Privacy Policy

Who is responsible for your data

Abect Dev Tools is built and operated by Roman Popovych (Ukraine), who acts as the data controller for the purposes of the GDPR. For any privacy question, data request, or complaint, write to support@abect.com — this is the fastest route and we answer every message.

Short version

• The 49 browser tools — image converters, compressors, text converters, form-based schema generators — collect nothing. They need no account and your files never leave your device.
• An account is required only for the Lora AI assistant. Then we store your email, your conversations, and your token usage.
• Messages you send to Lora are transmitted to DeepSeek, an AI provider in China, to generate the reply.
• The service is free. There are no paid plans and we never ask for payment details.
• You can delete your account and everything in it at any time, in one click.

Browser-based tools — no data collected

Image converters, image compressors, text and code converters, and the form-based schema generators run entirely in your browser. Files you drop in or text you paste are processed locally using the Canvas API and File API — they are never sent to our servers, and we never see them. No file data leaves your device.

You can verify this: open DevTools → Network, use any of these tools, and observe that no file is transferred. These tools also keep working with the network disconnected.

User accounts

Creating an account is required only for the Lora AI assistant. If you register, we store:

• Your email address — used for login and transactional emails (verification, password reset)
• A bcrypt-hashed password — your actual password is never stored in plain text
• Display name, profile photo and Google account identifier — only when you sign in via Google
• Authentication provider — whether you use email/password or Google
• Whether your email address has been verified
• Email verification and password reset codes — six digits, valid for 15 minutes. They are stored on our servers until they are used or expire, then cleared.
• Your token balance and the date it next resets
• Tools you mark as favourites — the tool name and route, so the list can be shown back to you
• Account creation and last update dates

Your account record also contains an inactive subscription field that is fixed to the free plan. The service is free, we operate no paid tier, and we hold no payment or card data of any kind.

Authentication and sessions

When you sign in, we issue two tokens:

• Access token — a short-lived JWT (15 minutes), stored in memory only. It is never written to localStorage or cookies.
• Refresh token — a 30-day session identifier stored as a secure, httpOnly, SameSite=Strict cookie (refreshToken). It is not accessible to JavaScript. In our database it is a random UUID, not a decodable JWT.

Each time you open the site, the refresh token silently restores your session. Logging out immediately invalidates the token and removes the cookie. Refresh tokens are deleted from the database automatically 30 days after issue, enforced by a database-level expiry rule.

Lora AI assistant

When you send a message to Lora, your message and the earlier messages of that conversation are transmitted to the DeepSeek API to generate a response. This is the only feature on the site that sends your input to a server.

We store, linked to your account:

• Every message in the conversation — both yours and Lora's — and the tokens each one cost
• A conversation title, generated from your first message
• Which skill the conversation uses
• Files produced by Lora. When a reply contains a complete file — a code snippet with a filename, a schema, a config — we extract and store that file's name and full contents so it can be shown in the conversation's file panel. These are files the assistant generated, not files you uploaded; the chat has no file upload.
• An optional summary of the conversation, if you generate one

Conversations are private. Every conversation is readable only by the account that created it; the server refuses any other request. There is currently no feature that makes a conversation public or shareable.

We do not use your messages for advertising, for training any model, or for anything other than producing the response you asked for. You can delete individual conversations from the sidebar, or remove everything by deleting your account.

Token system

Each AI request deducts tokens from your monthly balance. We keep a transaction log of charges, refills and bonuses linked to your account — the amount, the type, a short description and the timestamp. It exists to display your usage history in Profile → Usage and to keep the balance accurate. It is deleted permanently when you delete your account.

Technical data and server logs

• Infrastructure logs. Delivering any website requires processing connection metadata — IP address, user agent, requested URL, timestamp. Our hosting provider and API server process this to serve responses and to detect abuse.
• Rate limiting. To block brute-force and abuse, the API counts requests per IP address in server memory (for example, 10 sign-in attempts per 10 minutes). These counters are transient and are not written to the database.
• Application logs. The API writes operational logs — errors and warnings, which may include the internal account identifier of the affected user, but not your conversation content. Log files rotate daily and are deleted after 30 days.

Analytics

• Google Analytics 4 and Microsoft Clarity — page views, clicks, scrolling, device type and general usage patterns, used to find usability problems. Neither one loads until you explicitly accept analytics cookies in the consent banner.
• Vercel Web Analytics — a privacy-preserving, aggregate page-view counter provided by our host. It sets no cookies and builds no cross-site profile, so it runs without a consent prompt.

Cookies and local storage

• refreshToken — set when you sign in. Secure, httpOnly, SameSite=Strict, expires after 30 days. Strictly necessary to keep you signed in.
• Analytics cookies — Google Analytics 4 and Microsoft Clarity. Loaded only after you accept them in the consent banner.
• Local storage — your cookie choice, colour theme, sidebar mode, and a flag noting that you were signed in (so the header does not flicker on load). This data stays in your browser and is never transmitted.

Who we share data with

• DeepSeek (China) — receives your Lora messages and conversation history to generate replies. See DeepSeek's privacy policy.
• Brevo (France, EU) — delivers transactional emails. Receives your email address and the verification or reset code.
• Google (USA) — Google OAuth sign-in and Google Analytics 4. With "Continue with Google", Google shares your name, email and profile photo with us. See Google's privacy policy.
• Microsoft (USA) — Clarity session analytics, consent-gated.
• Vercel (USA) — hosts the website and provides aggregate analytics.

We do not sell your data, we do not share it with advertisers, and we do not use it to build advertising profiles.

International data transfers

If you are in the European Economic Area or the United Kingdom, note that using the Lora AI assistant transfers your messages to DeepSeek in China, a country without an EU adequacy decision. Analytics and hosting providers listed above process data in the United States. Our own API server is operated from Ukraine, which the European Commission has not issued an adequacy decision for.

If you do not want your text leaving this jurisdiction set, do not use the AI assistant — every other tool on the site runs entirely on your own device and transfers nothing.

Why we are allowed to process this (legal basis)

• Performance of a contract — account data, sessions, conversations and token accounting. Without them the AI assistant cannot work.
• Your consent — Google Analytics 4 and Microsoft Clarity. You may withdraw it at any time via Cookie Settings, with no effect on anything else.
• Legitimate interest — rate limiting, abuse prevention and error logs, in order to keep a free service available and secure.

How long we keep it

• Account data, conversations, generated files and transaction history — until you delete your account
• Refresh tokens — 30 days from issue, then removed automatically
• Email verification and password reset codes — 15 minutes
• Application logs — 30 days
• Rate-limit counters — minutes, in memory only
• Analytics data — per Google's and Microsoft's own retention policies

Your rights

Under the GDPR and comparable laws you have the right to access your data, to correct it, to erase it, to restrict or object to its processing, to receive a copy in a portable format, and to withdraw consent at any time.

• Erasure — immediate and self-service: Profile → Account → Delete account. It permanently removes your account, every stored conversation and generated file, your full token transaction history, and all active sessions. Nothing personal is kept afterwards.
• Access, correction, portability, restriction, objection — email support@abect.com and we will respond within 30 days.
• Withdrawing analytics consent — Cookie Settings, in the sidebar footer.

If you are in the EEA or UK and believe we have handled your data improperly, you also have the right to lodge a complaint with your national data protection authority.

Children

Accounts are not intended for anyone under 16. We do not knowingly collect data from children. If you believe a child has created an account, write to support@abect.com and we will delete it. The browser tools collect no data at all and can be used by anyone.

Security

Passwords are hashed with bcrypt. Sessions use httpOnly, SameSite=Strict cookies over HTTPS only. The database is not reachable from the public internet. To report a security issue, see our security.txt or write to support@abect.com.

Changes to this policy

We update this policy as the product changes. The current version always lives at devtools.abect.com/privacy-policy, with the revision date at the top. If a change materially affects how we handle your data, we will make it visible on the site rather than changing the text quietly.