Skip to content
ToolVault

Privacy Policy

Last updated: 2026-10-18

01

Our Principle: Privacy First

ToolVault is built with privacy first as a core philosophy. Most tools run locally in your browser via client-side JavaScript — formatting, encoding, hashing, encryption, and similar inputs stay on your device by default. Exceptions are described below under "Optional server-side proxy for the API Tester" and "User Feedback".
02

Personal Data We Do NOT Collect

  • We do not collect your name, email, phone number, or any personally identifiable information.
  • We do not require you to create an account to use any tool.
  • Except when the API Tester has server-side proxy enabled (target URL / headers / body required for forwarding), we do not transmit other tool input data (JSON text, keys, passwords, ID photos, etc.) to any server.
  • We do not sell or share any of your tool input data with third parties.
03

User Feedback

  • Content you actively submit through the in-site feedback widget (type, message, page URL, timestamp) is stored on the site server and visible only to site administrators for product improvement; it is never published.
  • We do not collect the submitter's IP address, account, or any personally identifiable information; feedback is anonymous.
  • Please do not include passwords, keys, real names, or contact details in feedback text.
  • Tool input data (JSON text, keys, passwords, etc.) is still never uploaded — the feedback feature only transmits the feedback text you write.
  • Retention: Feedback records are retained until you request deletion; daily backups are kept for 30 days. Deletion requests can be sent to the email below.
04

Local Storage (Necessary Only)

We use browser localStorage to remember your necessary feature preferences. This data is stored only on your device and is never transmitted to our servers:
  • Theme preference (light/dark mode)
  • Interface language selection (Chinese/English)
  • Your favorite tools and recently used records
  • Tool data you actively enter (e.g., text in the JSON formatter, for session recovery only)
You can clear localStorage at any time via your browser settings.
05

Local Computation

Most tool operations (formatting, encoding, hashing, encryption, image and PDF processing, etc.) are performed locally in your browser via the Web Crypto API and JavaScript. Related inputs are processed in memory and discarded when you close the page.
06

Optional server-side proxy for the API Tester

To work around browser CORS and mixed-content limits, the API Tester by default forwards requests through this site's same-origin /api/proxy endpoint to the target URL you specify. You can turn off "Server proxy" in that tool's settings and use browser direct mode instead (the target must allow cross-origin requests).
  • In proxy mode, the target URL, method, and the headers/body you enter pass through our servers only for that forward.
  • We do not use proxied traffic for analytics, ad targeting, or sale, and we do not write request bodies into a product database. Standard server access logs may still include IP, time, and User-Agent (see "Hosting & infrastructure").
  • Do not send production secrets or sensitive personal data to untrusted targets while proxy mode is on; turn the proxy off when you need a fully direct browser connection.
07

Third-Party Services (Anonymous Analytics & Ads)

To continuously provide the service for free and improve the product experience, this website uses the following anonymous aggregate third-party services. These services are operated by Google LLC and their processing is governed by their official policies.
  • Google Analytics: Used to anonymously aggregate statistics on website traffic, page dwell time, tool usage distribution, etc., helping us understand user needs and optimize the product. Data is processed anonymously and is not linked to personal identity. You can opt-out by installing the Google Analytics Opt-out browser add-on.
  • Google AdSense: Used to display content-relevant advertisements to support free operation. Google AdSense may use cookies to show personalized ads based on your browsing history (ad scripts and ad slots load only after you explicitly accept them in Cookie Settings; if you reject or have not chosen, this site loads no advertising scripts at all). AdSense data processing follows the Google Ads Policy.
The above third-party services operate servers in the US and other countries/regions. Their data processing follows the Google Privacy Policy. You may change or withdraw preferences anytime via "Cookie Settings" below.
08

Cookies & Consent Management

This website uses cookies and similar technologies. Necessary storage is always on; analytics and advertising cookies load only after you explicitly accept them, in every region — until that choice, no tracking or ad scripts load at all. You can make or change your choice anytime via the Cookie banner on first visit or via "Cookie Settings" below.
  • Necessary Storage (always enabled): Saves theme preference, language selection, favorite tools, recently used records. Stored in browser localStorage only. Never sent to any server.
  • Analytics Cookies (explicit acceptance required): Set by Google Analytics for anonymous visit behavior statistics. They load only after you explicitly accept; if you reject or have not chosen, this site loads no tracking scripts.
  • Ad Cookies (explicit acceptance required): Set by Google AdSense for personalized advertising or frequency capping. They load only after you explicitly accept; if you reject or have not chosen, this site loads no ad scripts.
  • Google ad preferences: Beyond this site's toggle, you can manage Google's personalized ads at Google Ads Settings, or see more opt-out options on Google's About Ads page.
Your preference is recorded in browser localStorage for 180 days. Rejecting or withdrawing does not affect necessary features.
09

Hosting & infrastructure

This website runs on cloud VPS / container infrastructure. As part of normal operations, the stack may collect standard access logs (IP address, request time, User-Agent, request path). These logs are used for security, troubleshooting, and abuse prevention — not for sale or ad targeting. Access logs rotate daily and are automatically deleted after approximately 10 days; they are not used for long-term user profiling.
10

Minors

This site is intended for developers and technical professionals and is not directed at children. We do not knowingly collect personal information from children under 13. If you believe a child has submitted personal information to us (e.g. via the feedback feature), contact us at the email below and we will delete it after verification.
11

Future Changes

If additional third-party services are added or data processing methods change in the future, we will update this privacy policy and prominently disclose and obtain your consent before enabling them.
12

Your Rights

  • Clear all local data by clearing localStorage for this site in your browser.
  • Withdraw or change your consent at any time via "Cookie Settings" in the Cookie banner.
  • Use this site in a private/incognito window to avoid storing any data.
  • Contact us at the email below if you have questions about this policy.
13

Contact

Privacy inquiries: mainxbegin@163.com