Privacy policy
Most ToolzyLab tools run in your browser, so your files and text never reach us. This page lists the few features that do send data, where it goes, how long it's kept and what you can ask us to do.
Who runs ToolzyLab and how to reach us
ToolzyLab (toolzylab.com) is an independent website of free browser tools. For the data described here, ToolzyLab is the controller, meaning we decide how it's used. Send privacy questions and requests to toolzylab@gmail.com.
There are no accounts, sign-ups or newsletters. You never give us a name, email address or password to use a tool.
The short version
- Image, PDF, developer, calculator and most text tools process your input in your browser. Our server never receives the file or text.
- Six features send something over the network. They're listed in the table below, and each one says so on its own page.
- Our host, Hostinger, keeps standard web server logs. Our server also keeps a rate-limit counter that lasts about a minute.
- Google Analytics 4 is set up but loads only after you allow Analytics in the cookie banner. Google AdSense is not active.
- We don't sell personal information.
Tools that run in your browser
When you compress an image, merge a PDF, format JSON, decode a JWT or use a calculator, the work happens in JavaScript on your device. The code libraries those tools need are served from toolzylab.com itself, so opening a tool doesn't send a request to a third-party code host.
Your input stays in the browser's memory until you clear the tool, reload or close the tab. Some tools also save settings or history in your browser's local storage so they're there next time. For example, the BMI Calculator's Save this result to local history box is ticked by default. Our server can't read that storage. The cookie policy lists every key, and you can delete them from your browser's site data settings.
Which tools send data to a server
These are the only features that send data off your device. Every other tool processes your input in your browser.
| Feature | What is sent | Where it goes | What is kept |
|---|---|---|---|
| Word Counter: the AI buttons (Review writing, Correct writing, Find keywords, Improve clarity, AI Fill, Blend into text) | The text in the editor, the writing mode, and any keywords or review results that action needs | ToolzyLab's server, then the OpenAI API | Nothing on our server. OpenAI may keep it for up to 30 days for abuse monitoring. |
| Text Expander: the AI assistant buttons (Generate snippet, Rewrite content, Suggest trigger, Extract variables) | Your prompt, or the snippet's title, trigger, tag and content, plus the tone and the names of your existing triggers | ToolzyLab's server, then the OpenAI API | Nothing on our server. OpenAI may keep it for up to 30 days for abuse monitoring. |
| Random Joke Generator with Joke source set to AI writer | Category, tone, topic, language, the Family-friendly only setting and your last few jokes | ToolzyLab's server, then the OpenAI API | Nothing on our server. OpenAI may keep it for up to 30 days for abuse monitoring. |
| Random Quote Generator with Quote source set to AI writer | Category, tone, topic and maximum quote length | ToolzyLab's server, then the OpenAI API | Nothing on our server. OpenAI may keep it for up to 30 days for abuse monitoring. |
| HTTP Header Checker | The URL you enter, the request method (HEAD or GET) and the timeout | ToolzyLab's server, which requests that URL, the site's robots.txt and security.txt, and the plain http:// version of the site | Nothing on our server. Your last 20 scans are saved in your own browser. |
| Currency Converter | A request for the currency list and the latest USD-based rates. Your amounts and currency choices are not included. | The Frankfurter API (api.frankfurter.dev), called directly from your browser | ToolzyLab receives nothing. Frankfurter sees your IP address, as any website you load does. |
The built-in joke and quote libraries are picked in your browser, and nothing is sent unless you switch the source to AI writer. Word Counter's counts and Text Expander's snippets also stay local until you press one of the AI buttons. The JWT Decoder decodes, verifies and signs tokens in your browser and sends nothing.
Don't paste passwords, API keys, health records, client files or other people's personal data into an AI feature. The AI usage policy explains what OpenAI does with the text.
Server logs and rate limiting
Like most hosts, Hostinger writes a log line for each request to toolzylab.com. It records your IP address, the page or file requested, the date and time, your browser's user agent, the referring page and the response code. Request bodies, which carry the text for the AI features, are not part of these logs. We use the logs to keep the site running, find errors and block abuse.
To stop one visitor from using up the AI and header-checking services, our server counts requests. It never stores your full IP address. It takes the network part: the first three blocks of an IPv4 address, or the first half of an IPv6 address. It turns that into a SHA-256 hash and saves the hash with a request count and two timestamps. Each count covers 60 seconds. A hashed network prefix is pseudonymous, not anonymous, so we treat it as personal data.
The per-minute limits are 8 requests for Word Counter AI, 10 for Text Expander AI, 12 each for the joke and quote writers and 6 for the HTTP Header Checker.
Analytics and advertising
The site has one settings file for Google Analytics 4 and Google AdSense. Google Analytics 4 is configured: it loads only if you choose Accept cookies or switch on Analytics under Customize. If you ignore the banner or decline, it doesn't load and Google sets no analytics cookies through ToolzyLab. The AdSense ID is empty, so no ads or advertising cookies load. Before any Google script can load, our consent code sets Google's consent mode to denied for analytics and advertising storage.
If we add the IDs later, this is how it will work:
- Analytics loads only after you choose Accept cookies or switch on Analytics under Customize. It would collect page views, approximate location, device and browser details and the referring page, with IP anonymization turned on in our setup. We'd use the reports to see which tools people use and where pages fail.
- Advertising loads only after you allow Advertising. Google and its partners may then use cookies to show, cap, measure and personalize ads. Google may also show its own consent message where its rules require one.
- If your browser sends a Global Privacy Control signal, the Advertising switch stays off and can't be turned on. Analytics is unaffected by GPC and stays off until you allow it.
Google explains how it uses data from partner sites in How Google uses information from sites or apps that use our services. You can manage ad personalization in Google Ads Settings.
When you email us
If you write to toolzylab@gmail.com, we receive your email address, your message and any attachments. The mailbox is a Gmail account, so Google stores and processes these messages for us. We use them to reply, fix what you reported and keep a record of the conversation. Please don't attach confidential files unless we ask for one.
Legal bases under GDPR and UK GDPR
- Server logs and rate limiting: our legitimate interest in keeping the site secure, available and free of abuse.
- AI features, header checker and currency rates: providing the feature you asked for when you pressed the button or opened the page (our legitimate interest in running the service you requested).
- Theme, consent record and tool settings in your browser: strictly necessary to provide what you asked for. They never reach our server.
- Google Analytics (and AdSense, if it is enabled later): your consent, which you can withdraw at any time with Privacy choices in the footer.
- Emails: our legitimate interest in answering you.
Service providers that process data
- Hostinger hosts the site and the PHP scripts behind the server features, and keeps the web server logs.
- OpenAI processes the text sent by the AI features through its API. OpenAI states that API data is not used to train its models unless the customer opts in. It keeps abuse monitoring logs for up to 30 days (OpenAI: Your data).
- Frankfurter supplies the exchange rates for the Currency Converter.
- Google runs the Gmail inbox we use for email, and would provide Analytics and AdSense if those are switched on and you consent.
These providers may process data outside your country, including in the United States, under their own data protection terms.
How long data is kept
| Data | Where it is held | How long |
|---|---|---|
| Files and text in local tools | Your browser's memory | Until you clear the tool, reload the page or close the tab |
| Tool settings, history and saved items | Your browser's local storage | Until you delete them in the tool or clear site data |
| Your cookie choice | Your browser's local storage | 180 days, then the banner asks again |
| Ignore for now | Your browser's session storage | Until the browser session ends |
| Rate-limit counts (hashed network prefix) | A temporary folder on our server | A 60-second window; expired entries are removed the next time that counter file is written |
| Text sent to the AI features | Our server's memory during the request, then OpenAI | Not saved by ToolzyLab. Up to 30 days at OpenAI for abuse monitoring, unless law requires longer |
| URLs sent to the header checker | Our server's memory during the scan | Not saved by ToolzyLab |
| Web server logs | Hostinger | Rotated on Hostinger's schedule |
| Emails you send us | Gmail | As long as we need them to answer you, handle follow-ups or deal with a legal claim |
Your rights
Under GDPR and UK GDPR you can ask for a copy of your personal data, or ask us to correct or delete it. You can also restrict or object to its use, or ask for it in a portable format. You can withdraw consent for analytics or advertising at any time. You can also complain to your data protection authority, such as the ICO in the UK.
Under California law (CCPA, as amended by the CPRA) you can ask what personal information we hold, ask us to delete or correct it, and opt out of its sale or sharing. We don't sell personal information. If advertising is ever switched on, personalized ads could count as sharing under California law; leaving Advertising off, or sending a Global Privacy Control signal, opts you out. We won't treat you differently for using these rights.
Email toolzylab@gmail.com to make a request. There are no accounts, so the only data we might hold about you is in pseudonymous logs or your emails. To find log entries we may ask for the date, time and IP address of your visit. We aim to reply within one month. Data in your own browser is under your control: clearing site data for toolzylab.com deletes it.
Children
ToolzyLab is a general-audience site and isn't directed at children under 13. We don't knowingly collect personal information from children. If you think a child has sent us personal information, for example by email, contact us and we'll delete it.
Security
The site is served over HTTPS. The server features accept only JSON requests below a fixed size, and the header checker refuses private and reserved network addresses. No system is completely secure, so keep sensitive material out of the server features listed above.
Changes to this policy
When we change how data is handled, for example by switching on Google Analytics, we update this page and the date at the top. If a change affects optional cookies, we'll ask for your choice again.