Privacy Policy

Last updated: September 29, 2026 • Effective: September 1, 2026

1. Information we collect

Account: When you create an account we store name, email, password hash (bcrypt in production, base64 demo), provider (email/Google), avatar, created_at and last_login in our database (currently localStorage-backed toolshub:users, production Supabase). Tool usage: history, recently used, bookmarks, reviews, submissions. Mock URLs: filename, file path (stored securely, 48h retention), size, dimensions, view_count. Analytics: tool views, outbound clicks, searches, device/browser (no fingerprinting). Contact form: name, email, message.

2. How we use it

To provide tool functionality, save your history/bookmarks, show your mock URLs, improve popular/trending rankings, and display relevant (non-personalized until consent) ads via Google AdSense. We never sell data.

3. Cookies & consent

We use essential cookies for session (toolshub:session) and analytics/ads cookies only after you click Accept on the banner. You can Decline or withdraw via Cookie Policy. Google Tag Manager may load before a choice with optional storage denied by default; deployed tags must be configured to honor consent. Clarity loads only after analytics acceptance. Advertising consent is not granted by this button. With JavaScript disabled, the supplied GTM fallback may contact Google; its tags require separate container review. See our cookie banner (minimal, non-intrusive, mobile-friendly).

4. File uploads & Mock URLs

Images for compress/resize are processed client-side via Canvas — they never leave your device. Server-processed files (video, PDF) are queued, processed, and auto-deleted in 60 minutes. Mock screenshots are stored with a random 8-char public token, expire in 48 hours, then file removed (record kept 7 days for expired page). Public mock links are noindex and require the token — no.directory listing.

5. Google Auth & third parties

“Continue with Google” uses Google Identity Services OAuth 2.0 — we receive only name, email and avatar after you consent. Rates for currency/PSX use open.er-api.com / PSX APIs. QR uses api.qrserver.com. SimpleIcons CDN for AI logos. All third-party content is loaded over HTTPS.

6. Google AdSense

When you Accept, AdSense may set cookies to serve and measure ads. You can opt out via Google Ad Settings. We label ad units clearly (AD — Sidebar 300×250) and never disguise ads as navigation. We do not use fake traffic or incentivized clicks.

7. Data retention & rights

Account data until you delete your account (Admin → Users → delete). Analytics 90 days. Mock files 48h. You can request export or deletion at [email protected]. Admin for user [email protected] can view/delete users per your request.

This policy is editable in Admin → Settings. Contact: [email protected] • [email protected]