by the host.

The data controller can be reached at any time at support@bagofholdingtools.com. That address is the single point of contact for every request concerning your data.

You can use every tool without creating an account. In guest mode, your data (manuscripts, pages, text, formatting and illustrations) is stored only in your browser (localStorage) and is never sent to our servers. Exporting to PNG or JSON happens entirely on your device. We have no access to guest-mode data.

Guest mode is not exempt from the optional audience measurement described in section 5. That covers browsing only (pages viewed, device type), never the content you create, and it stays off until you have accepted it.

An account is optional and serves to save your work in the cloud and continue on another device. Signing in with Google provides account information to our authentication service; saving work to your account additionally provides the content you choose to store:

• Your email address and authentication identifier, used to recognise your shared account;
• Google profile metadata received and retained by Supabase Auth during sign-in, including a profile-picture URL and, when provided by Google, your name;
• The creative content you choose to save to your account, such as text, images, structured project data and the settings needed to reopen your work.

Our application account record uses your email address and authentication identifier. The tools and the website do not display your Google profile picture or name, analyse the picture, or copy these profile fields into the application account record. Those fields can nevertheless remain in the authentication metadata held by Supabase Auth; not displaying them does not mean they are not collected or stored. The processing necessary to authenticate you and provide the cloud saving you request is based on performance of the account service contract.

Your account data is processed by the following providers, solely to operate the service:

• Supabase (EU region) — authentication and database hosting;
• Vercel — application hosting;
• Google — sign-in (OAuth) provider.
• Google Analytics — audience measurement, only if you have accepted it. Nothing is sent to it before you agree, and your content is never sent to it at all. See the Cookie Policy.

Your data is never sold, rented, or shared with any third party beyond these providers.

Account data is retained for as long as your account exists. You may request deletion of your account and all associated data at any time by writing to support@bagofholdingtools.com. Deletion is permanent.

Profile metadata retained in Supabase Auth is associated with the shared authentication account. Deleting that account also removes its authentication record, including this metadata.

We implement appropriate technical and organizational measures to preserve the security, integrity and confidentiality of your data and to prevent unauthorized third-party access.

Your account data is stored on Supabase servers, in a region located within the European Union.

Vercel and Google are based in the United States. Where your data is transferred outside the European Union, that transfer is covered either by an adequacy decision (including the EU–US Data Privacy Framework) or by the standard contractual clauses approved by the European Commission.

Under the GDPR, you have the following rights:

• Right of access, rectification and erasure of your data;
• Right to restrict processing;
• Right to data portability (receive your data in a machine-readable format);
• Right to object to processing;
• Right to withdraw your consent at any time;
• Right to define directives on what happens to your data after your death.

You can exercise these rights by writing to support@bagofholdingtools.com. We reply within one month of receiving your request.

You have the right to lodge a complaint with a supervisory authority — in France the CNIL — if you believe the processing of your data breaches applicable law.

Some tools let you enter information about other people. You are responsible for having the right to enter that information — see our Terms of Use. If a third party wants information about them removed from an account they do not control, they can contact us and we will forward the request to the account holder or act on it directly where required by law.

Our tools are not directed at children under 15. If you believe a child under 15 has created an account, contact us and we will delete it.

We may update this policy as tools are added or changed. Changes take effect upon publication, reflected in the last-updated date above.

Any question about this policy: support@bagofholdingtools.com.