Privacy Policy

The short version

The tools on this site run entirely in your browser. Whatever you type, paste, or upload into a converter, formatter, or counter is processed on your own device and is never sent to us. You can check that for yourself.

There are three small exceptions. The contact form sends the message you write (and your name and email, if you choose to give them) to us by email, so that we can read and reply to it. The currency converter downloads current exchange rates from a public exchange-rate service; it sends nothing you've typed, although, like any web request, that service can see your IP address.

The DNS lookup sends the domain or IP address you look up, and nothing else, from your browser directly to the public DNS service you choose (Cloudflare or Google), which answers it like any other DNS query; toolcrate never sees it.

What we don't collect

We don't require accounts, logins, or email addresses. We don't store the text, numbers, or files you enter into any tool.

What's stored on your device

Some tools and games remember things in your browser's local storage: your light/dark theme, favourites and recently used tools, game progress, best scores, and daily-challenge results. This stays in your browser on your device. It isn't sent to us, and toolcrate doesn't set cookies of its own. You can see all of it, back it up, move it to another device, or delete it on Your data, or delete it by clearing this site's data in your browser settings.

If you write a message on the contact form while you're offline, it's kept in the same place (including the name and email you typed, if any) until your device is back online, when it's sent to us and removed. Pages and games you save for offline use are kept in your browser's cache; you can remove them from the Offline page.

Advertising and cookies

Tools where you open files or type passwords and other secrets (the PDF and image tools, the password, encryption, hash and JWT tools, the link checker, the camera and microphone tests and others like them) never show ads and load nothing from any other website, and they say so on the page. They also tell your browser (with a Content Security Policy) to refuse any request to another website, so it’s enforced by your browser, not just promised. The one exception is a button you have to press: the password strength checker’s optional leak check asks Have I Been Pwned about the password by sending the first 5 characters of a scrambled fingerprint (SHA-1 hash) of it, never the password itself and not enough to work it out. Other pages may show ads.

On pages that show ads, Google's ad script loads with the page and Google decides which ads to show. In the UK, the EU/EEA and Switzerland, Google's own rules apply there: unless you've agreed through a Google consent message, it shows only limited ads, which aren't personalised.

This site may display ads served by third-party networks (such as Google AdSense). These networks may use cookies or similar technologies to show relevant ads and measure performance. This is standard for ad-supported sites and is governed by the ad network's own privacy policy, not ours directly — see Google's policy at policies.google.com/technologies/ads for details on how they handle this.

In particular, third-party vendors, including Google, use cookies to serve ads based on your previous visits to this and other websites. Google's use of advertising cookies enables it and its partners to serve ads to you based on those visits. You can opt out of personalised advertising in My Ad Center (Google's ad settings), through your browser settings, or via aboutads.info/choices.

The games for babies and toddlers (the Baby and Montessori games) show no ads at all.

Donations

The Donate page embeds a Ko-fi widget. If you use it, your payment is handled by Ko-fi and its payment providers under their own privacy policies; we never see your card details.

Analytics

We count page views ourselves, with no third party involved. When a page opens, your browser tells our server which page it is and which site linked to it, and our server adds one to that day's count for that page, that linking site, your country (worked out from your connection, then discarded) and whether you're on a phone or a computer. That is all that's kept: no cookies, no IP address, no device details and nothing that could identify you or link one visit to another. If your browser sends Do Not Track or Global Privacy Control, nothing is counted at all.

Error reports

If a tool’s program crashes in your browser, or your browser blocks something under a page’s security rules, the page tells our server what went wrong so we can fix it: which page, the kind of error, which line of our code, your browser and its version, and whether you’re on a phone or a computer. The error’s wording is cleaned first of anything in quotes, numbers, links and email addresses, and on the tools that open your files or secrets it isn’t sent at all, only the kind of error, so nothing you typed or opened can be in it. Reports are counted per day like page views, with no cookies, no IP address and nothing that identifies you. Do Not Track or Global Privacy Control turns them off too.

Contact

Questions about this policy can be sent to admin.toolcrate@gmail.com.