Skip to content

Privacy Policy

Last updated: August 2026

Our Commitment

At Toolsda, we are committed to protecting your privacy. This page is the honest, current account of what we collect, what a third party (our ad network) collects, and why — not a marketing claim. If any other page on this site ever seems to say something different, this page wins.

How Toolsda Stays Free

Every tool is free and unlimited — no account, no usage cap, no signup wall. We run ads outside the tool workbench to pay for it (never beside your input, never on a tool that runs entirely in your browser). Signing in — free, email or Google — is entirely optional: it saves your Online Notepad history, syncs favorites across devices, and is how we verify Pro. The tool itself never gets more or less capable based on whether you're signed in. Past a generous amount of use in one day, we may show a small, dismissible reminder that an account exists — see “Cookies” below — but it never blocks anything. Abuse is handled by IP-based rate limits and a bot check (Turnstile) on the few tools that call our server, not by requiring an account. That is the whole business model: no subscriptions, no paywalled features.

First-Party vs. Third-Party

This is the distinction that matters, and we'd rather spell it out than let “no trackers” do the work of a sentence that isn't true anymore:

  • First-party (us, Toolsda, running on Cloudflare): our own usage measurement — tool_events and tool_visitors — described in full below. Cookieless, never an IP address, never what you typed. (The separate free-use counter is different and does use one cookie — see “Cookies” below.)
  • Third-party (not us): the ad network. Ads sit outside the workbench and are served by a domain other than toolsda.com. We're building toward contextual, cookieless ad placements (keyed on the page you're on, not on you or your browsing history) rather than behaviourally-targeted ones, but a third-party network is still a third party — it can set its own cookies and run its own tracking for ad delivery, and we don't control that the way we control our own code. If that changes once a specific provider is live, this section is the place we'll say so.

One implementation note, for anyone checking: lib/analytics.ts's track() function — our own measurement — only ever calls our own /api/events endpoint. It has no code path to any third party. The ad network is a separate integration that doesn't go through it.

Cookies

We set exactly one cookie of our own: sbai_anon. It holds a random id with no personal information in it — not your name, email, or IP address — and it exists for one narrow purpose: counting how many tools a signed-out visitor has used today, across page reloads, without double-counting (or under-counting) the way an IP address alone turned out to allow, since an IP can look different from one request to the next for the same browser. That count only ever drives a small, dismissible on-page reminder that an account exists, once it passes about 15 tools in a day — it never limits or blocks a tool. It is first-party — set by toolsda.com, sent only to toolsda.com, never to the ad network or any other third party — and it is never combined with anything you type into a tool or used to track you on any other site. It lasts up to 400 days (the longest a browser will honor) or until you clear cookies, whichever comes first. Signing in makes it irrelevant: you never see the reminder, and nothing about your account depends on it.

That is the only cookie referenced anywhere on this page. If a future feature ever adds another, this section is the place we'll say so — see “Our Commitment” above.

What We Never Collect

  • Beyond the one functional cookie described above, we set nothing else, and we do not track you across other websites
  • We never transmit what you type into a tool — your inputs stay in your browser for the tools that say so on their own page
  • We do not sell or share your data with anyone
  • We do not run Google Analytics, an advertising pixel, or any third-party script of our own choosing on this site — the one exception, described above, is the ad network itself

IP Addresses: What We Store, and Why

An IP address touches a few different tables, for different, narrow reasons. None of them is “we track where you go” — all of them are abuse prevention or a rate limit, and all of them are bounded in time:

  • usage_tracking — the WhatsApp Scam Detector's own daily cap on AI-assisted checks (a real cost, not an anti-abuse measure) is IP-based here for signed-out visitors (stored as anon_<ip>). Signing in does not raise this cap — only Pro does. The site-wide daily-use counter behind the optional-account reminder (“Cookies” above) keys on the sbai_anon cookie instead (stored as anon_<cookie id>) since an IP address isn't a stable way to recognize the same visitor twice. Deleted automatically after 180 days.
  • login_attempts.ip — brute-force protection on password login (lockout after repeated failures). Deleted automatically after 1 day.
  • secrets.created_ip — abuse prevention on the Secret Sharing tool. Deleted with the secret itself, at expiry or max-views.
  • suggestions.ip_hash / suggestion_votes.ip_hash — not a raw IP: a one-way hash, used only to rate-limit and de-duplicate votes on the public “Suggest a Skill” board.

Outside of those tables, we do not store your IP address, and none of them is used to build a profile of you or link your activity across tools.

Usage Measurement (First-Party)

We measure how our tools are used so we know which ones are worth improving and what to build next. This measurement is first-party and cookieless — it runs entirely on Cloudflare, our own hosting provider, through our own /api/events endpoint only.

What Is Measured

  • Which tool page was opened, and which part of the site you reached it from
  • Whether a tool was actually used, as a plain action count - never the input or the result
  • Whether the visitor was signed in or anonymous, without recording who
  • Approximate device type (mobile, tablet, or desktop) and country

What Is Never Measured

Your tool inputs never leave your browser for any tool that says so on its own page. Measurements record that a calculation happened, never what was calculated - no weights or heights, no salary or loan figures, no pasted text, no message content, no uploaded files, and no search terms.

How Visitors Are Counted

To count visitors without identifying anyone, we set no cookie and store nothing on your device. Instead we derive a temporary, non-reversible identifier from a secret that rotates every day. It lets us count today's visitors once each, and it cannot be linked back to you, to your activity on any other day, or to your account.

Ads

Ad slots are placed outside every tool's control panel and result panel, never beside your input, and are labelled “Ad” wherever they appear. They are a third party — see “First-Party vs. Third-Party” above for what that means in practice. If you'd rather not have ads track you at all, your browser's or extension's ad/tracker blocking works normally here; blocking ads does not block or degrade any tool.

Data Storage

All data is stored securely in Cloudflare D1, with rate limits and validation applied to every write. Secrets are automatically deleted after expiry or max views.

Your Rights

These are buttons, not promises you have to email us to collect. If you have an account, all three live in Profile → Account → Your data, and none of them needs our approval or a waiting period.

  • Access and export. “Download your data” gives you a JSON file containing every row we store against your account — the account itself, your sign-in sessions, your per-tool usage counts, anything you submitted to the Suggest a Skill board or the scam reporter, and any Pro payment record. The file also lists, in plain words, what is not in it and why.
  • Sign out everywhere. Ends every signed-in session on every device, including the one you press it on — for a laptop you no longer have, or a session you left open somewhere you shouldn't have.
  • Deletion. “Delete your account” removes your account row, your sessions, your usage history, your login records, any pending email codes, and any Pro payment record. It happens immediately and cannot be undone — we do not keep a hidden copy behind a “deleted” flag. You confirm with your password, or by typing your email address if you sign in with Google only.

The one thing deletion does not erase, because we would rather say it than let the word “delete” quietly cover it: scam reports and Suggest a Skill posts stay published, with your name and email stripped off them. Both are contributions to something shared — a scam warning other visitors read, a board post carrying other people's votes — and what is personal about them is the link to you, which is what gets removed. If you want the content itself taken down as well, email us and we will do it.

What we hold about you without an account is covered above: it is either an IP address in one of the short-lived abuse tables, or a first-party cookie you can clear in your own browser. There is no anonymous profile to request, because there isn't one.

Anything these buttons don't cover — a question about how we use your data, a correction, or a takedown — goes to [email protected], and we'll answer within 30 days.

Contact

Questions about privacy? Contact us at [email protected]