Privacy Policy

1. Browser-Based Tools & Personal Finance Calculators

When using our online utilities (including JSON Formatters, Timestamp Converters, Code Minifiers, Password Generators, Image Resizers, and QR Code Generators) and our financial calculators (such as Loan EMI, Compound Interest, Debt Payoff, Savings Goal, and Crypto ROI models):

• Local Memory Processing: All parsing, cryptographic hashing, image recompression, and financial calculations execute locally in your web browser using Web Workers and the Web Crypto API.
• Zero Input Transmission: Your input values, text payloads, images, financial figures, salary data, and generated passwords never leave your device. They are not transmitted across the network, stored in server-side logs, or saved to any database.

2. Voluntary Community Reviews & Discussion

To foster an authentic, open platform while preventing automated spam and malicious flooding, visitors who wish to publish software reviews, comment on discussions, or cast helpfulness votes may sign in using their Google Account. When you submit these items, the following information is transmitted to our server and stored in our database:

• Public Display Name: Your chosen public handle or name (minimum 2 characters, customizable in your account) required to attribute your feedback and distinguish comments in discussion threads.
• Review Content: Target product slug, 1–5 star rating, review headline, detailed experience text, and optional usage duration or workload purpose.
• Discussion Comments & Replies: Display name, comment text, parent comment reference (to construct threaded replies), and timestamp.
• Helpful / Not Helpful Votes: Your vote selection (+1 or -1) associated with the specific review or comment ID.
• Product Suggestions: Suggested tool name, category, website URL, and justification text submitted for moderation.
• Abuse Reports: Report reason category and optional contextual notes submitted to alert our moderators to inappropriate content.

3. User Authentication & Password Security (Reviews Platform Only)

Authentication on AuditOptima is strictly isolated to the Reviews platform. We do not require sign-in to browse our site, read editorial benchmarks, read community reviews, or run any browser utility or financial calculator. Reviewers may sign in using either Google OAuth or Email & Password:

• Google OAuth: When signing in with Google, we request standard profile authentication (openid, email, profile). We store your immutable Google user ID (sub), verified email address, and default public display name.
• Email & Password Registration: When registering with email and password, we enforce strong password requirements (minimum 12 characters). Plaintext passwords are never logged, transmitted in unencrypted formats, or stored in any database. Passwords are cryptographically salted and hashed using memory-hard Argon2id (OWASP-recommended parameters: 19,456 KiB memory, 2 iterations, 1 parallelism).
• Email Verification & Password Recovery: Email registration and password reset workflows utilize single-use, cryptographically secure 256-bit random tokens that automatically expire within 30 minutes. Tokens are stored in our database exclusively as SHA-256 digests. Transactional security emails are delivered via Resend without marketing tracking.
• Automated Bot Defense (Cloudflare Turnstile): Account creation and password recovery forms are protected by Cloudflare Turnstile in Managed mode. Turnstile verifies human interaction without presenting intrusive image puzzles, and checks run over TLS directly with Cloudflare.
• Abuse Prevention & IP Privacy: To defend registration and recovery endpoints against brute-force and credential-stuffing abuse, rate limits are tracked in memory and cache using HMAC-SHA256 digests. Raw IP addresses are never written to database tables.
• Strict Email Privacy: Your email address is strictly confidential. It is never displayed publicly anywhere on AuditOptima, never visible to other users, never shared with third-party vendors or advertisers, and never used to send marketing newsletters or promotional spam.
• Session Security: Sessions are managed via secure, encrypted HTTP-only cookies (SameSite=Lax) with cryptographically signed tokens (HMAC-SHA256). Session cookies expire after 30 days of inactivity and are invalidated immediately upon logout or password reset.
• Account Management & Self-Service Deletion: Authenticated reviewers have full control over their data at /reviews/account:
  • Inspect all submitted reviews and monitor their moderation status.
  • Update your public display name at any time.
  • Change your account password or set a password for Google-connected accounts.
  • Permanently delete individual reviews.
  • Perform complete account deletion, which destroys all active sessions, removes your user profile and credentials from our database, and unlinks authored reviews.

4. Anti-Spam Architecture & Visitor Identifiers (Accurate Disclosure)

To protect the platform from automated spam bots, review flooding, and vote manipulation without pervasive surveillance, our server generates derived anti-abuse identifiers:

• One-Way Cryptographic Hash: When a review, comment, vote, report, or suggestion is submitted, the server calculates an irreversible SHA-256 cryptographic digest combining your connection IP address, User-Agent header, Accept-Language header, and a server-side confidential salt (VISITOR_SALT).
• Zero Raw IP Storage: Your raw IP address and user-agent strings are never stored in persistent database tables, never logged to permanent ledgers, and never returned in API responses.
• Limited Functional Purpose: This opaque hash is stored solely to enforce:
  • Sliding-window rate limits (e.g. limiting repeated submissions to prevent denial-of-service or bot flooding).
  • One-vote-per-visitor rules (preventing a visitor from artificially inflating or deflating review helpfulness scores).
  • Single-report deduplication (preventing a visitor from spamming multiple reports on the same comment).
• No Cross-Site Tracking: We do not use this identifier for cross-site behavioral tracking, commercial advertising, or user profiling.

5. Review Moderation, Author Management & Deletion

We maintain strict quality standards and editorial integrity:

• Editorial Moderation: All reviews and comments are initially stored in a pending moderation state or reviewed post-submission to prevent promotional spam, hate speech, and defamation before public display.
• Authenticated Author Control: Signed-in reviewers can inspect, edit, or delete their submissions anytime via their account dashboard at /reviews/account.
• Legacy Guest Management Keys: For reviews submitted prior to mandatory authentication, authors holding a private 48-character management key can continue to view, update, or remove their review through the management interface.

6. Data Retention Policies

• Published Reviews & Comments: Retained indefinitely while the target software product remains active in our catalogue, or until deleted by the author or removed by a moderator.
• Rate Limit Logs: Temporary rate limit records stored in our database contain an automatic expiration timestamp and are routinely purged once their sliding window expires (between 10 minutes and 24 hours).
• Local Preferences: Visual preferences (such as light or dark theme mode) are stored strictly in your browser's local localStorage and never transmit to our servers.

7. Outbound Links, Vendor Sites & Affiliates

Our software review pages and editorial benchmarks contain direct outbound links to official software vendor websites. Once you leave our domain, your activity is governed by the respective third-party vendor's privacy policy. All affiliate links on our platform are explicitly disclosed and tagged with rel="sponsored nofollow noopener" in accordance with FTC guidelines and web standards. Affiliate relationships never influence our editorial benchmark testing or community rating calculations.

8. Web Analytics & Advertising Disclosures

We maintain strict separation between client-side tools execution and platform analytics:

• Web Analytics (Google Analytics 4): AuditOptima supports Google Analytics 4 via an optional configuration to measure aggregate site performance and visitor trends. When active, GA4 sets first-party analytical cookies with IP anonymization enabled. No calculation inputs, file uploads, financial data, or sensitive passwords are ever transmitted to analytics services.
• Advertising (Google AdSense Readiness): Advertisements on AuditOptima are disabled by default. If commercial advertising is enabled in the future, Google AdSense and certified ad technology vendors may serve non-intrusive advertisements subject to user consent and applicable regional privacy frameworks (such as GDPR and CCPA). You can opt out of personalized advertising anytime through Google Ad Settings.

9. Contact & Data Inquiries

If you have questions about our data architecture or wish to request manual removal of content you submitted, you may contact our editorial and engineering team through our Contact Page.