Privacy Policy

1. Who we are

This policy covers the website ToolStash at https://toolstash.tech ("the site", "we", "us"). It explains what information is and is not collected when you use the site, who else receives information, and what you can do about it. Questions go tohello@toolstash.tech.

2. Your files and content are not collected

This is the most important section, so it comes first. Every tool on this site runs client-side: the processing is done by your browser, using JavaScript and WebAssembly that was downloaded to your device along with the page.

When you select a file or type text into a tool:

• The data is read into your browser's memory on your own device.
• The work (merging, compressing, converting, counting, hashing) happens there, in the browser tab.
• Any output file is generated locally by your browser and saved by your normal download mechanism.
• The file's contents and its name are never transmitted to us, at any point. Closing the tab discards them.
• Its size and file type are the one exception: those two numbers are included in the anonymous usage telemetry described in section 7, because knowing that failures cluster around large inputs is how we fix them. Neither reveals anything about the content.

We therefore have no copies of your documents, no way to recover them, and no retention period to disclose for them, because there is nothing being retained. This applies to every tool, with the one future exception described in section 8.

3. Information collected automatically

Loading any web page necessarily reveals some technical information to whoever serves it. Our hosting and content-delivery provider records standard server log data, including:

• your IP address;
• the date and time of the request and which page or asset was requested;
• your browser type and version, operating system and device type;
• the referring page, if you arrived from a link elsewhere.

This data is used to serve the site, keep it available, and detect abuse such as automated scraping or denial-of-service attempts. It is not used to build a profile of you, and it is not combined with anything you do inside a tool, since nothing you do inside a tool reaches us.

4. Cookies and similar technologies

We do not set cookies of our own for tracking, and the site does not require cookies to function. Cookies present on the site come from third parties, principally our advertising partners, described in section 5.

Some tools may use your browser's localStorage to remember a preference, a setting you last chose, for instance. That data stays on your device, is not transmitted anywhere, and can be cleared through your browser's "clear site data" control.

5. Advertising

The site is free to use and is funded by advertising. Ads are supplied by third-party networks, which means those networks (not us) receive certain information about your visit and may set cookies or similar identifiers on your device.

Current advertising partner

We currently serve advertising through Adsterra. When an ad loads, Adsterra and its own advertising partners may collect your IP address, device and browser information, the page you are on, and interaction data such as whether an ad was viewed or clicked. They may use cookies, web beacons and similar technologies to measure performance and limit how often you see the same ad. Their handling of that data is governed by their own privacy policy, which we do not control.

Planned advertising partner

We intend to also serve advertising through Google AdSense. When that happens, the following will apply and this policy will be updated with the date of the change:

• Google, as a third-party vendor, uses cookies to serve ads on this site. Google's use of advertising cookies enables it and its partners to serve ads to you based on your visit to this site and other sites on the internet.
• Third-party vendors and ad networks, including Google, may serve ads on this site and may use cookies to serve ads based on a user's prior visits to this website.
• You can opt out of personalised advertising by visitingGoogle Ads Settings.
• You can opt out of a third-party vendor's use of cookies for personalised advertising ataboutads.info or the NAI opt-out page.

Users in the European Economic Area, the United Kingdom and Switzerland will be shown a consent notice before non-essential advertising cookies are set, and can change or withdraw that choice at any time.

Note that ad networks receive information about your visit to the page. They do not and cannot receive the contents of a file you process, because that content never leaves your device and is never part of any network request.

6. Analytics and third-party requests from tools

We use Cloudflare Web Analytics to count visits. It is the only measurement product on the site, and it was chosen specifically because of what it does not do: it sets no cookies, stores no IP addresses, and does not fingerprint your device or browser. There is no identifier that follows you between visits, so we cannot tell a returning visitor from a new one, and we cannot link your activity across devices.

What it records, per page view:

• the page you viewed, and the referring page or search engine if there was one;
• a country, derived from your IP address at the edge and then discarded (the address itself is not stored);
• coarse device information: browser, operating system, and desktop or mobile;
• page loading performance, so we can tell when the site has become slow.

In practice this means two requests to Cloudflare rather than to us: your browser downloads a small script from static.cloudflareinsights.com, and that script then sends one measurement to cloudflareinsights.com recording the page you were on. Both are visible in your browser's Network tab, and neither carries anything about the files you process. The measurement happens at the page level and knows nothing about what a tool is doing.

It cannot see your files or what you do with them. Separately from it, we record a small amount of usage telemetry about the tools themselves, described below.

7. Tool usage telemetry

Page counting tells us nothing about whether the tools actually work. So when you run one, your browser sends us a few numbers about the operation, never about the file. This is our own measurement, stored on Cloudflare infrastructure we control, and it is not shared with anyone.

What is sent, per operation:

• which tool it was, as its address on this site, for examplecompress-pdf;
• what happened: the operation started, succeeded, failed, or a result was downloaded;
• how long it took in your browser. There is no server doing the work, so this measures your own device;
• the input's size in bytes and its file type, such as application/pdf;
• for a failure, a fixed category label such as encrypted_pdf orcorrupt_pdf, chosen from a short list. The underlying error message is never transmitted, because some of our messages mention the filename;
• a random identifier for the browser tab, so we can tell that one visit's "started" and "succeeded" belong together.

What is never sent: the filename, the file, any part of its contents, any text you type, or anything that identifies you. Filenames are excluded deliberately: people name files after themselves, their employer, their case number or their diagnosis, and a filename is often more revealing than the document.

The tab identifier is not a visitor identifier. It is random, generated in your browser, stored only in that tab's session storage, and destroyed when you close the tab. Opening ToolStash again produces a new one. It cannot connect two visits, cannot follow you to another site, and is not derived from anything about you or your device. No cookie is set.

It is optional in practice. If your browser sends a Do Not Track or Global Privacy Control signal, nothing is sent at all. Blocking the request changes nothing about how the tools behave. Telemetry is not allowed to be a dependency, and every tool works normally when it fails.

Retention: these records are deleted automatically 90 days after they are written. There is nothing in them to connect to you either before or after that.

8. An exception we have not built yet

One planned tool is a genuine exception to the rule that your file stays on your device: a currency converter needs current exchange rates, which must be fetched from an external rate provider over the internet. That request contains only the request for rate data. It carries no information about you beyond what any web request necessarily reveals to the provider, such as your IP address. The tool's page will state this plainly. No other tool sends anything about your input while you use it.

9. What we do not do

• We do not sell personal information.
• We do not rent or trade contact lists. We do not have one.
• We do not ask you to create an account or verify an email address.
• We do not attempt to identify individual visitors or link visits across devices.
• We do not read, scan, index or retain the contents of anything you process. It is not technically possible for us to do so given how the tools are built.

10. Legal bases for processing (UK and EU visitors)

Where the UK GDPR or EU GDPR applies, we rely on the following legal bases:

• Legitimate interests for the server log data described in section 3, which is needed to deliver the site securely and reliably.
• Consent for non-essential advertising and any future analytics cookies. Where consent is required, you will be asked before those cookies are set, and you may withdraw it at any time.

11. Your rights

Depending on where you live, you may have the right to access the personal data held about you, to have it corrected or deleted, to object to or restrict its processing, to withdraw consent, and to data portability. Residents of California have rights under the CCPA and CPRA, including the right to know what is collected, the right to deletion, and the right to opt out of the sale or sharing of personal information. We do not sell personal information; advertising partners' use of cookies may constitute "sharing" for targeted advertising under some state laws, and the opt-out links in section 5 are the way to exercise that choice.

To make a request, email hello@toolstash.tech. Please be aware of a practical limitation: because we do not operate accounts and hold no identifiers linking you to a visit, we usually cannot locate data relating to a specific individual, and we cannot verify a claim to it. For data held by advertising partners, those requests need to go to the partner directly, and we will point you to the right contact if you ask.

12. Data retention

We retain no user files or tool content, because none is ever received. The tool usage telemetry in section 7 is deleted automatically 90 days after it is written. Server log data held by our hosting provider is retained for a limited period for security and operational purposes, typically measured in weeks, and then deleted or aggregated. Retention of advertising data is determined by the relevant advertising partner under its own policy.

13. International transfers

The site is served from a global content-delivery network, so the server responding to you may be in a different country from you. Our hosting and advertising partners operate internationally and may process the technical data described above in the United States or elsewhere, under the transfer mechanisms set out in their own policies.

14. Security

The site is served over HTTPS. The strongest security property here is structural rather than procedural: the sensitive material (your documents) is never transmitted or stored, so it cannot be exposed by a breach of our infrastructure. It remains your responsibility to keep your own device and browser secure, since that is where the processing happens.

15. Children's privacy

The site is not directed at children under 13, and we do not knowingly collect personal information from them. Since no account or personal detail is required to use any tool, we do not knowingly hold such information about anyone. If you believe a child has provided personal information to us, contact us and we will investigate and delete anything found.

16. Links to other sites

Advertisements and occasional editorial links lead to sites we do not operate. We are not responsible for their content or privacy practices. Check the privacy policy of any site you visit from here.

17. Changes to this policy

We will update this page when our practices change, in particular when Google AdSense is added, or if analytics is ever introduced. The "last updated" date at the top always reflects the current version. Material changes will be flagged on the site itself rather than only in this file.

18. Contact

For privacy questions or to exercise a right described above, emailhello@toolstash.tech. See also ourterms of service and the about page, which explains how the client-side architecture works in more detail.