Privacy Policy

1. Who We Are

DapDigital operates the website dapdigital.top. Throughout this policy, "we," "us," and "our" refer to DapDigital.

We provide free online tools (PDF utilities, file converters) and educational games (math, typing) to our users.

For any privacy-related questions, please visit our contact page.

2. Information We Collect

Account Data

When you register for an account, we collect:

• Email address — used for authentication, account verification, and communication.
• Display name (optional) — shown on your profile and leaderboards.
• Password — stored as a one-way cryptographic hash; we never store your plaintext password.
• IP address — recorded at registration and each login for security and fraud prevention.

Usage Data

• Game progress and XP — scores, levels, experience points, and achievements earned while using educational games.
• Tool usage — which tools you use and general usage statistics (for logged-in users).

Uploaded Files

Files uploaded to our tools (such as PDFs for conversion) are stored temporarily on our servers. These files are automatically and permanently deleted after 90 minutes. We do not read, analyze, or share the contents of your uploaded files.

Cookies

• Session cookies (essential) — required to keep you logged in and maintain your session state. These expire when you close your browser or after a period of inactivity.
• Ad network cookies — third-party advertising partners may set cookies to serve and measure relevant advertisements. See Section 7 for details.

3. Legal Basis for Processing (GDPR Article 6)

If you are located in the European Economic Area (EEA) or the United Kingdom, we process your personal data under the following legal bases:

• Consent (Article 6(1)(a)) — you provide consent when you voluntarily create an account and agree to this policy. You may withdraw consent at any time by deleting your account.
• Legitimate Interest (Article 6(1)(f)) — we process certain data (such as IP addresses and usage analytics) for security, fraud prevention, and service improvement. We have assessed that these interests do not override your fundamental rights and freedoms.
• Performance of a Contract (Article 6(1)(b)) — processing necessary to provide you with the services you requested (account management, game progress tracking, file processing).

4. How We Use Your Data

• Provide services — operate our tools and games, process uploaded files, and track your game progress.
• Account management — authenticate your identity, manage login sessions, and send account-related emails (verification, password reset, magic links).
• Security — detect and prevent fraud, abuse, and unauthorized access using IP address logs and rate limiting.
• Analytics and improvement — understand how our services are used so we can improve them. We use aggregated, anonymized data wherever possible.

We do not sell your personal data. We have never sold personal data and have no plans to do so.

5. Cookies

Essential Cookies

We use session cookies that are strictly necessary for the operation of our website. These cookies enable core functionality such as user authentication and session management. Because they are essential, they do not require consent under GDPR.

Third-Party / Advertising Cookies

Our advertising partners may use cookies and similar tracking technologies to serve advertisements and measure their effectiveness. These cookies may collect information about your browsing activity across different websites. You can manage or disable these cookies through your browser settings or by using the opt-out mechanisms provided by the ad networks.

6. Data Retention

• Account data — retained for as long as your account is active. You may delete your account at any time, and we will erase your personal data within 30 days of the request.
• Uploaded files — automatically deleted after 90 minutes. No copies are retained.
• IP address logs — retained for security and fraud prevention purposes. Registration IP and last login IP are stored as part of your account record and deleted when your account is deleted.
• Game progress and XP — retained for as long as your account is active and deleted upon account deletion.

7. Third-Party Services

We work with third-party advertising networks to display ads on our website. These networks may collect and use certain data (such as cookies, device identifiers, and IP addresses) to serve personalized advertisements. Each ad network operates under its own privacy policy.

We encourage you to review the privacy policies of these advertising partners. We do not control and are not responsible for the data practices of third-party ad networks.

8. Your Rights Under GDPR

If you are located in the EEA or the United Kingdom, you have the following rights regarding your personal data:

• Right of access — request a copy of the personal data we hold about you.
• Right to rectification — request correction of inaccurate or incomplete personal data.
• Right to erasure ("right to be forgotten") — request deletion of your personal data when there is no compelling reason for continued processing.
• Right to data portability — receive your data in a structured, commonly used, machine-readable format.
• Right to restrict processing — request that we limit how we use your data in certain circumstances.
• Right to object — object to processing based on legitimate interests or for direct marketing purposes.
• Right to withdraw consent — where processing is based on consent, you may withdraw it at any time without affecting the lawfulness of prior processing.

To exercise any of these rights, please contact us via our contact page. We will respond to your request within 30 days. If you are not satisfied with our response, you have the right to lodge a complaint with your local data protection authority.

9. Your Rights Under US Privacy Laws

California Residents (CCPA / CPRA)

If you are a California resident, the California Consumer Privacy Act (CCPA) and the California Privacy Rights Act (CPRA) provide you with the following rights:

• Right to know — request disclosure of the categories and specific pieces of personal information we have collected about you.
• Right to delete — request deletion of the personal information we have collected.
• Right to opt-out of sale or sharing — we do not sell or share (as defined by the CCPA/CPRA) your personal information. No opt-out is necessary.
• Right to non-discrimination — we will not discriminate against you for exercising your privacy rights.
• Right to correct — request correction of inaccurate personal information.
• Right to limit use of sensitive personal information — we do not use sensitive personal information for purposes beyond what is necessary to provide our services.

Virginia Residents (VCDPA)

If you are a Virginia resident, the Virginia Consumer Data Protection Act (VCDPA) provides you with similar rights:

• Right to access — confirm whether we are processing your personal data and access it.
• Right to delete — request deletion of your personal data.
• Right to correct — correct inaccuracies in your personal data.
• Right to data portability — obtain a copy of your data in a portable format.
• Right to opt out — opt out of the processing of personal data for targeted advertising, sale, or profiling. We do not sell your data or engage in profiling.

To exercise any US privacy rights, please contact us via our contact page. We will verify your identity and respond within the timeframes required by applicable law.

10. Children's Privacy

Our services are not directed at children under the age of 13. We do not knowingly collect personal information from children under 13 in compliance with the Children's Online Privacy Protection Act (COPPA).

If you are a parent or guardian and believe that your child under 13 has provided us with personal information, please contact us immediately. We will take steps to delete the information as soon as possible.

Users between the ages of 13 and 16 located in the EEA require parental consent for data processing in accordance with GDPR requirements.

11. Data Security

We implement appropriate technical and organizational measures to protect your personal data, including:

• Encryption in transit — all connections to our website are encrypted using HTTPS/TLS.
• Password hashing — passwords are stored using bcrypt, a strong one-way hashing algorithm. We never store plaintext passwords.
• CSRF protection — all forms are protected against cross-site request forgery attacks.
• Rate limiting — we employ rate limiting to protect against brute-force attacks and abuse.
• Input validation and sanitization — all user input is validated and escaped to prevent injection attacks.
• Regular updates — we keep our server software and dependencies up to date with security patches.

While we strive to protect your data, no method of electronic transmission or storage is 100% secure. We cannot guarantee absolute security but are committed to promptly addressing any security incidents.

12. International Data Transfers

Our servers may be located in different jurisdictions. If you access our services from outside the country where our servers are located, your data may be transferred across international borders.

When transferring data from the EEA or UK, we ensure appropriate safeguards are in place, such as standard contractual clauses approved by the European Commission, to ensure your data receives an adequate level of protection regardless of where it is processed.

13. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. When we make material changes, we will:

• Update the "Last updated" date at the top of this page.
• Notify registered users via email for significant changes that affect how we handle your data.

We encourage you to review this page periodically. Your continued use of our services after changes are posted constitutes your acceptance of the updated policy.