Privacy Policy

The short version

We don't track you. We don't sell your data. Most of our tools process everything in your browser, so your files never even reach our servers. The only data we might see is if you send us a message through the contact form. This Privacy Policy explains exactly what we collect, why we collect it, and how we protect it.

ToolsKit operates as a collection of client-side browser tools. Because computation happens locally in your browser using JavaScript, the vast majority of user interactions generate zero server-side data. This architecture is by design — it means your privacy is protected at a technical level, not just a policy level.

Data collection practices

We collect the absolute minimum data necessary to operate the site and respond to your inquiries. Here is exactly what we collect and why:

Contact form submissions: When you send us a message through the contact form, we collect the information you provide: your name, email address, subject category, and message content. We also record a server-side timestamp to prevent spam. This data is stored in Firebase Firestore, a cloud database operated by Google. We retain contact form submissions indefinitely unless you request deletion, as they help us track ongoing conversations and improve our support quality.

Tool usage: None. Every PDF tool, resume tool, GPA calculator, citation generator, and text tool runs entirely in your browser. Your files stay on your device. We literally have no way to see them. No file data, no processing results, and no usage patterns are transmitted to our servers.

Analytics: We use privacy-friendly analytics that don't use cookies or track you across sites. No Google Analytics, no Facebook pixels, no advertising networks. Our analytics provider collects only aggregate page view statistics with no personally identifiable information. This data helps us understand which pages people visit and how they navigate the site, which informs our content and tool development priorities.

Firebase data practices: Our contact form uses Firebase Firestore for message storage and Firebase hosting for site deployment. Firebase collects limited operational data such as IP addresses for security purposes and error logs for debugging. This data is processed by Google in accordance with their data processing terms. Firebase automatically encrypts data in transit and at rest. We do not use Firebase Authentication, so no user accounts or login credentials are created or stored.

Cookie usage

We use exactly one cookie: a theme preference cookie (light/dark mode). That's it. No tracking cookies, no analytics cookies, no ad cookies. The theme cookie is stored in your browser's localStorage and expires only when you clear your browser data. See our Cookie Policy for full details.

Because we use only strictly necessary cookies, we do not display a cookie consent banner. There are no non-essential cookies to opt out of. This is a deliberate design choice — we believe your browsing experience should be private by default. If we ever add non-essential cookies in the unlikely future, we will implement a consent mechanism before any such cookies are set.

Analytics approach

Our analytics are designed to give us the minimum information we need to improve the site without tracking individual users. We use a privacy-focused analytics provider that does not use cookies, does not track users across sites, and does not build user profiles.

The analytics data we receive includes: which pages are visited, how long people spend on each page, what referring site brought them to ToolsKit, and general geographic region (country level, not city or address). This data is aggregate and anonymous — we cannot identify individual users from it.

We do not use Google Analytics, Facebook Pixel, Hotjar, or any other analytics tool that tracks individual user behavior across sessions or sites. We do not run A/B tests that require tracking individual users. We do not use heatmap or session recording tools.

Advertising

ToolsKit displays ads through Google AdSense. Google AdSense uses cookies to serve ads based on your prior visits to our website or other websites. Google's use of advertising cookies enables it and its partners to serve ads based on your visit to our site and/or other sites on the internet.

You may opt out of personalized advertising by visiting Google Ads Settings. Alternatively, you can opt out of some third-party vendors' use of cookies for personalized advertising by visiting www.aboutads.info.

We do not control the data collected by Google AdSense, and we recommend reviewing Google's Privacy Policy for information about how Google handles advertising data.

Third-party services

We use the following third-party services that may process limited data:

• Firebase (Google): Cloud hosting, Firestore database for contact form messages, and analytics. Google's data processing terms apply. Firebase privacy documentation.
• Cloudflare: Content delivery network (CDN) and security services. Cloudflare may process IP addresses for security and performance purposes. Cloudflare privacy policy.
• Google AdSense: Advertising service. Google may collect data for ad personalization. See the Advertising section above for opt-out options.

We do not use any other third-party services beyond those listed above. We do not embed social media widgets, tracking pixels, or any other data-harvesting scripts beyond what is described here.

User rights

You have the right to:

• Access the personal data we hold about you (spoiler: almost none)
• Correct any inaccurate data we have about you
• Request deletion of your personal data
• Object to or restrict processing of your data
• Receive a copy of your data in a portable format
• Withdraw consent at any time (where processing is based on consent)

To exercise any of these rights, send us a message. We will respond to all requests within 30 days. If you are in the EEA and are not satisfied with our response, you have the right to lodge a complaint with your local data protection supervisory authority.

GDPR compliance

If you are located in the European Economic Area (EEA), United Kingdom, or Switzerland, you have additional rights under the General Data Protection Regulation (GDPR) and related data protection laws. ToolsKit processes data based on legitimate interest (responding to your inquiries) and consent (when you submit the contact form). You have the right to access, rectify, erase, restrict processing, and port your personal data. You also have the right to object to processing and to lodge a complaint with your local data protection authority. To exercise any of these rights, contact us through the contact page or email us directly.

Our legal bases for processing personal data under GDPR are:

• Consent: When you submit the contact form, you consent to us processing your data to respond to your inquiry.
• Legitimate interest: We have a legitimate interest in maintaining conversation history to provide better support and improve our tools.

CCPA compliance

If you are a California resident, the California Consumer Privacy Act (CCPA) grants you additional rights. You have the right to know what personal information we collect, use, and disclose about you. You have the right to request deletion of your personal information. You have the right to opt out of the sale of your personal information — though we want to be clear: we do not sell personal information. We do not discriminate against users who exercise their CCPA rights.

Children's privacy

ToolsKit is not directed at children under the age of 13 (or 16 in the EEA). We do not knowingly collect personal information from children. If you believe we have inadvertently collected data from a child, please contact us immediately and we will delete it promptly. We take children's privacy seriously and implement measures to prevent the collection of data from minors.

If you are a parent or guardian and believe your child has provided personal information to us, please contact us and we will take steps to remove that information from our systems.

Data security

We take security seriously. All data transmitted between your browser and our servers is encrypted using TLS (HTTPS). Firebase automatically encrypts all stored data at rest. We implement rate limiting on our contact form to prevent abuse. We follow standard security practices and regularly review our infrastructure for vulnerabilities.

However, no system is 100% secure. The good news is that we barely have any of your data to begin with. Our client-side architecture means most of your sensitive information never leaves your device, providing a fundamental layer of protection that policy alone cannot offer.

In the event of a data breach that affects your personal information, we will notify you promptly as required by applicable law and take reasonable steps to mitigate any harm.

International data transfers

ToolsKit is operated from the United States. If you access our site from outside the US, your data may be transferred to and processed in the United States. Firebase infrastructure may also process data in data centers located in various regions. We ensure that appropriate safeguards are in place for international transfers, including standard contractual clauses where required by applicable law.

Changes to this policy

We may update this Privacy Policy from time to time. If we make material changes, we will update the "Last updated" date at the top of this page and post a notice on our website. Significant changes that affect how we handle your data will be communicated more prominently. We encourage you to review this policy periodically.

When we make material changes to this policy, we will display a notice on our site for a reasonable period and update the "Last updated" date. We will not apply material changes retroactively to data we collected before the change without your consent.

Contact

If you have any questions about this Privacy Policy or our data practices, please send us a message. We aim to respond to all privacy-related inquiries within 5 business days.