Privacy Policy

Information you provide

• Account data — name and email address when you register.
• Communications — emails or messages you send to our support team.

Automatically collected information

• Usage data — pages visited, tools used, time spent, referring URLs.
• Device data — browser type, operating system, screen resolution, IP address.
• Log data — server logs including access timestamps and error reports.
• Tracked QR scan data — scan time, country code, and a one-way salted visitor hash used for approximate unique counts. Raw IP addresses and precise locations are not stored in QR analytics.

What stays on your device, and what does not

Most Toolorah tools do their work entirely in your browser: the text or file you give them is read into memory on your own device, processed there, and discarded when you close the tab. For those tools we hold nothing, because nothing was ever sent.

That is not true of every tool, and it would be misleading to state it as though it were. A small number of features have to open a connection in order to work at all — a currency converter cannot invent today's exchange rate, and a server API cannot process a document it has not received. The table below names every one of them and says exactly what leaves your device. Anything not listed here does not transmit your input.

Feature	What is sent	Where it goes	How long it is kept
Currency converter	A request for the day’s exchange rates. The amount you typed is not part of it — the conversion is done in the page after the rates arrive.	Toolorah	Not saved as converter history. Ordinary infrastructure logs may retain request metadata for security and reliability.
Crypto converter	A request for current coin prices. As above, the amount stays in the page.	Toolorah	Not saved as converter history. Ordinary infrastructure logs may retain request metadata for security and reliability.
Domain checker	The domain name you typed. There is no way to check availability without asking the registry.	Toolorah, which queries the public domain registry	Not saved as lookup history. Ordinary infrastructure logs and the registry may retain request metadata.
Word counter — thesaurus lookup only	The single word you look up. Counting, reading time, and every other statistic never leave the page; only pressing the thesaurus opens a connection.	api.datamuse.com (third party)	Governed by Datamuse, not by us.
QR generator — tracked codes only	The destination URL, plus a scan record (time, coarse location, device type) each time someone scans the code. An ordinary QR code is drawn in the page and sends nothing.	Toolorah	Until you delete the code.
PDF editor — choosing a font	A request for the font file itself. Your document is never part of it and never leaves the page.	cdn.jsdelivr.net (third party, Fontsource)	Governed by jsDelivr. The request reveals which font you picked and your IP address.
Image to text (OCR) — first use of a language	A request for that language’s trained data, a few megabytes, cached by your browser afterwards. Recognition itself runs in the page via WebAssembly; your image is never transmitted.	Public Tesseract data CDN (third party)	Governed by the CDN.
AI assistant and per-tool AI actions	The text you submit, plus the instruction you chose. Explicit and opt-in — no tool sends anything to a model unless you press an AI action.	Toolorah, which forwards it to our AI provider	Not stored as content by us beyond the request. Provider retention is governed by the provider.
Public API	Whatever you send it — by design. The documented endpoints accept text and base64-encoded PDFs, because a server API cannot work any other way.	Toolorah	Processed and discarded; request metadata is kept for quota accounting.
Accounts, saved history, team workspaces	Your email address and profile, and any result you explicitly choose to save.	Toolorah (Supabase)	Until you delete the item or your account.
Contact, support, and tool-request forms	The name, email address, subject, and message you submit, plus request metadata used to prevent abuse.	Toolorah (Supabase) and the configured transactional-email provider	Kept while the request is handled and as needed for support records, abuse prevention, and legal obligations.
Paid subscriptions (currently unavailable)	No billing or checkout data is collected while paid subscriptions are unavailable.	None	Not applicable.
Account, billing, newsletter, and lifecycle email	Your email address, the message template, delivery metadata, and subscription or suppression state.	Toolorah and the configured transactional-email provider	Delivery and suppression records are retained as needed to send requested mail and honour opt-outs.
Sign in with Google	The sign-in exchange itself, only if you choose that button rather than an email address and password.	Google	Governed by Google.
Advertising	Cookies, your IP address, and advertising identifiers, on pages that carry ads.	Google AdSense	Governed by Google.
Analytics	Page views and coarse referrer information. No tool input is included.	Vercel Analytics	Governed by Vercel.

Features marked as requiring an account only run when you are signed in and have chosen to use them; they are never triggered by simply opening a tool.

Tracked QR exception: when an account holder explicitly saves a tracked URL QR code, its destination and design settings are stored so the redirect and analytics can operate. Scan events remain until the owner deletes that QR code or account.

We use collected information to:

• Operate, maintain, and improve the website and tools.
• Create and manage user accounts.
• Send transactional emails (account confirmation, password reset).
• Send optional product update emails (you may unsubscribe at any time).
• Detect and prevent fraud, abuse, and security issues.
• Comply with legal obligations.
• Analyse aggregate, anonymised usage trends to improve the product.

We do not sell your personal information to third parties.

Your account data is stored on secure servers. We implement industry-standard technical and organisational measures — including encryption in transit (TLS) and at rest — to protect your personal information from unauthorised access, alteration, or destruction.

No method of transmission over the internet is 100% secure. While we strive to protect your personal information, we cannot guarantee its absolute security.

We retain your personal information for as long as your account is active or as needed to provide services. You may request deletion at any time (see Your Rights).

We use the following types of cookies and local storage:

You can clear browser storage at any time via your browser settings. Doing so will reset your theme and language preferences.

The service uses the following providers for the stated purposes. Each operates under its own privacy policy:

• Supabase — authentication, profiles, saved history, support records, team data, and service databases.
• Google — optional Google sign-in and AdSense on eligible pages. AdSense may use cookies and advertising identifiers subject to your region and consent settings.
• Vercel — application hosting, delivery logs, and aggregate site analytics.
• Groq or another configured OpenAI-compatible provider — processes text only when you explicitly submit an AI action. The active provider can change with the server configuration.
• Datamuse — receives the single word submitted through the word-counter thesaurus.
• jsDelivr and the public Tesseract data CDN — deliver optional PDF fonts and OCR language data; documents and images are not included in those asset requests.
• Configured transactional-email provider — delivers account, support, billing, newsletter, and lifecycle messages.

Paid subscriptions are not currently available. When billing launches, this policy will be updated with the payment provider and applicable terms.

We do not share personally identifiable information with advertisers.

Depending on your jurisdiction, you may have the right to:

• Access — request a copy of the personal data we hold about you.
• Rectification — request correction of inaccurate personal data.
• Erasure — request deletion of your personal data ("right to be forgotten").
• Portability — receive your data in a machine-readable format.
• Object — object to processing of your data for direct marketing.
• Withdraw consent — where processing is based on consent, withdraw it at any time.

To exercise any of these rights, email us at privacy@toolorah.com. We will respond within 30 days.

Our service is not directed to children under the age of 13. We do not knowingly collect personal information from children under 13. If you believe a child under 13 has provided us with personal information, please contact us immediately and we will delete it.

We may update this Privacy Policy from time to time. We will notify you of any material changes by posting the new policy on this page and updating the "Last updated" date. Continued use of our service after changes constitutes acceptance of the new policy.

If you have questions about this Privacy Policy or our data practices, please contact us:

Toolorah
Email: privacy@toolorah.com
Website: toolorah.com