How Toolsaly handles personal data

1. Who is the Data Fiduciary

Toolsaly (https://www.toolsaly.com) is operated by Puneet Naliath, an individual. There is no registered company. Puneet Naliath is the Data Fiduciary for this website.

For privacy questions and statutory grievance redressal under the DPDP Act, contact:

• Name: Puneet Naliath
• Email: contact@toolsaly.com

You may also use the contact page.

2. What this notice covers

This notice explains what personal data Toolsaly may process, why, who else receives it, how long it is kept, how you can use your rights, and how to raise a grievance or complain to the Data Protection Board of India.

3. Browser-first tools

Most Toolsaly tools process text, numbers, images, PDFs, audio and video in your browser. For those tools, your input is used on your device to generate the result and is not intentionally uploaded to Toolsaly servers. File-heavy tools may download model or processing assets (for example FFmpeg WASM, MediaPipe or img.ly background-removal models) from a content-delivery network. Those downloads can reveal your IP address to the CDN; your file itself stays in the browser.

4. Personal data we may process

Depending on how you use the site, this can include:

• Technical data created by visiting any website: IP address, user-agent, date/time and the page requested, as seen by our host.
• Optional analytics and advertising identifiers and cookies if you accept cookies.
• Feedback you choose to send: the message and the page path, so we can understand the report.
• Tool-specific requests that must leave the browser, described in section 6. We ask only for the minimum needed to return the result.
• Local preferences stored only in your browser: theme, favorites, recent tools, currency-list cache and your cookie choice.

We do not require an account. Do not paste passwords, private keys, medical records, bank details or other highly sensitive data into any tool or feedback box.

5. Cookies, analytics and advertising

Google Analytics and Google AdSense do not load until you accept. Google Consent Mode is initialised with storage and advertising signals set to denied. If you reject, those products are not loaded and the tools still work. If you accept, Google may set cookies and similar technologies to measure visits and tool events and to serve, measure and improve ads.

Analytics events may include a page path, a tool slug, a fixed action name and a broad failure category. Tool inputs, pasted text, numbers, filenames, generated outputs and raw error messages are not intentionally sent as analytics event data. Browsers that open the private Insights page are marked locally as owner devices and do not send further Analytics events.

You can change or withdraw this consent at any time from Cookie settings. Withdrawal does not affect processing that already happened while consent was in place.

6. Forms and tools that send data to a server

These are the current cases where user-supplied or request data leaves your browser:

• Feedback form. Sends only your message (up to 1,000 characters) and this page's origin and path to Toolsaly's `/api/feedback` endpoint, which emails the report to the site operator. Query strings, form field names other than the message, and browser user-agent are not stored in that email. Do not include sensitive personal data.
• Hashtag generator. Sends only the topic you search (up to 80 characters) to the public mastodon.social hashtag API, or to Toolsaly's `/api/hashtags` relay if a direct request fails. Custom keywords and the selected output stay in your browser.
• Currency converter. Sends only the two selected currency codes to Frankfurter (`api.frankfurter.dev`) to fetch a reference rate. The amount you enter is not sent.
• YouTube thumbnail downloader. Your browser requests publicly available thumbnail images from `img.youtube.com` using only the 11-character video ID parsed from the URL you paste. The rest of the URL stays in your browser.

7. Purposes of processing

• To provide the requested page or tool result.
• To receive and review voluntary feedback.
• If you accept cookies: to understand aggregate site and tool usage and to show ads that support the free service.
• To keep the site secure, diagnose outages and comply with law.

8. Consent and other grounds

Analytics and advertising cookies are used only after you accept. You may reject or withdraw with equal ease from Cookie settings. Using a tool that must contact a named processor (hashtags, currency rates, YouTube thumbnails) or sending feedback is a request for that specific purpose; only the minimum fields listed above are sent. Hosting and security logs are created as part of operating the website.

9. Named processors and recipients

Depending on the feature you use, personal data may be processed by:

• Vercel Inc. — website hosting and related infrastructure logs.
• Google LLC — Google Analytics and Google AdSense, only after you accept cookies.
• Mastodon / mastodon.social — public hashtag search and trends for the hashtag generator.
• Frankfurter (api.frankfurter.dev) — reference currency rates.
• YouTube / Google — public thumbnail images for the thumbnail downloader.
• CDN and model vendors such as jsDelivr, img.ly and FFmpeg WASM hosts — may see an IP address when your browser downloads processing assets. They do not receive your uploaded file.

10. Cross-border transfers

Some processors above may process data outside India. We do not transfer personal data to a country or entity that is restricted by the Government of India under the DPDP Act. Where a processor is used, it is only for the purpose described in this notice.

11. Retention

• Local preferences remain until you clear site data in your browser.
• Your cookie choice stays in localStorage until you change it or clear site data.
• Feedback emails are kept only as long as needed to review and act on the report, then deleted or minimised.
• Hosting logs follow the host's standard retention. Analytics retention follows the Google Analytics property settings if you accepted cookies.

12. Children's data

Toolsaly is a general-purpose utility site. It is not directed at children under 18. We do not knowingly collect personal data from children or use their data for tracking or behavioural advertising. If you believe a child has provided personal data, contact the Grievance Officer. We will delete it when we become aware of it. Do not use the optional analytics and advertising cookies on a device primarily used by a child.

13. Security

We use HTTPS, origin checks and rate limits on the feedback endpoint, and we avoid collecting more data than a feature needs. No method of transmission or storage is completely secure. Keep backups of files before processing them.

14. Personal data breach notice

If a personal data breach is likely to affect you, we will notify the Data Protection Board of India and affected Data Principals in the manner and time required by the DPDP Act, 2023 and the DPDP Rules, 2025, including a description of the nature of the breach, the likely impact, and the measures being taken. You may also write to the Grievance Officer using the details in section 1.

15. Your rights

Subject to the DPDP Act, you may:

• Access a summary of the personal data we process about you and the processing activities.
• Correction of inaccurate or incomplete personal data.
• Erasure of personal data that is no longer necessary for the stated purpose, or that we processed after you withdrew consent, unless retention is required by law.
• Withdraw consent for optional analytics and advertising as easily as you gave it, using Cookie settings.
• Nominate another individual to exercise your rights in the event of your death or incapacity. Send the nomination, or a later change, to the Grievance Officer.
• Grievance redressal by writing to the Grievance Officer listed in section 1.
• Complain to the Data Protection Board of India if you are not satisfied with our response or if we do not address your grievance as required by law.

To exercise access, correction, erasure or nomination, email the Grievance Officer with enough detail to locate your request (for example the approximate date, page and the email you used if you wrote to us). We will respond within a reasonable period as required by applicable law. We may need to refuse or limit a request where the Act allows that, for example to comply with another law or to prevent a legally prohibited disclosure.

16. Grievance redressal

Write to Puneet Naliath at contact@toolsaly.com. We will acknowledge and address the grievance without undue delay and in any event as required by the DPDP Act, 2023 and the DPDP Rules, 2025. If you remain dissatisfied, you may complain to the Data Protection Board of India.

17. Changes to this notice

We will update the "Last updated" date when this notice changes. Material changes to optional cookie use will be reflected in the consent banner so you can accept or reject again.