Privacy Policy

Last updated: 21 October 2026

Summary

ToolBox is built around privacy. Most tools process files and text in your browser - they never leave your device. When a tool needs our servers (for example some video or Office conversions), data is handled in memory and discarded after the job finishes. We do not sell your personal data.

Data we process

Tool files & content

Client-side tools never upload your files. Server-side tools receive files only for the conversion you requested; they are not stored as a permanent archive and are deleted when processing completes (or shortly after, under temporary job cleanup).

Contact form

If you use the Contact form, we store the name, email and message you submit so we can reply. We do not use that information for marketing.

Analytics (only with your consent)

If you click Accept on the cookie banner, we may collect anonymous usage data such as page path, approximate region (from the analytics provider), device/browser type, and which tools were opened. If you click Reject, we do not load Google Analytics and we do not send usage telemetry. See the Cookie Policy for details and to change your choice.

Cookies

Optional analytics cookies run only after Accept. Reject keeps the site fully usable without those cookies. Manage your preference anytime from the Cookie Policy page.

Third-party processors

Depending on how you use the site, these providers may process limited technical data:

  • Vercel Inc. - hosts the website (HTML, scripts, CDN). Processes standard request logs (IP, user-agent, URL) as part of delivering the site.
  • Render - hosts our API and converter workers used by some server-side tools. Processes requests needed to run those jobs; file payloads are not kept as a lasting archive.
  • Cloudflare, Inc. - runs the AI behind the Smart Assistant (Workers AI). When you ask the assistant something, your question, the last few chat turns and a short list of matching tools are sent to write the answer. They are not stored. To enforce the daily limit, a one-way hash of your IP address is kept until the end of the day (UTC) and then deleted.
  • Google Analytics (Google LLC) - loaded only when analytics cookies are on: after you Accept, or by default on phones and tablets outside the EU/EEA, UK and Switzerland (switch it off on the Cookie Policy page). Used for aggregated traffic and tool-usage statistics. Configured with IP anonymization where supported.
  • Microsoft (Microsoft Clarity) loaded only when analytics cookies are on, under the same rule as Google Analytics. Records clicks, scrolls and what is shown on the page, including tool results, as heatmaps and session replays, so we can see where tools work well and where they confuse people. Microsoft processes this data for us.
  • Supabase (if used for blog/admin content) - stores published blog content and related CMS data for the site operators, not your tool uploads.

We do not integrate advertising networks by default. If that changes, this policy and the cookie banner will be updated first.

Google Search Console connector

If you choose to connect Google Search Console (Developer API → Search Console), we ask Google for read-only access to your Search Console data, or read and sitemap access if you enable sitemap submission. We store only the Google refresh token, encrypted with AES-256-GCM, and the email address of the connected Google account. Search Console reports are fetched from Google when you or an AI app you approved asks for them, passed straight back, and not stored. We keep a log of which tool ran, when and what it cost.

AI apps you connect (for example Claude or ChatGPT) receive the report results they ask for, never your Google token. Data from Google is used only to provide the reports you request; it is not sold, used for advertising, or used to train AI models.

500Toolbox's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements. (Google API Services User Data Policy)

You can remove a connected AI app or disconnect Google at any time on the Search Console page of the developer dashboard; disconnecting revokes our access at Google and deletes the stored token. You can also revoke access at myaccount.google.com/permissions.

Legal bases (UK / EEA)

Where UK GDPR / EU GDPR applies: operating the site and responding to contact messages is based on legitimate interests / contract-like steps you request. Optional analytics cookies rely on consent. You can withdraw consent by rejecting cookies on the Cookie Policy page.

Retention

Contact messages are kept only as long as needed to handle your request. Analytics data follows the retention settings of the analytics provider. Tool file payloads are not retained after processing.

Your rights

Depending on your location, you may have rights to access, correct, delete, or object to certain processing, and to lodge a complaint with a supervisory authority. For requests email contact@500toolbox.com.

Children

ToolBox is a general-audience utility site. We do not knowingly collect personal information from children for accounts or marketing.

Contact

Privacy questions: contact@500toolbox.com or the Contact page.