Privacy policy

ToolboxHere ("we", "us") provides free online tools at toolboxhere.com. This policy explains what happens to your information when you use the site. The ToolboxHere app for iPhone and iPad has its own app privacy policy (also in العربية and اردو), with app support and app terms.

Your files are never uploaded

Every tool on ToolboxHere runs inside your web browser. When you choose a file, your browser reads it from your device and processes it in memory. The file, its contents and the results are not sent to our servers or to anyone else. We cannot see, store or recover your files.

Scanning with your phone for your computer

In Scan to PDF, ID Card to A4, Fill PDF Form, Sign PDF and the passport photo tools you can link your phone to the page open on your computer by scanning a QR code. The tools that take photos (Compress Image, Resize Image, Crop Image, Image to PDF, Merge PDF, Image to Text, Color Picker From Image, Color Converter, Photo Enhancer, Remove Background, Blur Background, Blur Face and Object Remover) offer the same link under "Use your phone's camera", and it starts only when you open that card, never when the page loads. Each page or photo you then take on the phone is sent from your phone's browser to your computer's browser, usually directly between the two. When your networks don't allow a direct connection, the pages pass through our pairing service instead, encrypted in your browser with a key that only your two devices have (it is part of the QR code and is never sent to us). The service cannot read the pages and stores nothing; it only connects your two devices.

Recording with your microphone

Audio to Text uses your microphone only after you tap Record, and only while the recording runs. The sound is recorded and transcribed in your browser; it is not sent to us or to anyone else. Your browser asks for your permission first, and you can withdraw it at any time in its site settings.

When a recording is in Urdu or Hindi, Audio to Text chooses which of the two scripts to write from your last choice, your browser's languages and your time zone. It reads these on your device; they are not sent anywhere. In the same way, Amount in Words starts with the currency used in your time zone.

In the Creative Studio, "Your own voice" also uses your microphone only after you tap Record: to record your voice sample and the consent sentence. You can listen to each recording first, and it is sent only with your job, as described under Creative Studio below.

Text to Speech and your device's voice

Text to Speech makes the audio in your browser with an AI voice downloaded from our site; the text you type is not sent to us or to anyone else, and it is not kept after you leave the page. Its "Listen now with your device's voice" option uses the speech engine built into your phone, tablet or computer, and only voices your device marks as running on the device itself (some browsers also offer online voices, which would send the text to their maker; the tool never uses those). Text to Speech remembers how fast your device made speech last time, as one number in your browser's local storage, to estimate the time left; nothing else is stored.

Some tools download code or AI model files to your browser the first time you use them (for example, the language data used by Image to Text, or the speech model used by Audio to Text). These downloads come from our site and contain no information about you or your files. Your browser keeps them so the tool starts faster next time.

Sharing a page

The Share buttons are plain links. Nothing is sent until you tap one, and then only the page's address and a short line about it go to the app or site you chose, which has its own privacy policy. On phones and tablets the Share button opens your device's own share sheet. A link shared through WhatsApp, the other channels or the share sheet ends with two tags, utm_source and utm_medium, that name the channel, so Google Analytics can count the visits that come from shared links; the page takes them out of the address bar when it opens. Copy link copies the plain address. When you share, Google Analytics records which channel you chose (for example WhatsApp), never who you shared it with.

Information we do not collect

The free tools ask for no account, and we do not collect your name, email address or files through them. The paid Creative Studio is the one exception, and only for people who continue into it with their email.

Information stored on your device

• Your theme choice (light, dark and accent colour) is saved in your browser's local storage.
• Some tools keep your settings and details in your browser's local storage so they are there next time: for example the business details on your invoices, your QR code design and logo, your prayer-times place and calculation method, calculator history, CGPA semesters, whether you read transcripts in Urdu or Hindi script, how fast your device makes speech in Text to Speech, how many seconds the background remover took on your last photos (for its time estimate), the names on your wheel and in the team generator, and your number-to-words choices (the numbers themselves are not kept). The text inside your QR codes, such as a Wi-Fi password, is not kept.
• The text tools (Word Counter, Case Converter, Remove Duplicate Lines, Readability Checker and Remove Tashkeel) keep what you type in your browser's session storage, so a reload does not lose it. Session storage belongs to that one tab: closing the tab clears it, and it is never sent anywhere. A Word file or PDF you open in the Word Counter is read inside your browser.
• When you copy a share link for a wheel, its names are packed into the part of the link after "#". Browsers never send that part to a server, so the names go only to the people you send the link to.
• If you tick "Remember it on this device" when you sign a PDF, a picture of your signature is saved in your browser's local storage. You can remove it in the signature window at any time.
• AI model and language files may be cached in your browser's storage to avoid downloading them again.

You can remove this data at any time by clearing your browser's site data for toolboxhere.com.

Hosting and security

The site is hosted on Cloudflare. Like any web host, Cloudflare processes technical information such as your IP address and browser type to deliver pages and protect the site against abuse. See the Cloudflare privacy policy.

Analytics and advertising

We use two Google services, Google Analytics and Google AdSense. They are the only third parties on the site that can set cookies, and they only ever see page addresses and technical details such as your browser and screen size. They never see the files, text or numbers you put into a tool.

• Google Analytics tells us which tools are used, how visitors find the site and on which devices, so we know what to improve. Google Analytics 4 does not log or store IP addresses, and we keep Google Signals, advertising features and ad personalisation switched off, so analytics data is not used to build advertising profiles. Inside a tool it records what you do, not what you work on: that files were added and how many, which buttons and options you chose, that a result was made, saved, copied or shared, the kind of file (for example PDF or JPG) and whether an error appeared. It never records file names, the contents of your files, or the text and numbers you type.
• Google AdSense shows the ads that keep the tools free. Third-party vendors, including Google, use cookies to serve ads based on your prior visits to this website or other websites. Google's use of advertising cookies enables it and its partners to serve ads to you based on your visits to our site and/or other sites on the internet. We allow no ad networks other than Google AdSense; if that changes they will be listed here.

See how Google uses information from sites that use its services and Google's privacy policy. We may also use Cloudflare Web Analytics, which counts page views without cookies.

Cookies

The free tools set no cookies of our own; the Creative Studio sets one account cookie, only on its own pages and only when you open its email link (below). These are the cookies the Google services may set, only once you have agreed where consent is required (below):

Google may change the names and lifetimes of its cookies; Google's list of advertising cookies is the current reference. The site also keeps settings in your browser's local storage, described below; that storage is not sent to anyone.

Your consent choices

• European Economic Area, United Kingdom and Switzerland. We ask for your consent first, through Google's consent message. Until you agree, analytics and advertising storage is switched off (Google Consent Mode "denied"): no Google Analytics or advertising cookies are set and no personalised ads are shown. Google's tags may still send cookieless signals without identifiers, such as that a page was viewed. If you decline, ads that are not personalised may still be shown.
• Everywhere else. Analytics and ads are on by default. Visitors in US states with privacy laws can opt out of the sale or sharing of their data for advertising through the message Google shows on this site.
• Change your mind at any time with the Privacy and cookie settings link at the bottom of every page. It reopens Google's consent message, where you can withdraw or give consent. Withdrawing does not affect what happened before.
• You can also turn off personalised ads in My Ad Center, opt out of other vendors' cookies at aboutads.info or youronlinechoices.eu, block Google Analytics with the Google Analytics opt-out add-on, or block or delete cookies in your browser.

Legal basis

For visitors in the EEA, the UK and Switzerland, we use Google Analytics and advertising cookies only on the basis of your consent (GDPR and UK GDPR Article 6(1)(a), and the ePrivacy rules on cookies). Delivering the pages themselves and keeping the site secure rely on our legitimate interest in running a working, safe website (Article 6(1)(f)).

How long data is kept, and where

User-level Google Analytics data is deleted automatically after the retention period set in our Google Analytics account, at most 14 months. Google may process data in the United States and other countries under its own safeguards, including the EU–US Data Privacy Framework and standard contractual clauses.

The Creative Studio (paid AI tools on our GPU)

The Creative Studio is separate from the free tools. Its AI tools run on our own graphics card, not in your browser, so what you send to a studio tool (your prompt, and any picture, recording or file you add) is uploaded to our server to make your result. Nothing from the free tools ever goes there, and the free pages never contact the studio.

What the studio stores, and for how long:

• Your email address, to sign you in with a one-time link (no password is stored) and to send your receipts, the "job accepted" and "ready" messages, a reminder on day 5 if you have not downloaded a result, and refund notices. We send no newsletters.
• Your credits: every purchase, hold, spend and refund, with its reason and time, so your balance can always be checked. Kept while you have an account.
• Your jobs: the tool, option and settings, the safety check's verdict and the timings, kept so a job can be traced if it is misused.
• Your prompts and uploaded files: prompts are kept with the job for 7 days, then deleted; only the safety verdict, the timings and a one-way fingerprint (hash) of the prompt remain. Uploaded files are deleted when the job ends.
• Your results: kept 7 days, or 48 hours after your first download, whichever comes first, then deleted. A storage rule deletes anything older than 8 days in any case.
• Your consent to a voice of your own: when you use "Your own voice", you record a short consent sentence with a one-time code. Our GPU computer transcribes it to check the code and the words, and compares it with your sample to check it is the same voice. The recording is deleted with your other uploads; we keep a consent record for 12 months: one-way fingerprints (hashes) of the sample and the recording, whether the code and the words matched, the similarity score, the time and the country your request came from. Never the words themselves.
• Where you are, as a country: the studio reads the country your request comes from (from Cloudflare) and the country of your billing address from the payment, to offer the MiniMax H3 video model only where its licence allows. Only the two-letter country is kept.
• Reports: if you report a result, we keep what you wrote, the result's link and, if you gave one, your email address for 12 months, so the report can be checked and answered.
• An account cookie (tbh_s), set only on the studio's pages when you open the email link, for 30 days. It holds a random token, nothing else.

Nobody else can see your jobs: a job, its files and its result are shown only to your account or to someone with its private tracking link. The live queue on the studio page shows the tool and the time left, never prompts, files or emails.

The services the studio uses: PayPal takes your payment on its own page (we never see your card or PayPal login; PayPal tells us the amount and that it was paid; see the PayPal privacy statement). When the card button on your account page sends you to Freemius, a reseller that takes card payments for the studio, it takes the payment on its own page: we pass it your studio email so the credits reach your account, and it tells us the amount, the pack and that it was paid, never your card (see the Freemius privacy policy). Resend delivers the studio's emails (see the Resend privacy policy). Cloudflare hosts the studio's server, database and stored results, and its Turnstile check, shown when you sign in or send a job, tells people from bots without a puzzle (see the Cloudflare privacy policy). To delete your studio account and everything linked to it, email contact@toolboxhere.com.

Support gifts, certificates and the Wall of Supporters

You can send a one-off thank-you gift from the support page (for the free tools, no account needed) or from the Creative Studio (on your studio account). The gift is paid on PayPal's own page; we never see your card or PayPal login, and PayPal tells us only the amount and that it was paid. A gift buys no credits and is not refundable.

• Gifts for the free tools (no account): we keep a random gift id, the program, the amount, PayPal's payment reference (to match a refund), the date, the certificate number and badge, and whether the gift was refunded. PayPal tells us the payer's name and email with every payment; for gifts we do not read or keep them. The checkout record (PayPal's order id, the program and the amount) is deleted when the certificate is made, or after 30 days.
• Your name: after paying you choose the name to print on the certificate (1 to 60 characters, checked against offensive names, impersonation, links and email addresses). For a free-tools gift it is kept only if you tick "Make it verifiable" (the name then shows when someone checks the number at /verify/) or "Show my name and badge on the Wall of Supporters"; with both off it is used once, to draw your certificate in your browser, and never stored. Both boxes are off unless you tick them. The Wall and the verify page never show the amount or an email address.
• Gifts to the Creative Studio: the same, linked to your studio account, plus the name on your certificate, so you can get it again from the email we send. Deleting your studio account removes the name; the certificate number stays valid.
• Drawn on your device: the certificate, the badge and the share card are drawn in your browser and saved straight to your device; nothing you save is uploaded.
• The link back from PayPal carries a one-time code after the "#" in the address, which browsers never send to a server; the page removes it from the address bar at once, sends it only to our server to make the certificate, and Google Analytics gets only the page's path on these pages.
• The board (/studio/board/) shows the requests and comments people post there, their vote counts and the poster's badge, never a name or an email. Posts are plain text, kept until they are hidden or you ask us to remove them.

The gift pages carry no ads. To be taken off the Wall, to hide your name on the verify page, or to have a certificate's name removed, email contact@toolboxhere.com.

Children

The site is not directed at children under 13, and we do not knowingly collect information from them.

Your rights

Under the GDPR, the UK GDPR and similar laws you have the right to access the personal data held about you, to have it corrected or deleted, to restrict or object to its use, to receive it in a portable form, and to withdraw consent at any time (use the Privacy and cookie settings link). Outside the Creative Studio we do not store personal data about you ourselves (what the studio keeps, and for how long, is listed below): the only data linked to your visits is held by Google, against a random ID in your browser's cookies. To have it deleted, delete this site's cookies in your browser and withdraw consent; to ask us to delete analytics data held against your browser's ID, or for anything else, email contact@toolboxhere.com and we reply within one month. You may also complain to your data-protection authority, for example the ICO in the UK or the authority in your EU country.

ToolboxHere is run from Qatar, so Qatar's Law No. 13 of 2016 on the Protection of Personal Data Privacy (PDPPL) also applies to the little personal data we handle, which is the emails you send us: we keep them to answer you and delete them when the matter is closed. In Qatar, complaints go to the National Cyber Governance and Assurance Affairs (NCGAA) of the National Cyber Security Agency.

Changes

We may update this policy. The date at the top shows when it last changed.

The ToolboxHere app for iPhone and iPad

The app collects no data and has its own policy: the ToolboxHere app privacy policy (العربية, اردو). Help with the app is on the app support page, and its terms are the app terms of use.

Who is responsible, and contact

The site is run by Saad Naeem, Doha, Qatar. Email contact@toolboxhere.com.