Privacy Policy

The short version

FreePanda's tools fall into three groups, and each handles your data differently.

• Tools that run in your browser — almost all of them: the formatters, converters, calculators, PDF and image tools. What you type, paste or drop into them is processed on your device and never sent to us. They need no account, and they are free with no limit.
• Tools that keep your records in an account — the document generators (invoice, receipt, quotation, purchase order and delivery challan), the Asset & Warranty Manager and the Shagun Register. What you save is stored on our servers, in your account.
• Tools that use our server to do the job — the SEO Audit and AI Visibility Audit, the server features of the Email Preview Checker, the AI concept images in the House Plan Designer, What Is My IP and the Internet Speed Test. Each sends only what that job needs, and says so at the top of its page.

The sections below say exactly what is sent, what is stored, who can see it, how long it is kept and how to have it removed. We do not sell your data, and we do not use what you enter or save for advertising. Separately, the site uses Google Analytics to count visits and shows advertising; both set their own cookies, and those sections are further down.

Who is responsible for what

For your account, and for how you use the site, Freepanda decides how your data is used.

For the records you enter about other people — customers and suppliers on a document, the vendor of an asset, the guests at a function — you decide what to record and why, and we store and process it only to run the service for you. You are responsible for having a proper reason to record it. If your details were recorded by someone else and you would like them removed, ask that person first; if that is not possible, write to us and we will help.

What never leaves your device

Every tool not named on this page computes locally. JSON you format, tokens you decode, PDFs and images you open, spreadsheets you convert, salary and tax figures you enter — none of it is sent anywhere. There is no upload request carrying it, so we have nothing to store, log or disclose. You can confirm this in your browser's developer tools: open the Network tab and use any of those tools.

Some of these tools download code or data they need the first time you use them — the image-to-text tool, for example, downloads the language model for the language you pick. That is a download to your device; your image stays where it is.

What we store when you use an account

• Your account. Your email address and name, a hashed password (we cannot read it), your organisation and role, your plans, and whether your email is verified.
• Sign-in and security records. For each session, the time, the IP address and the browser or device. Where something is changed — an entry edited or voided, an event closed, a plan changed — a record of who did it and when.
• Documents. Everything on an invoice, receipt, quotation, purchase order or delivery challan as you entered it: your business and your customer's name, address, GSTIN, email and phone, the line items and amounts, bank account number, IFSC and UPI ID, and your logo. Customers and suppliers are also kept in an address book so you do not retype them.
• Assets. Names, serial numbers, purchase dates and prices, vendors, locations, warranty and service records, who holds each item, and the photos and invoices you attach.
• Shagun registers. Events; the names, villages, addresses, phone numbers and relations of your guests; the amount, payment mode and reference (a UPI reference or cheque number) of each entry; and who recorded it, and when.
• Audit reports you keep. The audits you run while signed in, and any you ran before signing in and chose to keep — see the next section.
• A count of what you have used. For the tools with a monthly allowance — audits, email test sends and rendered previews — a record of each use (when, which tool and, for email, which client and a fingerprint of the HTML), so the allowance can be counted. The fingerprint is a one-way hash: it can tell that the same email was sent again, but the email cannot be rebuilt from it.
• Emails we send you. Verification codes, password resets, warranty reminders, and the test emails you ask for. We do not send marketing email without asking.
• Messages you send us. What you type in the contact form — your name, email address and message — is delivered to our inbox and is not otherwise stored.

The tools that use our server

SEO Audit and AI Visibility Audit

These need no account. When you start one, the address you enter is sent to us, and our crawler, FreePandaBot, reads that site's public pages, its robots.txt, sitemap and llms.txt, the way a search engine would. It obeys robots.txt and never logs in or submits a form.

• What is stored: the address, the report built from the crawl, and when it ran. The raw copy of the pages crawled is discarded about a day after the audit finishes; the report is what remains.
• Who can read a report: anyone who has its link. A report is addressed by a long random identifier, and that identifier is the only key to it — so a report can be shared by sending the link, and anyone you send it to can open it. The identifier is taken out of the page address before anything is sent to Google Analytics or an advertising partner.
• How long: a report made without an account is kept for 7 days. A signed-in report is kept for as long as your audit plan allows — 30 days on the free plan and up to a year on the larger ones. After that it is deleted, not merely hidden.
• Limits, without knowing who you are: to stop the crawler being abused, we count audits per requester. For a visitor without an account, the requester is a keyed hash of the IP address — we store the hash, not the address, and it cannot be turned back into one. While signed in, it is your account.
• On your device: the identifiers of the reports you ran before signing in are remembered in your browser for 7 days, so you can keep them if you then sign in.

If you run the site that was audited and would like a report about it removed, write to us at freepanda.in@gmail.com.

Email Preview Checker

The checklist, the client previews and the dark-mode preview all run in your browser, with no account. Your HTML is sent to us only when you sign in and ask for one of these:

• A test email. Your HTML is sent, unchanged, to the verified email address on your account and nowhere else. It is delivered through our email provider, which handles it only to deliver it. We do not keep a copy of the HTML.
• A rendered preview. After a test send, your HTML can be drawn as an image by a browser running on our server. That browser loads the images your email links to from wherever they are hosted, as an email client would, and runs none of its scripts. The image is returned to you and not stored; neither is the HTML.
• Real-client previews. At present these are a demonstration that uses sample images, and no third party receives your email. If we start using a rendering partner, it will be named here before your HTML is sent to it.

A screenshot you upload, or capture from your own screen, to compare against a preview stays in your browser and is not sent to us.

House Plan Designer

Floor plans are generated in your browser, with no account. If you ask for an AI concept image, we send our image provider only what it needs to draw it: for an interior, the room's type, name, width and length, and which walls have doors and windows; for an exterior, the line drawing of the house built from your plan, and the number of floors. We do not send your plot's address or anything else about you. The image is generated by models hosted through Hugging Face, which passes the request to the inference provider that runs the model, and is returned to you. We do not store the request or the image. To keep the feature affordable, requests are counted per IP address for an hour, in memory; the address is not written down.

A concept image is an illustration, not a design: it can show things your plan does not contain. Your plan remains the source of truth.

What Is My IP and Internet Speed Test

• What Is My IP reads the public IP address of the request and returns it to you. A browser cannot determine its own public address, so this one has to ask the server. The address is read from the request and sent straight back — it is not written to a database.
• Internet Speed Test transfers meaningless random bytes to and from the server in order to time them. The payload carries no information about you and is discarded.

Who can see it

• You, and the people you add to your organisation, each limited by their role. Someone at the gift desk of a shagun register can be allowed to record entries without seeing anything else in the account.
• Our staff, only when needed to support you, to fix a fault or to comply with the law.
• Anyone you share a link with. A shared asset link shows a limited view — never the serial number, what you paid or where it is kept — to whoever has the link, until it expires. An audit report can be opened by anyone with its link until it is deleted.
• Service providers that run the service for us, each only to do that job: our hosting and database providers; Resend, which delivers our email, including the test emails you ask for; and Hugging Face and the inference provider it routes to, for the House Plan Designer's concept images. Before we add another provider that receives your data, it will be named here.
• A payment provider, once paid plans start. No payment is taken today and no payment details are collected. When that changes, the provider will be named here first, and card or bank details will go to it rather than to us.
• Authorities, where the law requires it.

Advertising partners never receive what you save, what you enter into a tool, the address you audit or the email you test. Advertising is not shown on the account tools or in your account, and the advertising script is not loaded there.

How it is protected

Connections to FreePanda are encrypted in transit. Passwords are stored only as salted hashes. Sign-in tokens are short-lived, and the cookie that keeps you signed in cannot be read by scripts on the page. Uploaded photos and files are served only to signed-in members of your organisation, and one organisation cannot see another's data. Our crawler and preview renderer refuse to reach private or internal network addresses. No system is perfectly secure, so keep your own copy of anything you cannot afford to lose — the documents can be downloaded, and the asset register exported.

How long we keep it

Account records are kept for as long as your account is open. Deleting a document, asset, event or entry removes it from your lists and frees its slot on your plan, but the record is kept, out of sight, so a mistake can be undone until you ask us to erase it for good; a voided shagun entry stays on the register, marked as voided, by design. Audit reports are kept for the periods above. The record of what you have used is kept with your account, because it is how your allowance is counted.

To have your data permanently erased, or your account deleted, email us at freepanda.in@gmail.com from the address on the account and we will do it within 30 days, except for anything the law requires us to keep. Deleting an account deletes everything attached to it. Security records such as session details are kept only as long as security needs them.

What the site does record

• Aggregate page views per tool. When a tool page opens, the server increments a counter for that tool. The record is the tool's name, the event and the date. It contains nothing about you and nothing you entered.
• Google Analytics. We use Google Analytics 4 to see which pages are visited and how people move between them. It records the page you are on, roughly where in the world you are, your device and browser type, and which site sent you here. It sets its own cookies and gives your browser a random identifier so that several page views in one visit count as one visit rather than several.
  We send it one event of our own, tool_view, carrying the name of the tool opened and its category — never anything typed into that tool. The address of the page is sent with the identifiers that point at a record — an open shagun event, an asset behind a QR code, the token in a share link, an audit report — taken out first. Nothing you enter into a tool that runs in your browser reaches any measurement, because it never leaves your browser to begin with.
• Standard server logs. Our hosting providers record request metadata, including IP address and user agent, for security and reliability. These are kept only as long as the provider's retention window and are not used to profile visitors.

You can opt out of Google Analytics everywhere at once with Google's browser opt-out add-on, or by blocking it with an extension. Every tool works identically either way — nothing here depends on being measured.

Storage in your browser

We use localStorage to remember interface preferences — the light or dark theme, and some tools' last-used settings. The document generators also keep your unsaved draft there, which can include your customer's details, until you clear it or start a new document, and the audit tools remember the reports you ran before signing in. While you are signed in, a short-lived sign-in token is held in sessionStorage, and a strictly necessary cookie keeps you signed in for up to 30 days. The Shagun Register keeps any entry it could not send yet on your phone until it can. All of this stays on your device or goes only to your own account, is readable only by this site, and is not used for advertising. Clearing your browser storage removes it — including an unsent shagun entry, so check the register before you do.

Advertising and cookies

Advertising is what keeps the browser tools free. It is served by third parties, including Google, on the tools that run in your browser, on the tools that use our server, and on the pages that describe them. It is not shown on the account tools — the document generators, the Asset & Warranty Manager and the Shagun Register — or in your account.

• Third-party vendors, including Google, use cookies to serve ads based on your prior visits to this and other websites.
• Google's use of advertising cookies enables it and its partners to serve ads to you based on your visit to this site and other sites on the internet.
• You can opt out of personalised advertising by visiting Google Ads Settings. You can opt out of a third-party vendor's use of cookies for personalised advertising at aboutads.info or youronlinechoices.com.
• Where required by law, advertising partners obtain consent for the use of cookies and device identifiers before personalised ads are shown.

Advertising is entirely separate from the tools. An advertising partner never receives what you enter into a tool or save to an account.

Children

Accounts are for people aged 18 or over, and the site is not directed at children. We do not knowingly collect personal data from anyone under 18.

Your rights and choices

You can ask us to show you the personal data we hold about you, to correct it, to give you a copy, or to erase it, and you can withdraw your consent to how we use it. Write to freepanda.in@gmail.com from the address on your account and we will respond within 30 days. If you have not used an account, there is normally no personal data of yours for us to find, but if you believe we hold something, write to us and we will look into it.

If you have a complaint about how your data is handled, write to our Grievance Officer at freepanda.in@gmail.com, marking it “Grievance”. We will acknowledge it promptly and aim to resolve it within one month.

Changes

If this policy changes, the revised version will be posted here with a new “last updated” date. If a change affects what we do with the records in your account, we will tell you by email before it takes effect.

Contact

Questions about this policy can go to freepanda.in@gmail.com, or through the contact page.