Privacy policy

This policy explains what personal data VoltKit collects, why, who receives it, where it is stored, how long it is kept, and how you can use your rights under India's Digital Personal Data Protection Act, 2023 (the DPDP Act). It covers this website, your VoltKit account, payments, SVGA Maker and VoltKit RTC.

1. Who we are

This policy is published by VoltKit (“we”, “us”). For the personal data described here we are the Data Fiduciary under the DPDP Act: we decide why and how it is used. The exception is data about people using apps that our customers build on VoltKit RTC, which we handle on those customers' behalf (see People using apps built on VoltKit RTC).

You can reach us at contact@voltkit.in; our contact details, our Grievance Officer and how to raise a grievance are in section 11.

2. What we collect and why

What we collect depends on what you use. Most of the site needs no account at all.

Free tools and games

• Browser tools. Tools marked “Processed on your device” do their work inside your browser. The files you select and the text you paste are not uploaded to us, and they are gone when you close the page.
• Two tools contact other services from your browser. DNS Lookup sends the domain you type to Cloudflare's and Google's public DNS services. What Is My IP asks ipwho.is and ipify.org for more details, but only if you click the button for them. These services see your IP address, and DNS Lookup's also see the domain.
• Server-assisted checks. Some internet, security and website checkers, such as the WHOIS, SSL, port and website status checks, need our server. What you enter (a domain, web address, IP address or port) is sent to our server, which runs the check and sends back the result. We do not save it, but it is part of the address of the request, so it appears in our web server logs (see Logs and security). To answer, our server may contact the site you are checking, domain registries (RDAP), Cloudflare's DNS service or Team Cymru; they see the name or address being checked, coming from our server, not from you. The speed test sends test data between your browser and our server. Each of these tools says on its page that it uses our server.
• Games and preferences. Best scores, two game settings, your recently used and favourite tools and your recent searches are kept in your browser (see section 5) and are never sent to us.
• Search. The search page puts your search term in its address, so the term reaches our web server logs and Google Analytics.

Your account

You need an account for SVGA Maker, VoltKit RTC and buying credits. New accounts are opened with Google sign-in for now. Accounts that already have a password keep signing in with it.

• Registering with email: your name, a username, your email address and a password. We store the password only as an argon2id hash, a one-way scrambled form that cannot be turned back into the password.
• Google sign-in: Google gives us your Google account ID, your verified email address and your name. We use them to open your account, or to create one with a username made from your email address. Google's Firebase Authentication runs the sign-in window and keeps a record of your Google sign-in, with your email address and name, in our Firebase project.
• Contact details, asked once after you sign up: your mobile number (required), your company or organisation and your country (both optional). We use them to contact you about your account and your support requests, and when we verify an account. We do not check the number by SMS or call. Our staff can see them when they help you, and you can change them under Profile in your dashboard. We do not sell them or use them for marketing.
• Profile (optional): a bio, time zone and two email preference switches, which you can fill in under Profile in your dashboard. Our staff can see them when they help you. The product-email preference controls product news and offers. Unsubscribing does not stop essential account and service messages, such as password resets and service announcements.
• Product emails and external contacts: we may email account holders about VoltKit products and offers. We also keep the email address, optional name, tags, source and consent record of people without an account who agreed to hear from us, including contacts imported by our staff. Each product email has an unsubscribe link. We record delivery attempts and failures, and retain an address on a suppression list after an unsubscribe, bounce or complaint to prevent further unwanted emails. We do not track email opens or link clicks.
• Sign-in security: when you last signed in, failed sign-in attempts (five in a row lock the account for 15 minutes) and a counter that ends all your sessions when your password changes. We do not keep a history of the IP addresses or devices you sign in from, apart from our web server logs (see Logs and security), which record the IP address and browser of every request, sign-ins included, for about 14 days.
• Password resets: we store a hashed form of the reset link's code and when it expires. A link works for 1 hour (24 hours if our staff make it for you), and its record is deleted automatically when it expires. If reset emails are switched on, the email, which contains your username and the link, is sent through our email delivery provider.

We use this to provide your account, keep it secure, let you sign in and get back in, and help you when you contact us.

Credits and payments

• When you buy credits, we create an order with Razorpay that contains the amount, the currency and a random reference. Razorpay's checkout window opens with your name and account email filled in. You enter your payment details, and your phone number if Razorpay asks for it, in Razorpay's window, not ours. Razorpay handles them under its own privacy policy.
• For each payment we keep Razorpay's order and payment IDs, the amount, currency, credits, status, dates and the signature Razorpay uses to confirm the payment.
• Razorpay can also tell our server directly that a payment has completed; this is how credits still arrive if your browser window closes. From that message we keep only the order and payment IDs, the amount, currency, status, the type of payment method (for example card or UPI) and its time; the email address, phone number, UPI ID and card details it also carries are not stored.
• We never receive your full card number, CVV, UPI PIN or net-banking password.
• Your wallet history records every purchase, spend, refund and adjustment of your credits. If our staff adjust your balance, the reason they give is recorded and shown in your credit history.

We use this to take payments, add credits exactly once, handle refunds and disputes, and keep the accounting records the law requires. See the refund policy and the delivery policy.

SVGA Maker

• When you convert a clip, the video (20 MB by default; the tool shows the current limit) and its file name are uploaded to our server and passed to our conversion service, which runs on the same server. No other company receives them.
• The uploaded video and the conversion's working files are deleted automatically about 48 hours after they were last used. The conversion service writes the file name and size to its log.
• The finished .svga file is kept in your account with a record of the conversion: the original file name without its extension, size, settings, status and daily/monthly conversion usage. Historical records may also show credits used before SVGA Maker became free. This lets you download the file again from your history. You cannot delete them yourself yet; email us and we will.
• Please do not upload footage you have no right to use, or private or sensitive footage of other people.

VoltKit RTC customers

If you build on VoltKit RTC, we keep:

• your projects: the names you choose, the App ID we create, status, limits and minute balances, and the minute balance of your account;
• your API keys: only a hash of each secret and its first few characters (so you can tell keys apart), with its label and when it was created and last used. A secret is shown to you once and never stored;
• your webhook settings: the address and events you choose, and the signing secret, which we keep in order to sign each delivery;
• usage figures for each project, such as participant minutes, rooms and peak participants. They describe your project, not individual people;
• your minute purchases, for your account balance or for a project (and any hour purchases from before minutes), and your verification request (see below).

We use this to run your projects, check your servers' API keys, bill and limit usage, deliver your webhooks and show you your usage.

People using apps built on VoltKit RTC

If you use an app that runs on VoltKit RTC, the business behind the app (our customer) decides what the app sends through VoltKit RTC and why. We process that data on the customer's behalf, as a Data Processor under the DPDP Act. For questions or requests about it, contact the app's owner; we will help them answer.

• Identity: the name or ID the app gives you, your role, and any details the app attaches to you or to a room.
• Audio and video are encrypted between each device and our servers, and relayed live through our media and relay (TURN) servers to the other people in the call. They are not end-to-end encrypted. They are not recorded or stored, unless the app's owner turns on our optional, paid recording service for their project; recordings are then stored for the period the owner chose, and deleted after it.
• Live room information, such as who is in a room, who is muted and raised hands, exists only while it is needed. Your entry is removed when you disconnect, and a room is closed 30 seconds after the last person leaves (10 minutes after it was created if nobody joins).
• Chat: so that people joining a conversation can read recent messages, we keep up to about the last 500 messages of each conversation, and delete its whole history 24 hours after its last message. Messages sent as ephemeral are not stored, and deleted messages are removed. The app's owner can read the history, including direct messages, and can have each message sent to its own server; a delivery that fails is kept longer (see section 6).
• Events: the app's owner can have events, such as people joining and leaving a room, sent to its own server. They include the identity the app gave you.
• Connection logs: our servers log connections with their IP address, identity and room. The web server log of each connection includes its access token, which contains the identity, role and room.
• Broadcast viewers: to admit viewers and count viewing minutes, our servers handle each viewer's IP address and browser details. This record is deleted when the viewer leaves, or after 24 hours at most.

The live demo

The demo at /rtc/demo needs no account. We are the Data Fiduciary for what it handles:

• Room record: the room name, the room code, the display names of the host and viewers, the number of likes, the start and end times, and a keyed hash of the host's IP address (a code that cannot be turned back into the address), used to allow one demo room per connection and to stop abuse.
• Chat, reactions and gifts travel through VoltKit RTC like any chat, and are kept as described above. The host can delete messages.
• Video and audio are relayed live and never recorded. Music and animations you add stay on your device and are sent only as part of your stream.
• Acceptance record: when you tick the box accepting the demo rules, we record the version, the time, the room, your display name, your browser and the keyed hash of your IP address.
• The demo page does not load Google Analytics or Firebase Analytics.

Support, verification and email

• Support tickets you open in your dashboard or with the ticket form: the topic, subject, the details you fill in (such as a payment ID, project or the place where reported content is), your messages and files you attach, our replies, and the status. Without an account, also the name and email address you give us so we can reply. Our staff read and answer them, and we email you a copy of the ticket and of our replies.
• Verification requests: your organisation, website and how you plan to use VoltKit RTC. A person on our staff reviews each request. The decision is shown in your dashboard, with the reason if a request is not approved, and is recorded with any note. We use verification to decide who may create RTC projects and buy RTC minutes.
• Notifications: we record one for you when we decide or reset your verification and when we change your RTC project's plan or status. They are kept with your account but are not shown in your dashboard yet; ask us for a copy.
• Browser notifications: if you turn them on, your browser gives us a notification token from Google's Firebase Cloud Messaging. We keep it with a label for the browser, the kinds of notification you chose and when it was last used, and send notifications through Google. For messages we send to many accounts, we count how many were delivered and opened. Turning notifications off or signing out stops them on that browser.
• Terms acceptance records: each time you tick a box to accept our terms (when registering, when we ask you to accept an update, before paying and before creating an RTC project), we record which documents and version you accepted, when, and the IP address and browser it came from.
• Email you send to contact@voltkit.in, which we keep to answer you and as a record of what was agreed.

Logs and security

• Web server logs: our web servers log requests with the IP address, the time, the full address requested (including anything after a “?”, such as a search term or a domain you checked), the response, the referring page and the browser's user-agent string.
• Application logs record requests (without IP addresses), errors and service events. VoltKit RTC's connection logs are described above.
• Rate limits: to stop abuse, we count requests per IP address, or per account when you are signed in, over windows of 1 to 15 minutes, and use the counts for nothing else.
• Staff actions in our admin console that change accounts, such as suspending an account, adjusting credits or deciding a verification request, are recorded with the staff member's account, IP address and browser, the account affected and the reason given.

We use these to keep the service secure and working, investigate faults and abuse, and meet legal obligations.

Analytics

• Cloudflare Web Analytics counts page views and measures page speed. It sets no cookies. Cloudflare receives the page address, the referring page, your browser and device type and timing measurements, and sees your IP address because your browser contacts it.
• Google Analytics 4 shows us which pages and tools are used and how visitors arrive. It sets two cookies (see section 5). It receives the address of each page you view (including a search term in the search page's address), the referring page, device and browser details, an approximate location that Google works out from your IP address, and events such as a tool being used, a result copied or downloaded, a game score or the number of search results. When you sign up or sign in, it learns only the method (password or Google).
• Firebase (Google): Firebase Analytics receives events like those above, but with page addresses reduced to broad groups such as “/dashboard” or “/tools”; Performance Monitoring measures how fast public pages load; and Remote Config lets us show a site-wide announcement. When a page fails to load properly, your browser sends us an error report with the error type, the affected script and the page group, and no personal data.
• We do not send these services your name or email address, or the contents of your files and text. Page addresses can contain IDs, though: an RTC project's ID in your dashboard and, when our staff open an account in our admin console, that account's ID.
• Both run on every page without asking you first. You can block both with a content blocker, and Google Analytics also with Google's opt-out browser add-on. Everything on the site works the same without them.

What we do not do

• We do not show ads, and we do not sell or rent personal data.
• We do not buy or rent mailing lists, or track product-email opens or link clicks.
• Account verification is decided by a person, not by an automated system.
• We use personal data only for the purposes in this policy, to meet legal obligations (such as tax records, or an order from a court or authority) and to protect people and the service.

Why we may use your data

The DPDP Act allows personal data to be used with consent or for certain legitimate uses. We rely on:

• Data you give us to use a service: your account and profile, payments, SVGA Maker uploads, VoltKit RTC projects, support tickets, verification requests and what you type into a server-assisted checker. You choose to give it to us for that service, and we use it only for that, which section 7(a) of the DPDP Act allows. If you tell us you no longer want it used, we stop, which means closing that service or your account (section 8).
• Legal duties: keeping payment and tax records, protecting personal data with security safeguards such as logs, and answering courts and authorities. Records the law requires us to keep are kept even if you ask us to stop.
• Analytics runs without a consent step, as described above. You can switch it off for yourself at any time with a content blocker or Google's opt-out add-on.

For data about people using apps built on VoltKit RTC, the app's owner decides why it may be used.

3. Who receives your data

We share personal data only as this policy describes:

• Amazon Web Services (AWS) provides the servers VoltKit runs on (section 4), so everything we store on our servers is kept on AWS computers.
• Razorpay processes payments.
• Google runs Google sign-in (Firebase Authentication), browser notifications (Firebase Cloud Messaging), Google Analytics and Firebase Analytics, Performance Monitoring and Remote Config, and its public DNS service answers DNS Lookup's queries.
• Cloudflare runs Cloudflare Web Analytics and the public DNS service used by DNS Lookup and by some of our server's checks. It also receives email sent to contact@voltkit.in and forwards it to our mailbox, and visits to www.voltkit.in may pass through its network.
• Email providers: the service that hosts our mailbox and delivers account, support, service and product emails receives the recipient address and the message content, including any attachments.
• A backup storage provider, if we keep encrypted copies of our backups away from our servers (section 6).
• Lookup services: ipwho.is and ipify.org, if you ask What Is My IP for details. Domain registries (RDAP) and Team Cymru receive only the domain or address being checked, from our server.
• VoltKit RTC customers receive data about the people using their apps, as described above, including at the webhook addresses they choose.
• Our staff. Staff with admin access can see accounts, profiles (including phone numbers), wallets, payments, support tickets, verification requests and RTC projects, to run the service and help you.
• Authorities, when the law requires it, for example under a court order.

4. Where your data is stored

Our servers are hosted by Amazon Web Services in the United States (AWS region us-east-1, in northern Virginia). The website, the API, the account database, SVGA Maker files, VoltKit RTC service data, our logs and the backups kept on our servers are all there, so your personal data is transferred outside India. Encrypted copies of our backups may also be kept with another storage provider (section 3).

The other services in section 3 process data in their own locations, which may be in India or in other countries. Before we add servers with another provider or in another country, we will update this section.

5. Cookies and browser storage

• refreshToken keeps you signed in. Our API sets it when you sign in or register. Scripts on the page cannot read it, it is sent only over HTTPS, and it lasts 7 days, renewed while you use the site. Signing out removes it. It is needed for your account and is not used for analytics.
• _ga and _ga_XSRQ8LDSR4 are Google Analytics cookies on this site. They let Google Analytics recognise a returning browser and group its visits. Google sets them to last two years; some browsers shorten this.
• Razorpay and Google use their own cookies in their windows when you pay or sign in with Google, under their own policies.
• Local storage in your browser keeps your recently used and favourite tools, your recent searches, games' best scores and two game settings. This stays on your device.
• While you are signed in, a short-lived access token (valid for 15 minutes) is kept only in the page's memory, not in storage.
• The VoltKit RTC test console, if you use it, saves the server address, the API key you paste, the room, identity and role in your browser's local storage so that you need not enter them again, and its operator page keeps an admin token until you close the tab. Clear them when you are done on a shared computer.

You can delete cookies and local storage in your browser's settings. Deleting refreshToken signs you out.

6. How long we keep it

• Account, profile, verification requests, support tickets and notifications: as long as your account exists, including while it is suspended. They are not deleted automatically. If you ask us to delete your account, we delete or anonymise them within 30 days (section 8).
• Tickets opened without an account (with their files): up to three years after the ticket closes, as a record of what was reported or agreed. Reports about content and legal requests are kept at least 180 days, as the IT Rules require. Ask us to delete yours sooner.
• Google sign-in record in our Firebase project: until your account is deleted; we delete it with the account.
• Payment records and wallet history: kept even after your account is deleted, for at least as long as Indian tax and accounting law requires. They are not deleted automatically at present.
• Terms acceptance records: as long as your account exists, and for 3 years after it is deleted, as evidence of what was agreed. Demo acceptance records: 3 years.
• Live demo room records: deleted automatically 7 days after the room ends.
• Browser notifications: a notification token is deleted 90 days after it was last used, or when you turn notifications off. Records of messages sent to many accounts are deleted after 180 days.
• Website error reports: deleted after 30 days.
• Recordings, if an RTC customer turns on optional recording: for the period the customer chose, then deleted.
• Password reset links: deleted automatically when they expire (1 hour, or 24 hours for a link made by our staff).
• Sign-in cookie: 7 days, renewed while you use the site.
• SVGA Maker: uploaded videos about 48 hours after they were last used. Finished files and their records until you ask us to remove them or your account is deleted.
• VoltKit RTC: live room information only while it is in use; chat history until 24 hours after a conversation's last message; broadcast settings until the stream or the project is deleted. API keys are kept until the project is deleted (a revoked key is kept until then, marked as revoked). Webhook settings are kept until you remove them; deleting a project does not remove them, so remove the webhook first or ask us to. Usage figures are kept per project as daily totals for 100 days, monthly totals for 800 days (about 26 months) and a lifetime total with no time limit, also after the project is deleted. A deleted project's record stays in our database, marked as deleted.
• Failed VoltKit RTC webhook deliveries: a delivery that cannot be made goes into a list of the 500 most recent failed deliveries across all customers. The list is deleted 7 days after the latest failure, so while failures keep happening an entry stays until 500 newer ones replace it. Each entry holds the whole event, including the identity in it and, for customers who subscribed to chat messages, the message.
• Logs: web server logs for about 14 days. Application and VoltKit RTC logs are rotated by size, keeping at most about the latest 100 MB per service, so older entries are deleted as new ones arrive. The record of staff actions in our admin console is not deleted automatically.
• Rate-limit counters: the API's and VoltKit RTC's are discarded shortly after their window ends. The website's counters for its server-assisted checkers are kept only in server memory and can stay there until the server restarts.
• Analytics: Google Analytics deletes event-level data after 14 months at most, and keeps summary reports longer. Cloudflare keeps its analytics data under its own policy.
• Email you send us: while we need it to handle your request, and afterwards as a record of what was agreed.
• Backups: copies of the account database, SVGA Maker files and VoltKit RTC's database (which includes recent chat history and failed webhook deliveries) are deleted from our servers after about 15 days. Any encrypted copies kept with another storage provider have no fixed deletion date yet. Data deleted elsewhere can remain in a backup until that backup is deleted.

7. How we protect it

• Our website, API and VoltKit RTC's signalling use HTTPS (TLS), and webhooks are sent only to HTTPS addresses. Call audio and video are encrypted between each device and our media servers with DTLS-SRTP. Requests to our relay (TURN) server are not encrypted with TLS, and they include the identity the app gave you.
• Traffic between our servers travels over an encrypted private network.
• Passwords are stored only as argon2id hashes, and password reset codes and RTC API secrets only as SHA-256 hashes.
• The sign-in cookie cannot be read by scripts on the page. The access token lasts 15 minutes and is kept only in memory. Changing your password ends your other sessions, and resetting it ends all of them.
• Five wrong passwords in a row lock an account for 15 minutes, and sign-in, registration and password reset requests are rate-limited.
• Our databases accept connections only from our own servers, not from the internet.
• Payment details are entered in Razorpay's window, never on our pages.
• Only staff with admin access can use the admin tools. Changes made in our admin console are logged; changes our operators make directly on the VoltKit RTC servers are not logged yet.

No system is perfectly secure. If a personal data breach happens, we will tell the Data Protection Board of India and the people affected, as the DPDP Act requires.

8. Your rights and how to use them

Under the DPDP Act you can ask for a summary of your personal data and of who we shared it with; have it corrected, completed, updated or erased; have a grievance addressed; and nominate someone to use these rights for you. You can also tell us to stop using data you gave us for a service (see Why we may use your data).

In your dashboard

• See your profile, verification status, credit balance and credit history, support tickets, SVGA history on the Tools page and RTC projects, keys and usage, and download your SVGA files again.
• Correct your name, bio, phone number, time zone and email preferences under Profile.
• Change your password, which signs out your other sessions, and sign out.
• Revoke API keys (a revoked key's record stays until the project is deleted), remove webhook settings, and delete RTC projects (section 6 lists what is kept after a project is deleted).

By email

Write to contact@voltkit.in from your account's email address, so we know the request is yours; we may ask you to confirm it. We complete a request within 30 days.

• A summary of the personal data we hold about you and of the services we shared it with, including your payment records and notifications, which the dashboard does not show yet.
• Corrections you cannot make yourself, such as changing your email address or username.
• Erasure of your account, or of particular data such as SVGA files. There is no delete button for accounts yet, so we do this by hand: we delete or anonymise the data within 30 days, except records the law requires us to keep, such as payment records. Copies in backups are deleted as section 6 describes. Unused credits are lost when an account is deleted; the refund policy says when they can be refunded.
• Stopping a use of your data, or withdrawing consent you gave, works the same way. It does not affect what was done before, and we may then be unable to provide a service that needs the data.
• Nomination: tell us the name and contact details of a person who may use these rights for you if you die or become unable to.

If you use an app built on VoltKit RTC, send requests about it to the app's owner; we help our customers answer them. If you are not satisfied with how we handle a request, raise a grievance (section 11). If our answer to your grievance does not resolve it, you can complain to the Data Protection Board of India. Under the DPDP Act the Board works as a digital office, so complaints are made to it online.

9. Children

You must be 18 or older to create an account or buy credits. The DPDP Act treats anyone under 18 as a child, and we do not knowingly keep account or payment data about children. The tools and games need no account and are not aimed at children. If you believe a child has an account, email contact@voltkit.in and we will delete it.

10. Changes to this policy

When we change this policy, we update the date at the top. If a change materially affects account holders, we will tell them by email or with a notice on the site before it takes effect. This version takes effect on 17 October 2026.

11. Contact and grievances

Questions about this policy or your data: contact@voltkit.in.

To raise a grievance about how we handle your personal data, use the grievance form or email our Grievance Officer with “Grievance” in the subject line. We resolve grievances within 7 days. If you are not satisfied with our answer, you can then complain to the Data Protection Board of India (section 8).

Grievance Officer

contact@voltkit.in with “Grievance” in the subject

See also the Terms of Service, the Acceptable Use Policy, the Content & Grievance Policy, the Data Processing Terms, pricing, the cancellation and refund policy and the shipping and delivery policy.