Privacy Policy

Effective date: 31 May 2026. Last updated: 15 October 2026.

BeginThings ("we", "us", "our") operates beginthings.com and the products listed on it. This policy explains what we collect, how we use it, your rights, and how to contact us. The data we handle depends on the product you use and whether you have an account, an order or a support request. The table also covers records from past service engagements; those historical records are not a current service offer.

1. Products, accounts and support records

Category	Examples	What is collected
1. Free Tools	QR Creator, Invoice Generator, UPI QR, the /free-tools/ catalog	For local-only tools, the content you enter stays in your browser. Tools that use a network service or open an external destination describe that separately; review the tool’s instructions before supplying data. Google Analytics page views and the limited campaign identifiers described below are processed only if you accept analytics. No login, signup or email is required.
2. Account-based Workspace	BeginRooms / Workspace 3D	When you sign in, we receive the account profile supplied by Google or the email-link flow. Rooms and boards saved to your account are transmitted over HTTPS and stored for account access and cross-device sync. Identity sign-in does not grant Google Drive, Calendar or Gmail access. Connecting Calendar and Tasks in BeginRooms is optional and requires a separate Google permission prompt. Optional BeginNotes personal scripts require separate setup and permissions; see the integration instructions.
3. Subscription and release-gated products	BeginRooms; FormulaMapper preview and planned licensing	For BeginRooms we store the verified account email, selected product and plan, trial and entitlement timestamps, transaction identifiers, and the billing profile described below. FormulaMapper has a manual Windows trial preview with local trial state. Its paid activation and checkout remain closed; a future paid licensing flow may require machine and entitlement identifiers for the correct installation. Card and bank credentials are entered only in Razorpay.
4. Paid Digital Products	FollowUp Desk, templates, toolkits, workbooks and guides on /shop.html	We store the billing and delivery details you enter at checkout, the product, amount and transaction identifiers, and delivery status. We never see your card, UPI PIN or bank credentials.
5. Support and historical service records	Support requests and records from past service engagements; no new service offer	The contact details and project information you provided directly by email or a contact form. Used to respond to your request, support an existing engagement and retain required records.

2. Information you provide directly

Email address, if you subscribe to our newsletter, fill out a lead-capture form, or contact us at sourav@beginthings.com.
Google account profile (name, email, profile picture) if you use Google to sign in to BeginRooms. Provided by Google after you authenticate. Identity sign-in requests only basic identity scopes. BeginRooms Calendar and Tasks connections and optional BeginNotes personal Gmail or Calendar scripts use separate permissions which you review during setup. Capture filters do not reduce the scope of a permission grant.
Checkout and order details if you purchase a subscription or digital product: full name, delivery email, one-line billing address including city, country, State or Union Territory (or state/province outside India), postal code, optional GSTIN, selected product and plan, amount, transaction identifiers, payment status and fulfilment status. The Indian GST state code is derived from the State or Union Territory you select; we do not ask you to type it.
Support and historical project details that you provide for a support request or an existing service engagement. Project details remain confidential between you and BeginThings. These records do not mean that new service engagements are offered.

3. Information collected automatically

Google Analytics 4 (measurement ID G-7PBJMQL1LZ): page views, referrer, approximate location (city level), device type, browser, anonymized IP. Disabled by default until you accept the cookie banner.
Consented campaign attribution: if you accept analytics, the current tab may keep the first valid gclid, gbraid, wbraid, utm_source, utm_medium, utm_campaign, utm_content and utm_term values for up to 30 minutes. Unknown values, full landing URLs and form content are not included. Essential only or Global Privacy Control clears and suppresses this snapshot.
Retired first-party visitor counter: the former counter that hashed IP and browser data is retired and no longer records visits. Historical records remain stored. Current optional analytics use consent-gated Google Analytics as described above; Essential only or Global Privacy Control prevents that tracking.
Standard server logs from our host (Hostinger): request URLs, timestamps, IP address, user agent. Retained for hosting and security purposes.
Google AdSense (publisher ca-pub-8427756296560869), where enabled, may set advertising cookies after you consent. See Google's ads policy.

4. Product content and local processing

BeginRooms keeps a local browser copy for responsive editing and recovery. When you are signed in, saved room and board data is also sent over HTTPS to the BeginThings service for account access and cross-device sync. This content is account-protected but is not end-to-end encrypted; do not store secrets that require client-only encryption.
Local-only tools process inputs in your browser. A tool that uses a network service or opens another website describes that separately. Choosing to share, submit or open an external destination can send the information you select; review the tool’s instructions before doing so.
FollowUp Desk stores lead records, settings and edited templates in the browser profile where you open the downloaded file. Those records and any CSV or JSON backups are plaintext, not encrypted. They are not sent to BeginThings. Choosing “Open WhatsApp” creates a normal WhatsApp link containing the phone number and message you reviewed, which WhatsApp then handles under its own terms.
FormulaMapper has a manual Windows preview with local workbook and trial working state. The included trial helper has not yet been run in Windows Excel. Paid activation and checkout remain closed. See the product page and included setup guide for the current preview limits.

Optional Google Calendar and Tasks connections in BeginRooms

Signing in with Google identifies your BeginThings account. It does not connect your calendar or task list. If you choose Connect Google in BeginRooms, Google separately asks whether to allow Calendar and Tasks access. You can use your workspace without connecting these services.

Calendar: the connection reads upcoming events from your primary calendar for the next 31 days. It keeps event identifiers, titles, dates and times, all-day and recurring status, locations, event and meeting links, organizer name or email, attendance counts, whether you declined and the event’s status to display in the workspace calendar.
Tasks: the connection reads incomplete tasks from your default task list. It keeps task identifiers, titles, due dates and notes to display beside your workspace tasks.

Google’s responses can include additional event or task details; the connection keeps the display fields described above. These connections do not create, change or delete events or tasks in Google. The permissions you grant can cover more calendars or lists than the primary calendar and default list currently read by BeginRooms.

Browser storage and retention: these requests go from your browser to Google. Access tokens are held in page memory, not saved as persistent browser credentials, and access may be renewed while the page is open. Event and task display data and refresh times are cached separately in this browser. A successful refresh replaces the corresponding cache; a failed refresh may leave the previous copy. These content caches have no fixed automatic expiry. Closing the page ends its in-memory token session but does not reliably delete the cached content.

Disconnecting: Disconnect ends this page’s Calendar/Tasks connection, removes its display caches when browser storage is available, and asks Google to revoke the token. You can also review or remove access through Google Account connections. Clearing BeginThings site data in your browser removes local cached data, but can also remove unsynced workspace work; export important work first. Removing a Google grant does not delete content you have separately copied to your canvas, shared or exported. Such copies follow the workspace storage, sharing and deletion provisions in this policy.

Drive and Gmail: Google Drive account import is currently disabled, and the BeginRooms connection does not provide Gmail inbox access. You can add a Drive link or import a file you downloaded yourself. A saved link retains the original service’s access rules; an imported file is a separate workspace copy and does not automatically update when the original changes. BeginNotes personal scripts are a separate feature described below.

BeginNotes — free early-access notes

This subsection describes BeginNotes at /workspace/beginnotes/. Its storage choices are separate from the other products described above.

Guest notes: note content and selected images are stored only in this browser’s IndexedDB, not on our server. Local guest storage is not end-to-end encryption or a backup service. Clearing site data, removing the browser profile or losing the device may remove this copy. Export important notes before doing so.
Account sign-in: BeginNotes uses the existing BeginThings email magic-link authentication and account session. Creating an account through this flow also creates the existing account and trial records. BeginNotes early access remains free independently of any BeginRooms trial or paid plan; it does not require a paid subscription.
Account storage: signed-in notes and selected image attachments are sent over HTTPS to our existing hosting. They are stored in private per-user files outside the public web root, encrypted at rest using AES-GCM, with the encryption key outside the public web root. This is server-side encryption, not end-to-end encryption; the service can decrypt content to provide account access.
Browser memory and failed saves: signed-in cloud note content is held in browser memory without a persistent cloud-content browser cache. If a cloud save fails, the draft remains in memory while the page is open. Export it before closing or reloading to avoid losing unsaved changes. Account storage is not a promise of universal offline availability.
Limited attachments and storage: users may select up to two JPEG or PNG images per note, each at most 1 MiB after capture compression and at most 4 megapixels. The account limit is 200 notes and 20 MiB of encoded storage, including note and image data. Encoding may use more space than the original image files.
Content use: BeginNotes note content, including titles, text and image attachments, is not used for advertising or analytics. The public site’s consent-controlled measurement and hosting/security logs remain as described elsewhere in this policy. BeginNotes early access does not perform AI processing, OCR or microphone recording.
Device information: account device records show a browser/device label and its last successful contact with the service. This is not continuous location tracking, a live presence indicator or confirmation that all notes have reached every device.
Export and deletion: use the app’s text or JSON exports to keep a copy, and calendar-file export for dated items. Export formats differ; preserve original image files separately if an export does not include them. You can delete notes in the app. Guest deletion affects this browser; account deletion must be successfully saved to the service. Downloaded exports and original files are separate copies that you control. For account or data-deletion requests, email sourav@beginthings.com. Account content is kept until you delete it or request deletion, subject to applicable backup and security-retention windows; this does not promise immediate removal of separately retained backups.
Automation credentials: Optional capture credentials permit adding notes only, expire after 90 days and can be revoked in Settings. We retain hashed credential references, rule settings and bounded event receipts for duplicate protection (seven days). Connected workflows send only what their configured rules select. Any integration provider also processes the content under its own terms. Browser-extension pending captures and installable-app share drafts stay in that browser until sent or removed. A web app cannot read other apps’ phone notifications without a separately authorized native integration.
No automatic external-app access: BeginNotes receives only what you type, paste, import or select. Sign-in does not grant access to Apple Notes, Google Keep, WhatsApp, personal feeds, saved collections, your photo library or calendar. Imports are copies; calendar export does not create a live connection or automatically update another app. Deleting a BeginNotes copy does not delete its source.

Explore BeginNotes and its early-access limits.

5. How we use information

To operate and improve beginthings.com and the products listed on it.
To send emails you have requested, including newsletter updates and order confirmations.
To respond to messages you send to sourav@beginthings.com.
To analyze aggregate traffic patterns via Google Analytics.
To understand which consented campaign led to a checkout and, where the separately enabled order-attribution feature is active, attach that limited snapshot to the matching first-party order record. Campaign values never decide the product, price, payment status or fulfilment.
To show advertising where AdSense is enabled and you have consented.
To fulfill purchases and provide customer support.
To support existing service engagements and retain their required historical records. This does not offer new services.

6. Third-party services we use

Google Analytics 4 for traffic analytics. Google Privacy Policy.
Google Identity Services for optional account sign-in, which requests only basic profile scopes. BeginRooms Calendar and Tasks use a separate permission prompt. See Optional Google Calendar and Tasks connections in BeginRooms for the data accessed, browser caching and disconnect controls.
Google AdSense for display advertising on selected pages.
Hostinger for web hosting.
Razorpay for secure payment processing on paid products (UPI, cards, netbanking, wallets).
Our own contact backend (api/contact.php, hosted on beginthings.com) handles contact forms, including any retained historical service enquiries. There is no third-party form processor: submissions are stored on our own server and emailed to us. Does not place cookies on you.
Cloudflare, cdnjs, Google Fonts, Bootstrap CDN for public asset delivery. May receive your IP as part of normal HTTP requests.

7. Cookies

We use essential browser storage (theme preference, consent choice, checkout security and short-lived order-recovery state), and—only after you choose “Accept all”—Google Analytics, advertising measurement storage and a 30-minute current-tab campaign snapshot. After an order is created, a separate first-party measurement request may attach that snapshot to the matching order record; it is not sent to Razorpay and is not automatically uploaded to an advertising platform. Full breakdown is on the Cookie Policy page.

Google AdSense & Advertising Cookies

We use Google AdSense (publisher ca-pub-8427756296560869) to serve display advertisements on selected pages across beginthings.com. In compliance with Google Publisher Policies:

Third-party vendors, including Google, use cookies to serve ads based on a user's prior visits to beginthings.com or other websites across the Internet.
Google's use of advertising cookies (such as the DoubleClick DART cookie and related identifiers) enables it and its partners to serve ads to users based on their visits to our site and/or other sites on the Internet.
Users may opt out of personalized advertising by visiting Google Ads Settings.
Alternatively, you can opt out of a third-party vendor's use of cookies for personalized advertising by visiting aboutads.info choices or the European Interactive Digital Advertising Alliance (EDAA).

8. Your rights

If you are in the EU, EEA, UK, India, California, or other regions with data-protection laws, you have the right to:

Access the personal data we hold about you.
Correct inaccurate data.
Request deletion of your data.
Object to or restrict certain processing.
Withdraw consent for analytics or advertising at any time.
Lodge a complaint with your local data-protection authority.

To exercise any of these rights email sourav@beginthings.com. We respond within 30 days.

India residents (DPDPA, 2023)

You additionally have the right to nominate another person to exercise rights on your behalf, grievance redressal within 30 days, and consent withdrawal at any time without affecting prior processing. Send DPDPA requests to sourav@beginthings.com with the subject line "DPDPA request".

California residents (CCPA / CPRA)

You have the right to know, delete, correct, limit use of, and opt out of any "sale" or "sharing" of your personal information for cross-context behavioral advertising. We do not sell personal information. When you accept analytics and we run paid campaigns, configured advertising-measurement cookies such as Google Ads cookies may qualify as "sharing" under CPRA. Opt out by choosing Essential only, enabling Global Privacy Control (we honor it), or emailing sourav@beginthings.com with subject "CCPA opt-out". See the Cookie Policy.

9. Data retention

Newsletter emails: until you unsubscribe or request deletion.
Google Analytics data: per Google defaults (currently 14 months for user-level data).
Consented browser campaign snapshot: up to 30 minutes in the current tab. If the optional server order-attribution feature is enabled, the allowlisted snapshot is retained with the order for up to 90 days and then cleared without deleting the order.
Server logs: 30 days, then aggregated or deleted.
Account profile, trial and subscription records: kept while the account or a legal/operational record remains active; you may request account deletion, subject to records we must retain.
Cat 3/4/5 order records: retained per Indian accounting law (7 financial years) for tax and audit purposes.
BeginRooms content: kept in the local browser copy and, when sync is enabled for the signed-in account, in the account service until you delete it or request account deletion, subject to backup and security-retention windows.
Optional BeginRooms Calendar and Tasks display caches: stored in this browser with no fixed automatic expiry; see connection storage and disconnect controls. These caches are separate from saved canvas content.

10. Children

BeginThings is not directed at children under 13. We do not knowingly collect personal information from children under 13. If we learn we have, we will delete it promptly.

11. International transfers

Our analytics provider (Google) processes data in the United States. Razorpay, our payment processor, processes payments in India and internationally where enabled. By using the site you consent to these transfers. Standard Contractual Clauses apply where required.

12. Changes to this policy

We may update this policy. The "Last updated" date at the top reflects the latest revision. Material changes will be highlighted on the homepage.

13. Contact

Questions? Email sourav@beginthings.com. Operator: Sourav Mahapatra, India.

Reddit campaign measurement for BeginRooms

When you choose Accept all and Global Privacy Control is not enabled, a BeginRooms Reddit campaign can store its campaign label, ad variant, Reddit click ID and arrival time in your browser for up to 30 days. After you sign in, we may link that consented source to your verified trial, account return days, a room-save revision signal and a server-verified first subscription payment. We do not inspect or send your board text, files, email, phone number or device IP address in these conversion events.

We send eligible signup and first-payment events to Reddit through its Conversions API, with the Reddit click ID, event time, an opaque conversion ID and, for purchases, the plan, INR amount and currency. This integration does not load Reddit browser scripts or scan private workspace contents. Events without a Reddit click ID are not sent to Reddit. Account-linked measurement records are encrypted in private server storage, expire after 30 days from the ad arrival, and are removed by a daily cleanup. Small suppression markers may remain until that expiry to honour withdrawal.

Choose Essential only in Cookie settings or enable Global Privacy Control to stop new measurement. On your next authenticated measurement request, pending account attribution is cleared across devices; events already processed by Reddit are not automatically retracted. For access or deletion requests, contact sourav@beginthings.com. Independent backups and operational records remain subject to their published retention policies.