Privacy Policy

Last updated: May 10, 2026

This Privacy Policy describes how Toolsy ("we", "us", "Toolsy") collects, uses, and shares information when you visit toolsy.website (the "Service"). We have written it in plain language; technical or legal terms are explained inline.

By using the Service you agree to the practices described here. If you do not agree, please stop using the Service.

1. What we collect

You do not create an account on Toolsy. We never ask for your name, email address, phone number, billing details, or any other personally identifying information.

When you visit a page, our server automatically records:

the URL path you visited (e.g. /tools/json-formatter)
the HTTP method, response code, and time the response took
your browser family and operating system family (e.g. "Chrome on Windows"), derived from the standard User-Agent header
your country, when our hosting provider exposes it (no precise location)
the referring website's host (e.g. google.com) — never the full URL or any query parameters
a one-way hash of your IP address, salted with a value that we rotate every 24 hours, so two visits from the same network on different days cannot be linked

Your raw IP address is never written to disk and never stored beyond the duration of a single HTTP request.

2. Inputs you type into tools

Many Toolsy tools (JSON formatter, base64, hash generator, AES encryption, etc.) work entirely in your browser using JavaScript — your input never leaves your device.

Some tools that require server-side libraries (SQL formatter, YAML formatter, image-to-base64, RSA key generation, bcrypt hashing, TOTP) send your input to our server over HTTPS. In those cases the input is held only in memory for the duration of the request, used to compute the response, and then discarded. We do not log, persist, or analyze the contents of tool inputs.

3. Cookies and local storage

Toolsy itself uses one piece of browser storage:

toolsy-theme (localStorage): stores your theme preference — "light", "dark", or "system". Set only when you change it. Used only on your device. You can clear it any time from your browser settings.

If you sign in to the admin dashboard at /admin (for staff only), a separate HTTP-only authentication cookie called toolsy_admin is set for 24 hours. Regular visitors never receive this cookie.

Toolsy does not use Google Analytics or any other tracking library on the visitor side.

4. Advertising — Google AdSense

Toolsy is supported by advertising served through Google AdSense, a service provided by Google LLC ("Google"). To deliver and measure ads, Google and its partners use cookies and similar technologies (including third-party cookies such as the DoubleClick DART cookie).

These cookies enable Google and its partners to:

show ads on Toolsy and on other websites you visit
measure ad performance (impressions, clicks, attribution)
prevent fraud and abuse
in some cases, personalize ads based on your previous visits to this site or other sites

Google's use of advertising cookies is governed by its own policies, which you can read at:

Opting out of personalized advertising. You can disable personalized ads from Google at adssettings.google.com. You can also opt out of third-party vendors' use of cookies for personalized advertising by visiting optout.aboutads.info or, for EU users, youronlinechoices.eu.

When opted out, you'll still see ads — they just won't be personalized to your previous browsing.

5. Third-party content and services

In addition to Google AdSense, the Service may load:

Fonts and CSS from Google Fonts and cdnjs (Cloudflare) — these providers receive your IP address and the page URL when serving the request, governed by their own privacy policies
JavaScript libraries on demand from cdnjs (CodeMirror for the HTML editor, crypto-js for the AES tool) — same data flow as fonts

We do not embed social media widgets, comment platforms, or visitor-side chat tools.

6. Children's privacy

Toolsy is a developer-utility site and is not directed at children under 13. We do not knowingly collect personal information from children. If a parent or guardian believes that a child has shared information with us, please contact hello@toolsy.website and we will delete any associated logged data.

7. Your rights

Depending on where you live, you may have rights including: access, correction, deletion, restriction of processing, objection to processing, and data portability. Because Toolsy holds no identifying information about you, most requests are effectively non-applicable — we have nothing to correct or hand over.

EU/EEA and UK residents: see the dedicated GDPR page for details specific to your rights under EU and UK data protection law.

8. Data retention

Server analytics logs (the hashed-IP records described in section 1) are retained for a maximum of 90 days, after which they are deleted automatically. Aggregate statistics derived from those logs (e.g. "10,000 visits in May") may be kept indefinitely; aggregates contain no individually identifiable information.

Tool input data sent to the server is held only for the duration of a single HTTP request, then discarded.

9. Security

All traffic to and from Toolsy is encrypted with TLS (HTTPS). The server runs on managed serverless infrastructure with regular security patching. While no system can guarantee absolute security, we follow standard industry practices and limit data collection precisely so there is little to leak in the first place.

10. Changes to this policy

We may update this Privacy Policy from time to time. When we do, we'll change the "Last updated" date at the top. Significant changes will be announced via a notice on the homepage. Continued use of the Service after a change indicates acceptance of the updated policy.

11. Contact

Questions, comments, or data requests: hello@toolsy.website. We will respond within 30 days.