Privacy Policy

1. Information We Collect

Boztik Creative Toolkit has been designed to minimise the collection of user data. The extension does not require account registration and does not ask users to provide personal information before using its core features.

The public website's page-view counter stores the pseudonymous event data described below. Whether that identifier is personal information depends on applicable law and context; this policy does not classify it as anonymous or non-personal. Boztik does not sell personal information.

For the extension's core features, we do not ask you to provide:

It does not describe the separate website page-view counter or third-party processing explained below.

• Your full name
• Email address
• Phone number
• Passwords
• Payment information
• Banking details
• Government identification numbers
• Health information
• Biometric information
• Personal communications
• Browsing history
• Search history
• Location information
• Advertising identifiers
• User profiles

Boztik does not sell user information or build marketing profiles. Public pages that include Google Analytics or AdSense code may send information to those services as described in Section 6.

Website page-view counter

On eligible public pages, a first-party script creates a random 32-character hexadecimal identifier if the boztik_anon_session cookie is not already present. The cookie is set for the Boztik website host, has the `SameSite=Lax` attribute and, on HTTPS, the `Secure` attribute. It expires 180 days after it is set; the script does not refresh that expiry while the cookie remains present. The identifier lets the page-view service associate eligible page views with the same browser over time for page-flow reporting.

For each eligible page view, the browser sends the page key and cookie identifier to Boztik's page-view API. When enabled, the Worker accepts allow-listed page keys and increments an aggregate count for that page and day. If the submitted identifier is a valid 32-character hexadecimal value, it also records an individual event containing that identifier, page key and server-generated timestamp. The Worker source schedules cleanup of individual events strictly older than 90 days, in batches of up to 5,000 events per scheduled run. Because this cleanup is bounded and can fail or fall behind, an event may remain longer than 90 days. The repository configures the Worker to run scheduled maintenance every 10 minutes, but it cannot establish whether that Worker version and trigger are currently deployed and active. Aggregate daily counts are separate and are not removed by this event cleanup; no aggregate cleanup period is configured in the reviewed source. Page-flow reports filter events to a requested recent period; that reporting filter does not delete older events.

The page-view API also reads the proxy-provided IP address for an in-memory rate-limit key; the reviewed application code does not write that address to the page-view event or aggregate tables. The page-view script does not put the browser's user-agent or referrer in its JSON payload, and the application does not write them to those analytics tables. The request may include ordinary network headers; hosting or network-platform logging outside the reviewed application source could not be verified. The counter is skipped when the browser reports Do Not Track as "1" or Global Privacy Control as true. It does not run on private delivery pages or the Command Centre. This check applies only to this counter; it does not control the separately loaded Google tags described in Section 6.

If you email Boztik, we receive the sender address and any information you choose to include so that we can read and respond to your message. The Contact page provides email links and does not submit a message through an on-page contact form.

2. Local Storage

The Boztik website and the Boztik Creative Toolkit extension store a very limited amount of data locally in your browser to make the experience convenient and persistent.

On this website, the assistant and UI use the browser's localStorage to keep temporary chat history and optional configuration. When you enter an API key to connect a third-party AI provider on this site, that key is stored only in your browser's localStorage.

If you install the browser extension, extension settings and preferences are stored locally by the extension using the browser's extension storage API (for example chrome.storage in Chromium-based browsers). In both cases, data is stored on your device and is not transmitted to Boztik-operated servers by default.

Examples of locally stored information:

• Site assistant chat history (stored in localStorage on this site)
• Optional AI provider connection keys that you add in your browser (stored locally only)
• User preferences and extension settings
• Achievement progress and usage counters shown in the UI
• Any custom configuration saved by you in the UI

This locally stored information remains on your device until you clear it (for example by clearing site data or uninstalling the extension). It is not automatically uploaded to Boztik-operated servers unless an explicit feature in the future requires it and you are asked to opt in.

You can remove this information at any time by clearing your browser's site data, clearing localStorage via developer tools, or uninstalling the extension (which removes extension storage according to the browser's behavior).

3. Image Processing

Most image analysis is performed locally inside your browser.

Boztik Creative Toolkit does not permanently upload, archive or store the images you inspect.

When you choose to use external services such as Google Reverse Image Search, TinEye or Bing Visual Search, the selected image or image URL is sent directly to that third-party service at your request.

Boztik Creative Toolkit does not receive or retain this information.

4. Chrome Extension Permissions

Boztik Creative Toolkit only requests browser permissions required to provide its advertised features.

This describes the browser extension's permissions and their use for its features. It does not describe the separate public website page-view counter, Google tags, or information you choose to send to Boztik; those are covered in Sections 1 and 6.

5. Artificial Intelligence Services

Some features on this website and in the assistant are able to connect to third-party AI providers if you choose to enable them.

The current site implementation supports direct connections from your browser to the following providers when you supply and enable a provider API key in the UI:

• OpenAI (ChatGPT-compatible APIs)
• Anthropic (Claude)
• Google (Gemini / Generative Language API)

How AI requests work on this site:

• Requests are sent only after an explicit user action — for example when you click Connect, Test or Submit in the Creative Assistant UI, or when you send a prompt to the assistant.
• When a request is made, your browser sends the prompt (and the built-in system prompt used to guide responses) directly to the selected provider's API endpoint. The request may include the API key you supplied in your browser.
• API keys and prompts are sent directly from your browser to the provider. Boztik's site does not forward your key to any Boztik-operated server, and Boztik does not receive your API key when you connect a provider in the browser UI.
• The site stores optional keys and a local copy of chat history only in your browser (localStorage) so the connection and chat persist between visits on the same device; these are not uploaded to Boztik-operated servers by the current site code.
• Responses returned by the provider are displayed in your browser. Unless you explicitly opt in to a future feature that may upload or log prompts/responses, Boztik does not permanently store prompts, requests, responses or uploaded images on Boztik-operated servers.

Each AI provider processes requests according to its own Privacy Policy and Terms of Service. When you use a provider you accept that provider's handling of your data (prompts, responses and any content you include in requests).

If you do not want to use external AI services, the assistant continues to provide built-in guidance that runs entirely in your browser and does not require a provider connection.

6. Third-Party Services

Some public website pages load the Google Analytics tag, and pages with AdSense code may load ads. These tags make requests to Google; Google may receive network information such as an IP address and may use cookies, advertising identifiers or similar technologies to process usage, device or advertising information, depending on its settings and policies. Other third-party services may receive information when you intentionally use the related feature.

Typical third-party services used by the site and extension include:

• Google Reverse Image Search, Bing Visual Search, or TinEye — when you choose to use a reverse image search feature; the image or image URL you provide is sent directly to that service.
• Google AdSense — some public pages load the AdSense script and include ad units. Google and its advertising partners may use cookies, advertising identifiers or similar technologies, and may process information such as device, usage and network data (which can include an IP address) for ad selection and measurement, depending on their settings and policies. The exact data and advertising choices depend on Google's processing and the applicable account, region and site settings; those settings cannot be determined from the site source alone. You can review Google advertising choices in Google's Ads Settings and learn about participating vendors at www.aboutads.info. These options are not a site-wide consent mechanism.
• Google Analytics (GA4) — some public website pages load and configure the Google tag with measurement ID G-H8W54EBM20. The tag is configured to send analytics page-view information to Google. Google documents that Analytics may use cookies or similar technologies and process additional usage and device information; the browser's requests can also expose network information such as an IP address. See Google Analytics privacy guidance. The exact data collected and retention settings are not established by the site source. The public website tag does not intentionally send private Boztik Deliver IDs, file names or client details. You can review Google's guidance and its browser opt-out add-on.
• Ko‑fi — used for voluntary support/donations via an external link.
• GitHub, LaunchZone and other listing services — used as promotional or support links.

No consent banner or consent-state code was found in the reviewed website source, and account-side Google Privacy & messaging settings could not be verified. This policy does not claim that consent is collected. Consent requirements depend on the visitor's location and the services and settings in use; see Google's User Consent Policy.

When you leave Boztik Creative Toolkit and visit an external website, your interaction is governed by that website's own Privacy Policy and Terms of Service. Boztik Creative Toolkit is not responsible for the privacy practices or content of external websites.

7. Data Sharing

Boztik does not sell personal information. Where Google Analytics tags or AdSense code are present and operate, relevant browser information may be sent to Google as described in Section 6; Google and its advertising partners process it under their own terms and policies. When you choose to use an AI provider or search service, the information you submit is sent to that provider as described above.

8. Data Retention

Because Boztik Creative Toolkit does not collect personal information on Boztik-operated servers for its browser features, no extension user data is retained by us.

The public website page-view counter stores individual page events and aggregate daily counts as described in Section 1. The Worker source schedules bounded cleanup of individual events older than 90 days; events may remain longer if cleanup fails or falls behind. Whether the configured Worker and scheduled trigger are currently deployed and active cannot be verified from the repository. Aggregate daily counts are not part of this cleanup and have no configured deletion period in the reviewed source. The 30-day page-flow report window does not delete older events. Google Analytics and Google AdSense have separate processing and retention governed by their settings and policies, which cannot be verified from this repository.

Boztik Deliver, the separate private system used to send finished work to clients, stores delivery information needed to function — including the delivery ID and the client, project, and file details provided for each delivery — on Boztik-controlled Cloudflare infrastructure (D1 and R2). Files are removed through the delivery expiry cleanup process; delivery records and related analytics may remain after file removal. Their retention period is not specified here.

Any settings stored using the Chrome Storage API remain on your own device until you uninstall the extension or clear your browser's extension storage.

9. Data Security

We use a privacy-first design that minimises unnecessary collection and transmission of information.

Whenever possible, image processing and extension functionality operate locally inside your browser.

We continually review our extension to improve privacy, security and compliance with Chrome Web Store policies.

10. Your Choices

Available controls depend on the data source and your browser. The options below apply only as described.

• The first-party page-view counter skips its request when the browser reports Do Not Track as "1" or Global Privacy Control as true. This setting affects that counter only; Google Analytics and AdSense tags are separate.
• You can remove or block the boztik_anon_session cookie in your browser settings. If it is absent, the page-view script attempts to create a new identifier and still sends the page-view request, so removing or blocking the cookie alone does not disable the counter.
• You can use Google's Analytics opt-out browser add-on and review advertising choices in Google Ads Settings. These Google controls are not a site-wide consent mechanism and do not control Boztik's first-party counter.
• You may uninstall the extension at any time.
• You may clear locally stored settings from your browser.
• You decide when to use AI-powered features.
• You decide when to open external services.

11. Children's Privacy

Boztik Creative Toolkit is not intended for children under the age of 13. The public website's page-view counter and third-party tags may process information as described in Sections 1 and 6; the reviewed site source does not identify age-verification or child-specific analytics controls.

12. Changes to this Privacy Policy

We may update this Privacy Policy from time to time to reflect improvements to the extension, legal requirements or changes to our services.

The latest version of this Privacy Policy will always be available on this page.

13. Contact Us

If you have any questions about this Privacy Policy, our privacy practices or Boztik Creative Toolkit, please contact us:

Email:
boztiktech@gmail.com

We aim to respond to privacy-related enquiries as promptly as possible.