Privacy policy
Toolora is built so your files and text stay on your device. This page explains the small amount of data we do need for accounts, payments and security.
The short version
- Tools run in your browser. Your files and text are not uploaded.
- An account stores only your e-mail, name, sign-in method and favorites.
- We use one functional cookie to keep you signed in.
- Payments are handled by a payment provider. We never see your full card details.
- You can ask for a copy of your data or delete your account at any time.
Data inside tools
Every tool processes its input locally in your browser. Text, images, PDFs, code and other files are never sent to Toolora’s servers. We do not log, inspect or store tool input or output.
If you use a tool that loads a third-party library, that library is served from our site. It does not receive your content.
Account data
Creating an account is optional. If you create one, we store:
- your e-mail address and, if you provide it, your display name;
- a hashed password, or the provider link if you use Discord, Google or GitHub;
- the passkeys you register, stored as a public key and a label;
- your favorite tool IDs and basic session information;
- the date you created the account and your plan status.
We use this data to sign you in, verify your e-mail, sync favorites across devices, show your plan and protect the service from abuse. We do not sell it and we do not use it for advertising.
Our legal bases are performance of a contract (providing your account), legitimate interests (security and fraud prevention) and consent where the law requires it.
Payments
Paid plans are processed by our payment provider. When you check out, the provider receives the information needed to complete the payment, such as your name, e-mail, order amount and payment method. We receive a payment status, an order reference and limited billing details. We do not receive or store your full card number or bank credentials.
The provider’s own privacy policy applies to the payment page. We keep order records for accounting and tax obligations.
Third parties
- Hosting: our hosting provider stores the site files and database.
- E-mail delivery: a mail provider sends verification and reset messages.
- Payments: a payment provider processes checkout and payment status.
- Discord, Google or GitHub: if you choose social sign-in, they authenticate you and share your basic profile and e-mail address.
These providers only receive what is needed for their part of the service. Where a provider processes data outside the EEA, we rely on appropriate safeguards such as standard contractual clauses.
How long we keep data
Account data is kept while your account exists. Verification codes and pending sign-ins are deleted or expire automatically after a short period. Sessions expire when you sign out or after a period of inactivity. Order records are kept for the period required by accounting and tax law.
When you delete your account, we remove your profile, passkeys, favorites and sessions. Order records may be kept in a minimal form where the law requires it.
Your rights
You can ask to access, correct, export or delete your personal data, and you can object to or restrict certain processing. To make a request, mail contact@toolora.eu from the address linked to your account.
You can also delete your account from Account. If you believe we handled your data incorrectly, you can contact the Belgian Data Protection Authority or the supervisory authority in your country.
Security
Passwords are hashed, sessions use random identifiers, and every sign-in is confirmed with a one-time e-mail code. Passkeys use public-key cryptography; the private key stays on your device. We use HTTPS, restrict access to the server and keep the software up to date.
No system is completely secure. If you notice something suspicious, contact us so we can investigate.
Children
Toolora is not directed at children under 13. If you are under the age required to consent to online services in your country, use Toolora with a parent or guardian.
Contact
Questions about this policy or a data request? We usually reply within one working day.