Skip to main content
Toolzum
Privacy & Security

Privacy Policy

Last Updated: November 14, 2026

Privacy by Architecture, Not Policy

Your files never leave your device.

Unlike traditional services that upload your documents to cloud servers and promise to delete them later, Toolzum never sends your files to our servers for local tools. Most tools load, process, and output data entirely within your browser's memory via WebAssembly. A small number of AI-powered and cloud tools do send your input to our server, which forwards it to one of our AI providers (Google Gemini, Anthropic, or Cloudflare Workers AI, depending on the feature) — these tools are clearly marked on every tool page, and your file is never stored by us.

No File Logs for Local Tools

We do not see or retain your upload strings, documents, or image pixels.

Client-Side State Only

Application states and preferences are cached locally inside IndexedDB.

Offline Isolation

All compiled WebAssembly operations execute without sending outbound API pings.

1. Introduction

Welcome to Toolzum. We value the privacy of our visitors and users above all else. This Privacy Policy details our infrastructure configuration and absolute client-side isolation architecture.

By using Toolzum (the "Service"), you accept that all files, images, code, and calculation strings are processed directly inside your device's web browser, and agree to the storage guidelines listed below.

2. Client-Side Processing Pledge

Our Core Philosophy is simple: We do not upload your media to our servers.

Traditional utility sites transmit user documents to backend queues to run formatting scripts. Toolzum compiles C++ libraries and JavaScript tools into WebAssembly binaries that execute locally inside a sandboxed client thread.

For the majority of tools, your files (such as confidential business PDFs, identification files, or private photo pixels) never exit your device to traverse the internet. A small number of AI and cloud tools are the exception: your input is sent to our server, which forwards it to our AI provider (Google Gemini) for processing and returns the result. These tools are clearly marked so you always know what happens with your data, and we do not store your file content — only anonymous credit/quota accounting.

3. Information We Collect

Because local-tool processing operations occur in your browser, our servers never receive:

  • Files uploaded to converters, PDF compressors, or image editors (local tools).
  • Content, text strings, or inputs entered into developer calculators or humanizers (local tools).
  • Cryptographic hashes, passwords, or secure notes generated locally.

What our servers do receive and store:

  • Page-view telemetry — visited path, viewport size, and client type, sent to our first-party /api/analytics endpoint and stored in our database (no cookies; IP addresses are used only for rate-limiting and never stored alongside page views; disabled when you choose Decline in the consent banner).
  • Error reports — error message, stack trace, tool name, page path, and user-agent string, stored to diagnose crashes. Error text can occasionally contain fragments of what the page was doing — never file contents.
  • Zero-result search terms — only searches that match no tool, truncated, used to improve search synonyms.
  • Quota identifiers — a salted hash of basic browser attributes (user-agent, screen size, language, timezone) used solely to enforce anonymous download/usage limits. It cannot identify you and is never joined to account data.
  • AI/cloud tool inputs — prompts, text, or audio you submit to a marked AI or cloud tool transit our server to our AI provider (Google Gemini). We log only anonymous credit/quota accounting, not your content.
  • Account data (signed-in users only) — email, plan, AI credit balance, favorites, and session tokens.
  • Review emails (optional) — if you leave an email with a homepage review, we store it only to notify you when it goes live. Never displayed, never listed, never shared.

We also run Cloudflare Web Analytics (cookieless, aggregate page metrics) and, unless you Decline, third-party analytics: page-view analytics and session insights (heatmaps and session replays). See our Cookie Policy for details and controls.

4. Cookies and Session Memory

Toolzum utilizes browser storage mechanisms (LocalStorage, SessionStorage, and IndexedDB) to save settings, UI preferences, and user states (such as checklist items, upvotes, and custom styling themes).

A small number of functional cookies and storage keys keep the site working: your consent choice (stored locally on your device), sign-in session tokens (signed-in users only), an edge-set 2-letter country code used for regional formatting (user-country, 24h), and anonymous quota counters. Analytics storage (a session identifier) and session-insight cookies (_clck, _clsk) are only set while analytics are active — never after you Decline (see section 5).

These states remain persistently cached on your browser and can be completely purged at any time by clearing your browser cache. Full details in our Cookie Policy.

5. Third-Party Integrations

We do not sell, rent, or lease any analytical details or user data. We host the Toolzum compiler framework on global CDN edge nodes (Cloudflare/Pages) to deliver files to your browser efficiently.

Subprocessors and integrations that may receive limited data:

  • Google Gemini — our AI provider. Inputs you submit to marked AI/cloud tools transit our server to Gemini for processing, under Google's API data terms. We store none of your content.
  • PostHog — page-view and product analytics. Loaded only after you choose Accept in the consent banner; declining keeps it off entirely.
  • Microsoft Clarity — heatmaps and session replays that show where pages are confusing. Loaded through the same consent gate as PostHog; declining removes the tag and expires its cookies.
  • Cloudflare Web Analytics — cookieless aggregate metrics; no personal data.
  • Pollinations — the free AI image engine loads generated images directly from their servers in your browser.
  • Library & model CDNs (jsDelivr, unpkg, cdnjs, Google storage) — deliver open-source processing libraries and on-device AI models to your browser. They see standard download requests (IP, user-agent) like any CDN fetch.
  • Cloudflare Turnstile — bot-protection challenge on email sign-in.

When you initiate payment requests (such as upgraded cloud quotas), your transactions are handled directly through our payment gateway (Dodo Payments) under their privacy parameters. We never see or store card details.

6. Security Architecture

Our code compiles utilizing strict Content Security Policies (CSP) to block arbitrary external scripting injections. We run weekly audits to ensure dependencies remain clear of known vulnerabilities.

Should you have any questions regarding privacy audits, please inspect the public developer repository or write to us through our contact form.

7. Data Protection (India DPDP Act 2023)

Toolzum complies with India's Digital Personal Data Protection Act, 2023.

  • Data Fiduciary: Toolzum.
  • Grievance Officer: Reachable at contact@toolzum.com
  • Data we collect: Usage analytics (anonymised), account email (if logged in).
  • Your rights: Right to access, correct, and erase your personal data.
  • Retention: Analytics data retained for 90 days, then automatically purged. Account data retained until deletion.
  • Contact: For data requests, email contact@toolzum.com — we aim to respond within 72 hours.

8. GDPR Rights (European Users)

If you are located in the European Economic Area (EEA), UK, or Switzerland, you have the following rights under the General Data Protection Regulation (GDPR):

  • Right of Access: Request a copy of the personal data we hold about you.
  • Right to Rectification: Request correction of inaccurate personal data.
  • Right to Erasure: Request deletion of your personal data ("right to be forgotten").
  • Right to Restrict Processing: Request that we limit how we use your data.
  • Right to Data Portability: Receive your data in a structured, machine-readable format.
  • Right to Object: Object to our processing of your personal data.
  • Right to Withdraw Consent: Where processing is based on consent, withdraw it at any time.

Legal Basis: We process data based on (a) consent (analytics, account creation), (b) contractual necessity (providing the service), and (c) legitimate interests (security, fraud prevention).

Data Transfers: Toolzum uses Cloudflare (global CDN) and third-party analytics providers (page views and session insights) and may process data outside the EEA. We rely on Standard Contractual Clauses (SCCs) where required.

Contact: For GDPR requests, email contact@toolzum.com. We respond within 30 days. You also have the right to lodge a complaint with your local supervisory authority.

9. CCPA Rights (California Users)

If you are a California resident, the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA) grant you the following rights:

  • Right to Know: Request disclosure of the categories and specific pieces of personal information we collect, the sources, purposes, and categories of third parties we share it with.
  • Right to Delete: Request deletion of your personal information, subject to certain exceptions.
  • Right to Correct: Request correction of inaccurate personal information.
  • Right to Opt-Out of Sale/Sharing: We do not sell or share your personal information for cross-context behavioral advertising.
  • Right to Limit Use of Sensitive Personal Information: We do not use sensitive personal information for purposes other than providing the service.
  • Right to Non-Discrimination: We will not discriminate against you for exercising your privacy rights.

Categories Collected: Identifiers (email, user ID), internet activity (usage analytics), and inferences (tool usage patterns). We do not collect biometric data, geolocation, or financial information beyond payment processing.

Disclosure: In the preceding 12 months, we have not sold personal information of California residents.

Contact: For CCPA requests, email contact@toolzum.com. We verify your identity before processing. We respond within 45 days.