Privacy Policy

This Privacy Policy applies to the website at https://defaultfile.com, the Default File platform, and related services we operate (the "Service"). It should be read together with our Terms of Service, Cookies and Local Storage Notice, and Grievance Redressal Policy.

This Policy does not apply to third party websites, services, or applications that we do not control, even if they are linked from the Service.

Where a conflict exists between this Policy and a mandatory local law that cannot be waived, that local law prevails to the extent of the conflict for users protected by it.

The operator of the Service is Default File. For privacy inquiries, contact privacy@defaultfile.com. For general legal inquiries, contact legal@defaultfile.com. For grievances, contact grievance@defaultfile.com (see our Grievance Redressal Policy).

For purposes of India's Digital Personal Data Protection Act, 2023 ("DPDP Act") and related rules, where we determine the purpose and means of processing digital personal data, we act as a Data Fiduciary, and you are a Data Principal with respect to your personal data.

For purposes of the EU/UK General Data Protection Regulation ("GDPR") where it applies, we act as a controller for personal data we determine how and why to process. For purposes of California privacy law where it applies, we act as a "business" with respect to personal information we collect.

At present, the Service is offered without user registration. Many Studio tools run primarily in your browser. We do not operate durable server side storage of user design assets as a core product feature. We do store an aggregate unique-visitor total so the site footer can show how many browsers have visited.

Some features send data off your device when you use them. Design Extractor may transmit an image you choose, optional instructions, and related extraction inputs to model inference providers so the feature can return results. Hosting, content delivery, font providers, and usage analytics providers may also process technical information as described in this Policy.

We do not currently operate advertising trackers or sell personal information. If that changes, we will update this Policy and, where required, obtain consent or provide opt-out mechanisms before advertising or sale begins.

Depending on how you use the Service and how it evolves, we may process the following categories of information:

Local preference and tool data. The Service may store preferences and tool state in your browser, including local storage and IndexedDB (for example, simplified language toggles, Color Lab saves, Stage Shot layout preferences, and local media used in Stage Shot). This data typically remains on your device unless you clear site data.

URL and share state data. Certain tools encode configuration parameters in the page URL so that designs can be shared by link. Anyone with the link may be able to view the encoded configuration. Do not place secrets or personal data in shareable URLs.

Model inference inputs (when you run extraction). When you use Design Extractor, the image you submit, optional text instructions, a palette measured in the browser, and related request metadata may be transmitted through our Service to third party model inference providers (currently including Google Gemini and models available through Cursor, depending on the model you select). We use that processing to return extraction results to you. Those results may contain mistakes. We do not operate a product feature that permanently stores those uploads as a user library.

Usage analytics. We use Firebase Analytics (Google Analytics for Firebase) to measure how the Service is used, such as page views, approximate device and browser signals, and related first party usage metrics. This helps us understand traffic and improve the Service. It is not used for advertising on our behalf.

Visitor count. We set a random first party cookie on your browser and store an aggregate unique-visitor total in our database so the site footer can show how many browsers have visited. We do not store that cookie value in the database. The cookie is not used for advertising or cross site tracking.

Technical and log data. Our hosting or network providers may automatically receive standard request metadata such as IP address, user agent, timestamps, requested URLs, referrer information, and approximate location derived from IP address, for security, reliability, diagnostics, and abuse prevention.

Communications. If you email us, we process the content of your message and associated contact details to respond to your inquiry and maintain records of the correspondence.

Account and billing data (future). If we introduce accounts or Paid Plans, we may collect account credentials or identifiers, profile details you provide, subscription status, invoices, and payment related information. Payment card data, if any, would typically be processed by a third party payment processor and not stored in full by us.

We do not intentionally collect sensitive personal data (such as financial account passwords, biometric templates for authentication, health data, or government identity numbers) as part of ordinary use of the current Service. Please do not submit such data to us unless we expressly request it for a stated purpose. Do not upload images or instructions that contain secrets or sensitive personal data you are not authorized to process.

We process information to: (a) provide, operate, maintain, and improve the Service, including extraction that uses artificial intelligence when you request it; (b) measure usage and diagnose performance through analytics; (c) show an aggregate unique-visitor total; (d) secure the Service and prevent fraud, abuse, and security incidents; (e) communicate with you regarding support, grievances, or legal notices; (f) comply with legal obligations; (g) establish, exercise, or defend legal claims; and (h) if Paid Plans are introduced, process subscriptions, invoices, taxes, and related customer administration.

We process personal data only for purposes that are clear, specific, and reasonably connected to the Service you use, unless a new purpose is authorized by law or by your consent where required.

Where data protection laws require a legal basis, we rely on one or more of the following as applicable: performance of a contract or steps prior to entering a contract (including providing a tool feature you request); legitimate interests that are not overridden by your rights (such as securing and improving the Service, preventing abuse, and understanding aggregate usage); consent (where we request it, including for non-essential cookies where required); and compliance with legal obligations.

Under the DPDP Act, where consent is the basis for processing, consent must be free, specific, informed, unconditional, and capable of being withdrawn. Withdrawal of consent will not affect the lawfulness of processing carried out before withdrawal, and we may continue processing where another lawful ground applies (for example, legal compliance or security).

Where we rely on consent, we will provide a clear notice describing the personal data and purposes involved, and a means to withdraw consent that is no more difficult than giving consent, to the extent required by applicable law.

Details regarding cookies, local storage, IndexedDB, analytics identifiers, and similar technologies are set out in our Cookies and Local Storage Notice at https://defaultfile.com/legal/cookies.

The Service uses functional browser storage for tool preferences and local media, may load fonts from third party providers, and uses Firebase Analytics for usage measurement. We do not currently deploy advertising cookies. Where applicable law requires consent or an opt-out for non-essential technologies, we will implement those controls as required.

We may share information with: (a) service providers who assist in hosting, content delivery, model inference, analytics, email, security, customer support, or payment processing, under contractual confidentiality and use restrictions appropriate to the service; (b) professional advisors such as lawyers, auditors, or accountants where necessary; (c) authorities, courts, or regulators when required by law or to protect rights, safety, and security; and (d) a successor entity in connection with a merger, acquisition, financing, reorganization, or sale of assets.

Model inference providers and analytics providers process data under their own terms and privacy practices when you use the related features. Retention and secondary use by those providers are governed by their policies and our configuration of their services.

We may disclose aggregated information that does not reasonably identify you.

We do not sell personal information and do not presently "share" personal information for cross-context behavioral advertising as those terms are used under California law. If that changes, we will update this Policy and provide required opt-out mechanisms.

The Service is intended to be available to users in India and in other countries. The Service may be hosted or supported using infrastructure located in multiple jurisdictions. If you access the Service from outside the country where our processors operate, your information may be transferred across borders.

Where required by applicable law, we will take steps designed to ensure an adequate level of protection for personal data, which may include contractual safeguards with processors, reliance on permitted transfer mechanisms, or limiting transfers as directed by competent authorities.

By using the Service, you understand that processing may occur in countries that may have data protection standards different from those in your country of residence.

Local preference and tool data remain on your device until you clear them or the feature removes them. Communication and grievance records are retained for as long as needed to resolve your inquiry and for legitimate business, security, or legal recordkeeping. Server logs are retained for periods determined by our hosting providers and our security needs.

We do not operate durable product storage of Design Extractor uploads. Model inference providers may retain or process inputs according to their terms and our use of their APIs. Analytics retention follows the analytics provider's settings and practices. The aggregate unique-visitor total is retained while the public visitor count is offered. The visitor-count cookie lasts up to 400 days or until you clear site data.

If accounts or Paid Plans are introduced, account and billing records will be retained for the life of the account and thereafter as required for tax, accounting, dispute resolution, and legal compliance.

When personal data is no longer needed for the purposes stated in this Policy, we will delete it or convert it so that it does not identify you, except where retention is required or permitted by law.

We implement reasonable technical and organizational measures designed to protect information processed in connection with the Service, consistent with industry practice and applicable requirements regarding reasonable security practices (including expectations under Indian information technology and data protection frameworks where they apply).

Measures may include access controls, encrypted transport (HTTPS), least privilege operational practices, and vendor due diligence appropriate to our processing activities.

No method of transmission or storage is completely secure, and we cannot guarantee absolute security. You are responsible for securing devices and networks you use to access the Service.

The Service is not directed to children under the age of 18 for purposes of India's DPDP Act, or under the age of 13 (or the higher age of digital consent in your jurisdiction) for other applicable laws. We do not knowingly process personal data of children for behavioral monitoring, tracking, or targeted advertising.

If you believe a child has provided personal information to us, contact us and we will take appropriate steps to delete it and cease related processing where required.

Subject to the DPDP Act and applicable rules, Data Principals in India may have rights including: (a) the right to access a summary of personal data being processed and processing activities; (b) the right to correction, completion, updating, and erasure of personal data; (c) the right to withdraw consent where processing is based on consent; (d) the right to grievance redressal; and (e) the right to nominate another individual to exercise rights in the event of death or incapacity, where provided by law.

To exercise these rights, contact privacy@defaultfile.com or our Grievance Officer at grievance@defaultfile.com. We may need to verify your identity before fulfilling a request. We will respond within timelines required by applicable law.

If you are not satisfied with our response, you may escalate as described in our Grievance Redressal Policy at https://defaultfile.com/legal/grievance, and you may have the right to approach the Data Protection Board of India or other competent authority once available and as permitted by law.

If the GDPR, UK GDPR, or a similar law applies to you, you may have rights to request access, rectification, erasure, restriction of processing, data portability, and to object to certain processing, as well as the right not to be subject to solely automated decision-making producing legal or similarly significant effects, where those rights apply.

You may also have the right to lodge a complaint with a supervisory authority in your country of residence or workplace. To exercise rights with us, contact privacy@defaultfile.com.

If you are a California resident and California privacy law applies, you may have rights to know the categories and specific pieces of personal information we collect, to delete personal information, to correct inaccurate personal information, and to opt out of sale or sharing of personal information, subject to statutory exceptions.

In the preceding twelve months, depending on your interactions, categories of personal information that may have been collected include identifiers and internet or network activity information (such as IP address, request logs via hosting providers, usage analytics events, and a first party visitor-count cookie), model inference inputs you submit when using Design Extractor, and any information you voluntarily send by email. We collect this information for the business purposes described in this Policy.

We do not sell personal information and do not presently share it for cross-context behavioral advertising. We do not use or disclose sensitive personal information for purposes that require a right to limit under California law for the current Service.

Consistent with California Online Privacy Protection Act (CalOPPA) expectations: you may visit the Service without creating an account; a Privacy Policy link is available from the site footer; material changes will be posted on this page; and you may contact us to update information you have provided by email.

To submit a request, contact privacy@defaultfile.com. We will not discriminate against you for exercising privacy rights.

Some browsers offer a "Do Not Track" (DNT) setting. Because there is no uniform industry standard for responding to DNT signals, we do not alter Service behavior solely based on DNT signals at this time.

We do not presently operate advertising or cross site behavioral advertising cookies on the Service. Usage analytics is described in this Policy and in our Cookies and Local Storage Notice. If we introduce advertising technologies or change how we respond to DNT or comparable preference signals, we will update those notices and implement consent or opt-out controls as required by law.

The current Service does not make decisions that produce legal or similarly significant effects about you solely by automated means. Design tools and extraction that uses artificial intelligence produce creative, educational, or design reference outputs based on parameters and inputs you control. Those outputs may contain mistakes and do not constitute profiling for employment, credit, or similar decisions.

The Service is currently free. If we introduce Paid Plans as described in our Terms of Service, we may process additional information necessary for billing, subscription management, fraud prevention, tax compliance, and customer support. We will update this Privacy Policy before or when such processing begins, as required.

Privacy and data protection grievances may be submitted to grievance@defaultfile.com, addressed to Vignesh V. Further details, timelines, and escalation steps are set out in our Grievance Redressal Policy at https://defaultfile.com/legal/grievance.

We may update this Privacy Policy from time to time. The "Last updated" date indicates the most recent revision. Material changes will be posted on this page and, where appropriate, accompanied by additional notice on the Service.

Where required by law, we will seek fresh consent or provide an opportunity to object before processing under a materially new purpose.

Unless mandatory local law provides otherwise, this Privacy Policy is interpreted in accordance with the laws of India, consistent with our Terms of Service. Mandatory consumer and data protection rights in your jurisdiction remain unaffected to the extent they cannot be waived.

Privacy contact: privacy@defaultfile.com.

Grievance contact: grievance@defaultfile.com.

Operator: Default File, a personal project by Vignesh V. Domain: defaultfile.com.