Privacy Policy

1. Information We Collect

Boztik Creative Toolkit has been designed to minimise the collection of user data. The extension does not require account registration and does not ask users to provide personal information before using its core features.

The public website's page-view and traffic-source counters store the pseudonymous event data described below. Whether that identifier is personal information depends on applicable law and context; this policy does not classify it as anonymous or non-personal. Boztik does not sell personal information.

For the extension's core features, we do not ask you to provide:

• Your full name
• Email address
• Phone number
• Passwords
• Payment information
• Banking details
• Government identification numbers
• Health information
• Biometric information
• Personal communications
• Browsing history
• Search history
• Location information
• Advertising identifiers
• User profiles

This list covers the extension's core features. It does not describe the separate website page-view counter or third-party processing explained below.

Boztik does not sell user information or build marketing profiles. Public pages that include Google Analytics or AdSense code may send information to those services as described in Section 6.

Website page-view counter

On eligible public pages, a first-party script creates a random 32-character hexadecimal identifier if the boztik_anon_session cookie is not already present. The cookie is set for the Boztik website host, has the `SameSite=Lax` attribute and, on HTTPS, the `Secure` attribute. It expires 180 days after it is set; the script does not refresh that expiry while the cookie remains present. The identifier lets the page-view service associate eligible page views with the same browser over time for page-flow reporting.

For each eligible page view, the browser sends the page key and cookie identifier to Boztik's page-view API. When enabled, the Worker accepts allow-listed page keys and increments an aggregate count for that page and day. If the submitted identifier is a valid 32-character hexadecimal value, it also records an individual event containing that identifier, page key and server-generated timestamp. The Worker schedules cleanup of individual events strictly older than 90 days, in batches of up to 5,000 events per scheduled run. Because this cleanup is bounded and can fail or fall behind, an event may remain longer than 90 days. Scheduled maintenance runs every 10 minutes. Aggregate daily counts are separate and are not removed by this event cleanup; no aggregate cleanup period is configured. Page-flow reports filter events to a requested recent period; that reporting filter does not delete older events.

The page-view API reads the proxy-provided IP address only for an in-memory rate-limit key and does not write that address to the page-view event or aggregate tables. The page-view script does not include the browser's user-agent or referrer in its JSON payload, and the application does not write them to those analytics tables. The counter is skipped when the browser reports Do Not Track as "1" or Global Privacy Control as true. It does not run on private delivery pages or the Command Centre. This check applies only to this counter; it does not control the separately loaded Google tags described in Section 6.

Website traffic-source counter

On the same eligible public pages, and only when the page-view script's Do Not Track / Global Privacy Control check permits tracking, the browser submits a separate traffic-source visit. It uses a random 32-character identifier in that tab's sessionStorage, separate from the page-flow cookie. The identifier is reused while the tab remains active and rotates after 30 minutes without activity. The Worker stores at most one traffic-source record for each identifier and keeps the first attribution it receives for that session.

The traffic-source request contains the referrer hostname, a boolean indicating whether recognized search-result query parameters were present, and any valid UTM source, medium, and campaign values from the current page. It does not send or store a full referrer URL, page path, arbitrary URL query string, user-agent, or IP address in the traffic-source record. The Worker derives Reddit, organic search, social, referral, or direct/unknown from the submitted hostname and search signal; UTM values are supplementary and do not override that category. These client-supplied values are not independently verified and can be missing or spoofed. Browser and app referrer policies can hide source information, so the categories are estimates, not proof of identity or origin. The JSON does not include a full referrer URL, page path, arbitrary URL query string, user-agent, or IP address. The traffic-source table stores the server timestamp, random session identifier, derived category, and valid UTM values. The Worker uses the proxy-provided IP address only as an in-memory public rate-limit key.

Traffic-source records are scheduled for deletion when older than 90 days, using bounded batches of up to 5,000 records per scheduled run. Cleanup may fail or fall behind, so a record can remain longer than 90 days. Scheduled maintenance runs every 10 minutes.

If you email Boztik, we receive the sender address and any information you choose to include so that we can read and respond to your message. The Contact page provides email links and does not submit a message through an on-page contact form.

2. Local Storage

The Boztik website and the Boztik Creative Toolkit extension store a very limited amount of data locally in your browser to make the experience convenient and persistent.

On this website, the only thing the Creative Assistant saves in your browser's localStorage is an API key, and only if you choose to add one to connect a third-party AI provider (one entry per provider). The website does not save the chat itself; the conversation clears when you reload the page.

If you install the browser extension, extension settings and preferences are stored locally by the extension using the browser's extension storage API (for example chrome.storage in Chromium-based browsers). In both cases, data is stored on your device and is not transmitted to Boztik-operated servers by default.

Examples of locally stored information:

• Optional AI provider connection keys that you add in your browser (stored locally only)
• User preferences and extension settings
• Achievement progress and usage counters shown in the UI
• Any custom configuration saved by you in the UI

This locally stored information remains on your device until you clear it (for example by clearing site data or uninstalling the extension). It is not automatically uploaded to Boztik-operated servers unless an explicit feature in the future requires it and you are asked to opt in.

You can remove this information at any time by clearing your browser's site data, clearing localStorage via developer tools, or uninstalling the extension (which removes extension storage according to the browser's behavior).

3. Image Processing

Most image analysis is performed locally inside your browser.

Boztik Creative Toolkit does not permanently upload, archive or store the images you inspect.

When you choose to use external services such as Google Reverse Image Search, TinEye or Bing Visual Search, the selected image or image URL is sent directly to that third-party service at your request.

Boztik Creative Toolkit does not receive or retain this information.

4. Chrome Extension Permissions

Boztik Creative Toolkit only requests browser permissions required to provide its advertised features.

5. Artificial Intelligence Services

Some features on this website and in the assistant are able to connect to third-party AI providers if you choose to enable them.

The current site implementation supports direct connections from your browser to the following providers when you supply and enable a provider API key in the UI:

• OpenAI (ChatGPT-compatible APIs)
• Anthropic (Claude)
• Google (Gemini / Generative Language API)

How AI requests work on this site:

• Requests are sent only after an explicit user action — for example when you click Connect, Test or Submit in the Creative Assistant UI, or when you send a prompt to the assistant.
• When a request is made, your browser sends the prompt (and the built-in system prompt used to guide responses) directly to the selected provider's API endpoint. The request may include the API key you supplied in your browser.
• API keys and prompts are sent directly from your browser to the provider. Boztik's site does not forward your key to any Boztik-operated server, and Boztik does not receive your API key when you connect a provider in the browser UI.
• The site stores an optional key only in your browser (localStorage) so the connection persists between visits on the same device; it is not uploaded to Boztik-operated servers by the current site code. The site does not save the chat itself, and the conversation clears when you reload the page.
• Responses returned by the provider are displayed in your browser. Unless you explicitly opt in to a future feature that may upload or log prompts/responses, Boztik does not permanently store prompts, requests, responses or uploaded images on Boztik-operated servers.

Each AI provider processes requests according to its own Privacy Policy and Terms of Service. When you use a provider you accept that provider's handling of your data (prompts, responses and any content you include in requests).

If you do not want to use external AI services, the assistant continues to provide built-in guidance that runs entirely in your browser and does not require a provider connection.

6. Third-Party Services

Some public website pages load the Google Analytics tag, and pages with AdSense code may load ads. These tags make requests to Google; Google may receive network information such as an IP address and may use cookies, advertising identifiers or similar technologies to process usage, device or advertising information, depending on its settings and policies. Other third-party services may receive information when you intentionally use the related feature.

Typical third-party services used by the site and extension include:

• Google Reverse Image Search, Bing Visual Search, or TinEye — when you choose to use a reverse image search feature; the image or image URL you provide is sent directly to that service.
• Google AdSense — some public pages load the AdSense script and include ad units. Google and its advertising partners may use cookies, advertising identifiers or similar technologies, and may process information such as device, usage and network data (which can include an IP address) for ad selection and measurement, depending on their settings and policies. The exact data and advertising choices depend on Google's processing and the applicable account, region and site settings. You can review Google advertising choices in Google's Ads Settings and learn about participating vendors at www.aboutads.info. These options are not a site-wide consent mechanism.
• Google Analytics (GA4) — some public website pages load and configure the Google tag with measurement ID G-H8W54EBM20. The tag is configured to send analytics page-view information to Google. Google documents that Analytics may use cookies or similar technologies and process additional usage and device information; the browser's requests can also expose network information such as an IP address. See Google Analytics privacy guidance. The public website tag does not intentionally send private Boztik Deliver IDs, file names or client details. You can review Google's guidance and its browser opt-out add-on.
• Ko‑fi — used for voluntary support/donations via an external link.
• GitHub and other listing services — used as promotional or support links.

This policy does not claim that consent is collected. Consent requirements depend on the visitor's location and the services and settings in use; see Google's User Consent Policy.

When you leave Boztik Creative Toolkit and visit an external website, your interaction is governed by that website's own Privacy Policy and Terms of Service. Boztik Creative Toolkit is not responsible for the privacy practices or content of external websites.

7. Data Sharing

Boztik does not sell personal information. Where Google Analytics tags or AdSense code are present and operate, relevant browser information may be sent to Google as described in Section 6; Google and its advertising partners process it under their own terms and policies. When you choose to use an AI provider or search service, the information you submit is sent to that provider as described above.

8. Data Retention

Because Boztik Creative Toolkit does not collect personal information on Boztik-operated servers for its browser features, no extension user data is retained by us.

The public website page-view counter stores individual page events and aggregate daily counts as described in Section 1. The Worker schedules bounded cleanup of individual events older than 90 days; events may remain longer if cleanup fails or falls behind. Aggregate daily counts are not part of this cleanup and have no configured deletion period. The 30-day page-flow report window does not delete older events. Google Analytics and Google AdSense have separate processing and retention governed by their settings and policies.

Boztik Deliver, the separate private system used to send finished work to clients, stores delivery information needed to function — including the delivery ID and the client, project, and file details provided for each delivery — on Boztik-controlled Cloudflare infrastructure (D1 and R2). Files are removed through the delivery expiry cleanup process; delivery records and related analytics may remain after file removal. Their retention period is not specified here.

Any settings stored using the Chrome Storage API remain on your own device until you uninstall the extension or clear your browser's extension storage.

9. Data Security

We use a privacy-first design that minimises unnecessary collection and transmission of information.

Whenever possible, image processing and extension functionality operate locally inside your browser.

We continually review our extension to improve privacy, security and compliance with Chrome Web Store policies.

10. Your Choices

Available controls depend on the data source and your browser. The options below apply only as described.

• Boztik's first-party page-view and traffic-source counters skip their requests when the browser reports Do Not Track as "1" or Global Privacy Control as true. Google Analytics and AdSense tags are separate.
• You can remove or block the boztik_anon_session cookie in your browser settings. If it is absent, the page-view script attempts to create a new identifier and still sends the page-view request, so removing or blocking the cookie alone does not disable the counter.
• The traffic-source counter uses a separate random identifier held in this tab's sessionStorage, rotating after 30 minutes of inactivity. It records one visit per identifier and retains the first attribution for that session. Records are scheduled for deletion after 90 days but may remain longer if cleanup fails or falls behind. Clearing session storage or blocking it prevents that tab's traffic-source visit from being recorded.
• Traffic-source attribution may include a referrer-based category (Reddit, organic search, other social, referral, or direct/unknown) and valid UTM source, medium, and campaign values from the current page. The browser sends only the referrer hostname and whether recognized search-result parameters were present; Boztik does not store a full referrer URL, page path, IP address, or user-agent for this feature. Browsers and apps can hide referrers, and submitted attribution is not independently verified, so results can be incomplete or spoofed.
• You can use Google's Analytics opt-out browser add-on and review advertising choices in Google Ads Settings. These Google controls are not a site-wide consent mechanism and do not control Boztik's first-party counters.
• You may uninstall the extension at any time.
• You may clear locally stored settings from your browser.
• You decide when to use AI-powered features.
• You decide when to open external services.

11. Children's Privacy

Boztik Creative Toolkit is not intended for children under the age of 13. The public website's page-view counter and third-party tags may process information as described in Sections 1 and 6.

12. Changes to this Privacy Policy

We may update this Privacy Policy from time to time to reflect improvements to the extension, legal requirements or changes to our services.

The latest version of this Privacy Policy will always be available on this page.

13. Contact Us

If you have any questions about this Privacy Policy, our privacy practices or Boztik Creative Toolkit, please contact us:

Email:
boztiktech@gmail.com

We aim to respond to privacy-related enquiries as promptly as possible.