T
ToolboxKit.io

Privacy Policy

Last updated: May 2026

The Short Version

All ToolboxKit tools run entirely in your browser. Your data is processed on your device and is never sent to our servers. We don't track what you type, upload, or calculate. We believe your data is yours.

Data Processing

Every tool on ToolboxKit is built to run client-side using JavaScript. When you paste text, upload a file, or enter data into any tool, that data stays in your browser. It is not transmitted, stored, or logged by us.

Exceptions: A small number of tools connect to external services. These are clearly marked with a "Runs Locally" badge on the tool page. For example, certain AI tools download model files from Hugging Face (but all inference runs locally in your browser).

Local Storage

Some tools use your browser's localStorage to save preferences and data locally on your device. This includes:

  • Favourites - Tools you save to your favourites list
  • Recently Used - A record of the last few tools you visited
  • Tool data - Some tools save your work locally (e.g., Online Notepad, Habit Tracker, Checklist Maker, Daily Planner)

This data is stored entirely in your browser and is never sent to us or any third party. Clearing your browser's site data for toolboxkit.io will remove it. We don't store this data and have no access to it.

Cookies and Consent

ToolboxKit does not set any first-party cookies of its own. Whether you see a cookie banner depends on where you're visiting from, because cookie consent laws vary by region:

  • UK, EU/EEA, and Switzerland - you see the cookie banner on first visit with three options: Reject all, Accept all, or per-category preferences. Analytics cookies are not set until you click Accept. Lawful basis: consent (UK GDPR / EU GDPR Article 6(1)(a) and PECR Regulation 6 / Swiss revFADP).
  • Everywhere else - by default we do not show the banner and treat analytics as accepted, since basic, anonymous analytics for site operation is permitted under most other regimes without prior consent. You can still change your mind at any time via the link in the site footer.

Your choice is stored in your browser's localStorage under toolboxkit-consent-v1 so the banner doesn't reappear on every visit. Region detection uses your IP-derived country code from Cloudflare (CF-IPCountry) and is not stored.

Browser signals we honour: regardless of region, if your browser sends Global Privacy Control (the universal opt-out signal recognised under California CCPA/CPRA, Colorado CPA, Connecticut CTDPA and several other US state laws) or the older Do Not Track header, we treat it as a reject-all decision and do not show the banner.

The third-party services we may load (only after consent, or in regions where consent is not required by default):

  • Google Analytics 4 - sets _ga and _ga_* cookies (2-year expiry) to count anonymous visits. We use Google Consent Mode v2, so if you reject, GA4 falls back to cookieless modelled pings only.
  • Google AdSense - not currently approved on this site. Reserved for future use. If we enable ads, AdSense and its partners may set advertising cookies; you can manage preferences at Google Ads Settings.

Analytics

We use Google Analytics 4 to collect anonymous usage statistics such as page views, referral sources, screen size, browser, and approximate geographic region (city level, derived from IP). This data is aggregated and is not used to identify you personally.

GA4 only loads with cookies and pageview reporting after you accept analytics in the cookie banner. If you reject, GA4 still receives anonymous, cookieless pings via Google Consent Mode v2 so we can see aggregate visit counts, but no _ga identifier is set in your browser and no per-user data is collected.

What we have on:

  • Granular location and device data - on. Gives us city-level geography and device model alongside the country-level default. Still based on IP, no new data leaves your browser beyond what GA4 already collects.

What we have off:

  • Google signals - off. No cross-device tracking, no Demographics & Interests reporting from signed-in Google users.
  • User-provided data collection - off. We never upload emails, phone numbers, or any hashed identifiers to Google.
  • Google Ads / advertising features - off. No remarketing audiences, no ad personalization based on your visit.

Bug Reports and Feedback

When you submit a bug report, suggestion, or contact form message, the text of your message is stored via Cloudflare KV with a 90-day expiry. Reports are anonymous and we do not collect your name, email address, or any personal information. Your IP address is temporarily used for rate limiting (to prevent spam) but is not stored long-term.

Hosting

ToolboxKit is hosted on Cloudflare Pages. Cloudflare may process technical data such as IP addresses for routing, DDoS protection, and basic request logging. See the Cloudflare privacy policy for details.

Third-Party Links

ToolboxKit may contain links to external websites. We are not responsible for the privacy practices of other sites. We encourage you to read the privacy policies of any site you visit.

Changes to This Policy

We may update this privacy policy from time to time. Any changes will be reflected on this page with an updated date.

Contact

If you have any questions about this privacy policy, you can reach us through our contact page.