Privacy Policy

Last updated: August 2026. This policy describes how Toolbies (https://www.toolbies.com and related clients) processes information. It reflects our registry-driven privacy classes and infrastructure described in our architecture documentation.

Who this applies to

This policy covers visitors and users of the public website, mobile apps, and browser extension. Basic tools work without creating an account. Optional signed-in features, when offered, may process additional account data as described at sign-in.

Data controller

Toolbies is operated by Arjun Dhibar, an individual based in West Bengal, India. For privacy requests, contact contact@toolbies.com. A registered postal address for formal legal notices will be published on this page when finalized. Until then, email contact@toolbies.com.

Processing classes

Each tool declares how your input is processed. The applicable class is shown on the tool page.

  • Local tools — input stays on your device. Nothing is uploaded for processing.
  • Temporary server tools — files are uploaded to private object storage (Cloudflare R2), processed in isolated workers or approved heavy-compute paths, and deleted per our retention schedule below. File bodies are not stored in our PostgreSQL database.
  • External provider tools — content may be sent to a named third-party AI or media provider (for example, an OpenAI-compatible API configured server-side). The tool page discloses this before processing.

Data categories and purposes

Depending on how you use Toolbies, we may process:

  • Tool inputs and outputs — text, files, or media you submit to run a tool, only for the duration and path required by that tool's privacy class.
  • Operational metadata — anonymized job and request identifiers, job status, size buckets, error codes, timing, and queue metrics for reliability and abuse prevention.
  • Product analytics — privacy-conscious events such as tool views, execution success/failure, and category views. Events include tool identifiers and timing, not file contents, prompts, or search query text.
  • Security and abuse signals — metadata needed to enforce rate limits, block abuse, and investigate incidents, without logging uploaded private content by default.
  • Support and privacy communications — information you choose to send when contacting us (see Contact).
  • Account and admin data (when applicable) — if you use optional sign-in or admin features, we may process account identifiers, session data, and audit records needed to operate those features.

Retention

Default anonymous temporary processing (from our security baseline):

  • Successful uploads and results — deleted within about one hour after processing completes.
  • Failed or abandoned temporary objects — removed by object-storage lifecycle rules within 24 hours (safety net for incomplete uploads and working files).
  • Anonymous job operational metadata — targeted for about 24 hours unless a longer period is needed for security or operability.
  • Security and abuse logs — up to 30 days when justified, without uploaded private file contents.

Longer retention requires an explicit product feature and privacy review. Persistent cloud file history is not part of the default anonymous tool experience.

Third-party processors and infrastructure

We use service providers to host and operate Toolbies. Depending on the tool and path, this may include:

  • Cloudflare — DNS, CDN, WAF, Workers, Queues, R2 object storage, and related edge services for public delivery and temporary file processing.
  • Neon PostgreSQL — control-plane database for registry, job state, admin, and business metadata. Uploaded file bodies are not stored here.
  • AI inference providers — when you use an external-provider AI tool, prompts and related content are sent to our configured server-side provider (default OpenAI-compatible API endpoint). Provider credentials stay on servers, not in client apps.
  • Error monitoring — browser error monitoring (Sentry-class) is not enabled in the current production web deployment. If enabled later, it may receive stack traces and request metadata with sensitive headers stripped.
  • Heavy compute runtime — isolated container workers for native media/PDF operations when a tool requires it.

Each tool page identifies when content leaves your device and which class applies. Hybrid tools disclose all possible paths.

International transfers

Toolbies is operated from India. Our infrastructure providers (including Cloudflare and Neon) and configured AI providers may process data in multiple countries. Cross-border transfer safeguards depend on applicable law. Contact contact@toolbies.com for questions about transfer safeguards.

Your privacy rights and requests

Depending on where you live, you may have rights to access, correct, delete, or restrict certain processing of personal information, or to object to some processing.

  • Email contact@toolbies.com with “Privacy request” in the subject line and enough detail for us to verify and respond.
  • For anonymous tool use, we may have limited ability to identify records beyond short-lived job or request metadata. Include any job ID, approximate time, and tool URL if you need help locating operational data.
  • If you use optional account features, additional access, export, or deletion workflows may apply as described at sign-in.

We do not sell personal information. We do not use uploaded file contents for advertising profiling.

Security

Our security baseline includes, among other measures:

  • Private object storage with short-lived presigned upload and download URLs.
  • Validation of file types, size limits, and untrusted input handling in workers.
  • Isolated processing for server jobs with timeouts, resource limits, and per-job cleanup.
  • No provider secrets in web, mobile, or extension client bundles.
  • Responsible disclosure channel via contact@toolbies.com and security.txt.

Children

Toolbies is a general-audience utility platform. We do not intentionally design advertising, analytics, or profiling around knowingly identified children. Any future child-directed experience requires a separate privacy and product review before launch.

What we do not do

  • Store uploaded file bodies in our PostgreSQL database.
  • Log file contents, extracted private document text, or raw AI prompts by default.
  • Sell personal information.

Analytics and cookies

We collect privacy-conscious product analytics as described above. See our Cookie Policy for cookies, browser storage, and consent details where applicable.

Policy changes

We may update this policy to reflect product, infrastructure, or legal changes. We will revise the “Last updated” date and post the new version on this page. Material changes may also be communicated through the product or support channels when appropriate.

Contact

Privacy questions: contact@toolbies.com. See Contact & Support for other channels.