Privacy Policy

1. The short version

Most ToolFlow tools run entirely in your browser. Files you open are read from your device, processed in memory and written back to your downloads folder. We do not operate an upload endpoint for documents, and we do not keep copies of your files.

We collect a small amount of aggregate technical data to keep the site working and to understand which tools are used. We do not sell personal data, and we do not build advertising profiles from the contents of your documents.

2. File processing

Browser tools (PDF, image, text, converters, calculators, developer utilities) use the File API and client-side libraries. The file bytes never leave the device unless a page explicitly says otherwise.

Live-data tools (IP lookup, domain and SSL lookups, market data, AI tools) send the specific query you enter — for example a hostname or a prompt — to the third-party service named on that page. They never send files unless the tool requires an upload, which is stated in the interface before you submit.

The API (api/v1) processes request bodies in memory to produce a response and discards them afterwards. We do not log request bodies. Aggregate call counts are stored per API key for quota enforcement.

3. Information we collect

Server logs: IP address, timestamp, requested path, status code, user agent and referrer. These are used for security, abuse prevention and aggregate traffic measurement, and are retained for up to 30 days.

Analytics: aggregated page views, tool usage counts and approximate country. We do not record the content you type into a tool.

Contact form: your name, email, topic and message, used only to respond to you.

API accounts: the email address you provide when requesting a key, the plan, and usage counters.

Cookies: a consent preference, a theme preference and, where enabled, analytics identifiers. See section 5.

4. How we use information

To operate and secure the site, including rate limiting and abuse prevention.

To understand which tools are useful so we can prioritise new ones.

To respond to support, privacy and feature requests.

To enforce API quotas and billing for paid plans.

We do not sell personal data and we do not use file contents for advertising, model training or profiling.

5. Cookies and local storage

Essential: a local storage entry recording your cookie choice and another recording light or dark theme. These are not used for tracking.

Analytics (optional): aggregate measurement cookies, loaded only after you accept the banner.

Advertising (where enabled): third-party advertising partners may set cookies on pages that display ads. Those partners operate under their own policies.

You can clear local storage at any time through your browser settings. Clearing it resets the theme and consent choice.

6. Analytics and advertising

Analytics are configured with IP anonymisation where the provider supports it, and with no cross-site behavioural profiles.

Advertising, if enabled in your region, is limited to clearly marked placements that do not cover the tool interface. We do not share your files, text or query content with advertisers.

Where required by law, personalised advertising is disabled until you provide consent.

7. Third-party services

Hosting and content delivery, for serving the site.

Public data providers for IP intelligence, DNS, certificate transparency, market prices and exchange rates.

AI providers, only for tools you explicitly run and only with the input you provide.

Payment processing for tips and API plans. Card details are handled by the payment provider and never reach our servers.

Each provider processes data under its own terms and privacy policy. A current list is available on request.

8. Legal bases and your rights

Where the GDPR applies, we rely on legitimate interests for security and aggregate analytics, consent for optional analytics and advertising cookies, and contract performance for API plans.

You may request access, correction, deletion or portability of the personal data we hold about you, and you may object to processing based on legitimate interests.

To exercise a right, email [email protected]. We respond within 30 days. You also have the right to complain to your local data protection authority.

California residents may request disclosure or deletion of personal information and may opt out of sale or sharing. We do not sell personal information.

9. Data retention

Server logs: up to 30 days.

Contact messages: up to 24 months, or until the request is resolved.

API usage counters: the current billing period plus 12 months for accounting.

Files and tool inputs: not retained, because they are never transmitted.

10. Children

The site is not directed at children under 13, and we do not knowingly collect personal data from them. If you believe a child has submitted personal information, contact us and we will delete it.

11. International transfers

Our hosting and service providers may process data in countries other than yours. Where required, transfers rely on standard contractual clauses or an equivalent mechanism.

12. Security

Traffic is served over HTTPS. Administrative access is limited, and API keys can be rotated or revoked. No system is perfectly secure, but keeping processing local removes a large class of risk: there is no stored document to breach.

13. Changes to this policy

We update this policy when the tools or the services behind them change. The date at the top of the page always reflects the current version. Material changes will be announced on the site.

14. Contact

Questions about this policy or a specific tool: [email protected]. We prefer specific questions — they get better answers.