Privacy Policy
Last updated: 10 November 2026
This policy explains what personal data BounceSimulator ("we"), India, collects through BounceSimulator, why, and what you can do about it. We are the data fiduciary under the Digital Personal Data Protection Act, 2023 (DPDP Act), and the controller under the EU and UK General Data Protection Regulation (GDPR) for visitors there.
The short version
- Videos are made on your own device. We never receive the video files.
- We keep your email, your name if you add one, your settings, a record of your exports, and your purchases.
- Payments go through Razorpay. We never see your card number or UPI PIN.
- We don't sell your data, and we don't use advertising trackers.
- You can download your data or delete your account at any time, from the Account page.
What we collect, and why
| Data | Why we need it | Legal basis |
|---|---|---|
| Email address | To sign you in with a one-time code, and to send account messages | To provide the service you asked for |
| Name (optional) | To show on your account | Your choice |
| Google account name and email, if you sign in with Google | To sign you in | Your choice |
| When you ticked the age and agreement boxes, and which Terms version | To show you agreed | Legal obligation |
| Theme, language and email-tips choice | To remember your choices | To provide the service; your consent for tips |
| Export records: game settings, date, quality, whether a credit was used | To count free exports and credits, and for My videos | To provide the service |
| Purchases: pack, amount, currency, date, Razorpay order and payment references, invoice number | To add credits, issue invoices, handle payment problems, and keep tax records | Contract; legal obligation |
| Technical data: IP address, browser type, error reports | To keep the service secure and fix problems | Legitimate use for security |
We don't collect sensitive data such as financial account details, health or biometric information.
What we don't collect
- Your videos. The Studio draws and encodes them in your browser, and they download straight to your device.
- Card or UPI details. You enter these in Razorpay's own payment window.
- Anything that tracks you across visits. We count page views with Vercel Web Analytics, which uses no cookies and doesn't identify you: it sees the page, the referring site, your country and your device type, and keeps only totals. See the Cookie Policy.
Who processes data for us
| Service | What it does | Where |
|---|---|---|
| Supabase | Sign-in and our database | Mumbai, India |
| Vercel | Hosts the website and counts page views (Web Analytics, no cookies) | Worldwide edge network; Mumbai, India for servers |
| Razorpay | Payments | India |
| "Continue with Google" sign-in, if you choose it | Worldwide | |
| Google (Gmail) | Sends sign-in codes and account emails | Worldwide |
Each one may use your data only to provide its service to us, under a contract. Some of them process data outside India. When they do, they protect it under their contract with us, and for visitors in the EU and UK, under the standard contractual clauses the GDPR allows.
How long we keep it
- Account data: until you delete your account.
- Export records: until you delete your account.
- Purchase and invoice records: 8 years after the purchase, because tax law requires it, even if you delete your account. They are kept without your account attached.
- Security logs: up to 90 days.
Your rights
You can:
- Get a copy of your data: Account → Privacy and data → Download my data.
- Correct it: change your name on the Account page, or contact us.
- Delete your account: Account → Privacy and data → Delete account. We ask for a code sent to your email first, so nobody else can delete it.
- Withdraw consent: turn off email tips or analytics cookies at any time. This doesn't affect anything done before.
- Nominate someone to use these rights for you if you die or become unable to, as the DPDP Act allows. Contact the Grievance Officer to do this.
- Complain: contact our Grievance Officer first. If you're not satisfied, you can go to the Data Protection Board of India, or, in the EU or UK, your local data protection authority.
Children
BounceSimulator is for people aged 18 or over, or younger people using it with a parent's or guardian's permission. We don't knowingly collect data from children without the consent the law requires. If you think we have, contact the Grievance Officer and we'll delete it.
Security
Data is encrypted in transit (HTTPS) and at rest. Sign-in uses one-time codes, so there are no passwords to steal. Only our server can change credits and payments; people can only read their own records. If a breach affects your data, we'll tell you and the authorities as the law requires.
Changes
We'll update the date above when this policy changes, and tell you by email before any significant change takes effect.
Contact
Privacy questions: studioloopsyt@gmail.com · Grievance Officer: see the Grievance Officer page.