Privacy Policy

Last updated: January 2, 2026

QuantumGlitch Studio (“we”, “us”, “our”) respects your privacy. This Privacy Policy explains how we collect, use, disclose, and protect personal data when you use RandomizeIt web application (the “Service” or “App”).

1. Scope & Acceptance

By accessing or using the Service, you accept the practices described in this Privacy Policy. If you do not agree, please do not use the Service. This policy covers personal data collected through the website, APIs, and any account registration flows. It does not apply to third-party websites linked from the Service.

2. Categories of Data We Collect

2.1 Account & Registration Data

When provided by you: email address (if you register), username, display name (from Google profile if logging in with Google OAuth). Purpose: to create and manage your account, enable login, and contact you about your account.

2.2 User-Provided Content

Examples: custom presets (e.g., “Dinner Options”), Life Randomizer categories, Tarot customizations, saved decks, and other content you create and save. Purpose: to store and present your preferences and saved items across your devices.

2.3 Usage & Technical Data (Automatically Collected)

Examples: IP address, device type, browser type and version, operating system, pages visited, click events, timestamps, referrer, and error logs. Collection methods: server logs, Google Analytics, and hosting platform logs (Render/Vercel). Purpose: to operate, secure, analyze, and improve the Service.

2.4 Cookies & Similar Technologies

Session cookies and persistent cookies for authentication, preferences, and analytics. See Section 6 (Cookies) for details.

3. How We Use Your Data (Purposes & Legal Bases)

We use personal data for the following purposes:

Providing Service: to create and maintain your account, serve personalized settings, and deliver features you request (legal basis: performance of contract / user consent).
Security & Fraud Prevention: to detect and prevent abuse, secure accounts, and investigate incidents (legal basis: legitimate interests).
Analytics & Product Improvement: to measure usage, monitor performance, and prioritize features (legal basis: legitimate interests).
Advertising: to display and personalize ads via Google AdSense (legal basis: consent where required; otherwise legitimate interests subject to applicable law).
Communications: to send service-related messages, updates, and support replies (legal basis: performance of contract / consent).
Legal Compliance: to comply with legal obligations and defend legal claims (legal basis: legal obligation).

4. Data Retention

We retain data as follows, unless a different retention period is required by law:

Account data & user content: retained while your account is active and for up to 12 months after account deletion unless you request earlier deletion.
Usage & analytics data: retained for up to 24 months for analysis and product improvement, after which identifiers are removed or aggregated.
Backups & logs: retained for up to 90 days for operational and security purposes.
Support communications: retained for up to 24 months for troubleshooting and service history.

If you want data deleted sooner, see Section 10 (Your Rights).

5. Data Sharing & Third Parties

We may share personal data with:

Service providers: to host, operate, and secure the Service (e.g., MongoDB Atlas for database hosting, Render.com for backend, Vercel for frontend hosting, email delivery providers).
Google services: for Authentication (OAuth), Google Analytics (usage analytics), and Google AdSense (advertising). These providers act as processors under their own policies.
Legal & safety disclosures: when required by law, or to protect rights, safety, or property.
Business transfers: in the event of a merger, sale, or acquisition, user data may be transferred as part of business assets. We will notify users if a material change occurs.

We do not sell personal data. If you believe otherwise or want to opt out of personalised ads, see Section 11 (Advertising & Opt-Out).

6. Cookies & Similar Technologies

We use cookies and similar technologies for:

Essential cookies: authentication, session management, and security. Disabling these may break basic functionality.
Analytics cookies: Google Analytics to measure usage and improve the Service.
Advertising cookies: to serve and personalize ads via Google AdSense.

You can control cookie preferences via your browser settings. For targeted advertising opt-outs, see Section 11.

7. International Data Transfers

Our infrastructure and third-party providers may process data in countries outside your own, including the United States. When data is transferred internationally, we implement appropriate safeguards (for example, standard contractual clauses or equivalent measures) where required by law.

8. Security

We implement industry-standard technical and organizational measures to protect your data, such as HTTPS/TLS for data in transit, password hashing (bcrypt), access controls, and monitoring. However, no system is 100% secure; we cannot guarantee absolute security.

If a security breach affects your data, we will notify you and regulators as required by applicable law.

9. Children

The Service is not intended for children under 16. We do not knowingly collect personal data from children under this age. If we become aware that we have collected such data, we will delete it promptly.

10. Your Rights (Access, Correction, Deletion, Portability)

Depending on your jurisdiction, you may have rights such as:

Access: request a copy of your personal data.
Correction: request correction of inaccurate data.
Deletion: request deletion of your account and personal data.
Restriction: request limits on processing.
Portability: request a machine-readable copy of your data.
Withdraw consent: where processing is based on consent.
Object: object to certain processing (e.g., direct marketing).

To exercise any of these rights, contact us via the address below. We may need to verify your identity before acting on requests. We will respond within the timeframe required by applicable law.

11. Advertising & Opt-Out

We display personalized ads using Google AdSense. If you prefer not to receive personalized ads:

Use Google’s Ads Settings to opt out of personalized advertising:

https://adssettings.google.com/

For browsers, consider installing industry opt-out tools such as Network Advertising Initiative opt-out.

You may also contact us to request suppression of personalized advertising from our side; we will process reasonable requests consistent with applicable law. We do not sell personal information for monetary consideration.

12. Third-Party Links & Embedded Content

The Service may include links to third-party websites. We are not responsible for third-party privacy practices or content. Review the privacy policies of sites you visit.

13. Changes to this Policy

We may update this Privacy Policy from time to time. When changes are material, we will post a prominent notice on the site and update the “Last updated” date.

14. Contact & Data Requests

If you have any questions about these Terms, please contact us through the website.

QuantumGlitch Studio
Email:

support@randomizeit.xyz

If you are in the EU/UK and unsatisfied, you have the right to lodge a complaint with your local Data Protection Authority.

15. Additional Notices (EU / UK / California)

EU / UK (GDPR)

If you are located in the EU or UK, you can exercise rights described in Section 10. Our lawful bases for processing are as described in Section 3.

California (CCPA / CPRA)

California residents may request access to categories of personal data collected, request deletion, and opt-out of sale (we do not sell personal data). To submit a request, contact