Privacy Policy

ToolsBag is designed to be private by default. Every tool runs without an account, and the files you process are never kept. This page explains exactly what is and is not stored.

Your files

The files you upload — labels, PDFs, spreadsheets, images — are sent to our server, processed to produce your output, and discarded. They are not written to a database, not kept after your download, not used to train anything, and not shared with any third party. Nothing about a file's contents is logged.

Using the tools without an account

You do not need to sign up to use any tool on this site, and we do not ask you to. If you never create an account and never leave a review, we hold no personal information about you at all.

Accounts

If you choose to create an account, we store your email address and a name if you give one. You can sign in either with a password or with Google.

If you set a password, it is never stored in readable form. Passwords are hashed with Argon2id, a one-way function: we cannot recover your password, and neither could anyone who obtained a copy of our database.

Your email address is used to confirm the address is yours, to let you reset a forgotten password, and to contact you about your account if something goes wrong. It is not used for marketing and is not sold, rented, or shared.

Signing in with Google

If you use “Continue with Google”, Google tells us four things: an identifier that is unique to your Google account, your email address, whether Google has verified that the address is yours, and your name. We store those to create your account and to recognise you when you come back. The first time you sign in this way is the sign-up — there is no separate registration step.

We never see your Google password, and we ask for no access to anything else in your Google account — not Gmail, not Drive, not your contacts or calendar. If you only ever sign in this way, we hold no password for you at all.

Google will have its own record that you signed in here, which is governed by Google's privacy policy rather than this one. You can review and revoke that access at any time in your Google account's security settings — though doing so does not by itself delete the account you hold with us.

Deleting your account

There is currently no button for this. Email us at itplanet99@gmail.com from the address on the account and we will delete it, along with the sessions and any Google link attached to it. Reviews you have left and any tool suggestions you sent — including a phone number given with one — are removed with it.

Staying signed in

Signing in sets one cookie. It contains a random value with no meaning outside this site, is marked HttpOnlyso no script on the page can read it, and it is not an advertising or tracking cookie. Alongside it we record when the session was last used, your browser's user-agent string, and a hashed form of your IP address — enough to spot suspicious sign-ins and to show you your own active sessions, but not reversible into an address. Signing out ends the session immediately.

Ratings and reviews

You can rate a tool without an account. When you do, we store your star rating, any words you write, the name you choose to show (blank means Anonymous), a hashed form of your IP address, and a random identifier saved in your browser.

That browser identifier is created only when you actually leave a rating — not when you simply visit — and its only purpose is to recognise that a later rating for the same tool is you changing your mind rather than a second vote. It is not used for advertising and is not shared. Clearing your browser data removes it, after which you will no longer be able to edit a review you left.

Reviews are public: the rating, the text and the displayed name are visible to anyone. Please do not put anything private in one. We may hide a review that is abusive, off-topic or spam.

Suggesting a tool

If you ask us to build a tool, we store what you wrote and a link to your account. Suggesting requires signing in, for one reason: so that we can reply to you about it.

You may also give a phone number. It is optional — leave it blank and everything still works. If you do give one, it is used only to contact you about that suggestion. It is never shown publicly, never used for marketing, and never sold or shared. Only staff who need it to reply can see it, and it is deleted along with the suggestion or with your account.

To have a number removed without deleting your account, email us and say so — the address is at the bottom of this page.

What's stored in your browser

Beyond the sign-in cookie described above, the app saves a small amount of data in your browser's local storage: your chosen theme, the backend address, and — only if you have rated something — the review identifier above. This stays on your device and can be cleared at any time from your browser settings.

Analytics & cookies

Your files are never used for analytics. To understand how the tools are used, we may load Google Analytics — but only after you accept in the cookie banner. If you decline, or before you choose, no analytics scripts or cookies are loaded. Google Analytics collects anonymised usage data (such as pages visited and general location) and is governed by Google's own privacy policy. You can change your choice any time by clearing this site's data in your browser.

Separately, our own server keeps a count of how the tools perform — which tool was used, whether it succeeded, how long it took, how large the upload was, and whether the request came from a phone, tablet or desktop. This is how we find out that something is broken, which the analytics above cannot tell us.

It records nothing that identifies you: no IP address, no account, no cookie, no filename and nothing from inside a file. Error messages are stripped of quoted text before they are stored, precisely so a filename cannot end up in them. The device is kept only as one of a handful of words — we do not store the browser identification string it came from. Because none of it can be traced to a person, it is collected whether or not you accept the cookie banner, and there is nothing in it to delete on request.

Advertising

ToolsBag shows a banner in the window that appears once your file is ready. These are our own ads, chosen by us — there is no ad network, no bidding on you, and nothing about you is used to decide which one you see. We count how many times each banner was shown and how many times it was clicked. Those are totals for the banner, not records about the person: no account, no cookie, no IP address, nothing that could be traced back to you.

A banner may be an image or a video we host, and it may be a video embedded from YouTube. A YouTube embed loads from Google's servers, which means Google receives your IP address and may set its own cookies — this happens whether or not you accepted the cookie banner, and is governed by Google's privacy policy rather than this one. We use the youtube-nocookie address, which limits what is stored, but it is still a request to Google. Blocking third-party content in your browser stops it.

The part of a tool page where your file is processed carries no advertising.

How long we keep things

Uploaded files are discarded as soon as your output is produced. Sign-in sessions expire after 30 days of inactivity. Email confirmation links last 24 hours and password reset links one hour, and both stop working once used. Account details, reviews and any tool suggestions — including a phone number given with one — are kept until you ask us to remove them.

Your rights

Under India's Digital Personal Data Protection Act, 2023, you can ask us to show you the personal data we hold about you, correct anything inaccurate, or delete your account and its data. Deleting an account removes its reviews and tool suggestions with it, including any phone number. Write to itplanet99@gmail.com and we will respond within 30 days. If you are not satisfied with how we have handled a request, you may raise the matter with the Data Protection Board of India.

Children

These are business tools and are not directed at children. Please do not create an account if you are under 18.

Running your own copy

ToolsBag can also be self-hosted. If you are running your own backend, this policy describes the version hosted here — any logging, retention or security on a server you operate is governed by how you configure it.

Changes to this policy

If what we collect changes, we will update this page and the date at the top. For anything significant, we will tell account holders by email.

Contact

Questions about privacy, or a request about your data: itplanet99@gmail.com.