Toolexe Privacy Policy
Last revised November 7, 2026
This policy covers toolexe.com and every tool on the site. We wrote each section from the code behind the pages, so you get a record of what the site does today. You need no account to use a tool, and no tool asks for payment details.
The short version
- Most tools run in your browser. No tool uploads your files to our server.
- A short list of tools needs the network. Section 2 names each one.
- Every page load writes your IP address, the page address, and device details to our visit log.
- Google Analytics measures traffic. Journey by Mediavine runs the ads, with cookies.
- We never sell your tool input, your email address, or our visit log.
1. What stays on your device
JSON formatters, Base64 encoders, unit converters, calculators, and most other tools run as JavaScript in your browser. Text you paste and files you open get processed on your device. Our server has no file upload handler for any tool.
- Background remover: your browser downloads a model from Hugging Face on first use, then processes your photo locally.
- QR code reader and audio frequency analyzer: your browser asks for camera or microphone access. Our code sends neither stream anywhere.
- Saved work: notes, name lists, history, and settings live in your browser's local storage. The homepage keeps your recent tools there too.
Two limits apply. Saved notes stay on the device, so clear your site data when you finish on a shared computer. Ad and analytics scripts also run on the same pages as the tools. We pass your input to neither, but we do not control their code.
2. Tools with a network request
These features need something a browser cannot do alone, so part of your input leaves your device.
| Feature | What leaves your browser | Where the data goes |
|---|---|---|
| Site search | Your search terms | Our server. The search page also shows the terms in its address. |
| Server-backed generators and random quotes | The options you pick | Our server |
| My IP | Your IP address, on page load | Our server, then ip-api.com. The page also loads Google Maps. |
| Hostname lookup | The IP address or hostname you enter | Our server, then ip-api.com |
| Domain and nameserver lookups | The domain you enter | Our server, then the Verisign RDAP service |
| DNS lookup | The domain you enter | Our server, then nslookup.io |
| SSL certificate and security headers checkers | The domain or URL you enter | Our server, which connects to the site you named |
| MD6 hash generator | The text you hash | Our server |
| Performance profiler | The code you paste | Our server |
| Instagram photo downloader | The post link | Our server, then Instagram |
| Number to WhatsApp | Your IP address, on page load, to preselect a country code | ipapi.co, direct from your browser |
| Password security checker | The first five characters of the password's SHA-1 hash, never the password | Have I Been Pwned, direct from your browser |
| YouTube thumbnail grabber | The video ID | YouTube, direct from your browser |
Our server uses this input to build your result and writes none of the input to a database. Web server logs still record each request, including your IP address and the endpoint.
Keep real secrets out of the MD6 generator and the performance profiler. Use a test value, or run a hash or profile on your own machine.
3. The visit log
After a page loads, a script sends one record to our server. We store the record in our own database to read traffic patterns, find broken pages, and measure load speed. Each record holds:
- Your network details: IP address and time zone
- The visit: full page address with any query string, the page title, the page you came from, and the time
- Your browser and device: user agent, languages, platform, screen size, CPU core count, device memory, and touch support
- Your connection: connection type, speed estimate, and round trip time
- Page speed: load, render, and download timings
- Battery: charge level and charging state, in browsers exposing them
- Your Do Not Track setting: we record this setting, and the log runs either way
The record holds no name or email address for visitors. Tool input stays out of the log, with one exception. Some calculators, converters, and text tools put your values into the page address when you use a share or copy link button, and the responsive website tester does so as you work. Anyone opening such a link sends those values to the visit log and to Google Analytics as part of the address. Leave private values out of shared links.
4. Cookies and browser storage
| Type | Set by | Purpose | Lasts |
|---|---|---|---|
Session and XSRF-TOKEN cookies | Toolexe | Protect server-backed tools against forged requests. Set only when a tool calls our server, not on a normal page view. | About two hours |
_ga and _ga_* cookies | Google Analytics | Tell returning browsers from new ones for traffic reports | Up to two years |
| Advertising cookies and pixels | Journey by Mediavine, Grow, and their ad partners | Select, limit, and measure ads, including ads based on your interests | Set by each partner |
Security cookies such as __cf_bm | Cloudflare | Separate people from bots when bot protection applies | About 30 minutes |
| Local storage | Toolexe tools | Hold saved notes, history, and settings on your device. Never sent to us. | Until you clear site data |
Toolexe's own code shows no cookie banner. Use the controls in section 9 to limit these cookies.
5. Analytics and ads
Google Analytics
Tool pages load Google Analytics, which reports page views, page addresses, device types, and rough location. Read how Google uses data from sites using its services, or install the Google Analytics opt-out add-on.
Journey by Mediavine
Ads pay for Toolexe. Journey by Mediavine manages them, and its ad script loads on our pages along with Grow, its reader engagement script. These scripts and their ad partners use cookies and pixels to collect your IP address, device details, and browsing activity, then use the data to pick and measure ads. Mediavine's Legal and Privacy Center explains their practices. The ad script adds Journey's required privacy wording to this page, so you might see a further section below this policy.
Sale of personal information
We take no money for your tool input, email address, or visit log. Some US state laws still count cookie-based ad targeting as a sale or sharing of personal information. The advertising cookies in section 4 fall under those laws, and the opt-out links in section 9 apply to them.
6. Newsletter, email, and accounts
Newsletter. The footer sign-up stores your name, email address, subscription status, an unsubscribe token, and a count of failed deliveries. We also keep a copy of each email sent to you with its delivery status. Every email carries an unsubscribe link. Unsubscribing stops the emails and keeps your record, marked as unsubscribed. Email us to delete the record.
Contact form and email. The contact form posts your name, email address, subject, and message to our server, which accepts the request without saving or forwarding the content. For anything needing a reply, including a privacy request, email info@toolexe.com. We keep your email and your address to answer you.
Accounts. No tool needs an account. The sign-in pages exist for running the site, and an account there holds a name, email address, and hashed password.
7. Who receives data
- Cloudflare: delivers pages and assets, and handles your IP address and request details on each visit.
- Our hosting and mail providers: run the server, database, and newsletter delivery.
- Google: Analytics, Fonts, and Maps on the My IP page.
- Journey by Mediavine and its ad partners: ad delivery and measurement.
- Code hosts: cdnjs, jsDelivr, unpkg, and Hugging Face see your IP address when a page loads a library or model from them.
- Lookup services: the third parties named in section 2, for the tools listed there.
- Authorities: we disclose data when the law requires, or to protect the site and its users from abuse.
8. How long we keep data
- Visit log: records stay until we delete them. No automatic expiry runs today.
- Newsletter records and sent email copies: until you ask us to delete them, or we close the list.
- Emails to us: as long as we need them to handle your question.
- Session data: about two hours.
- Analytics and ad data: set by Google and by each ad partner.
- Local storage: on your device until you clear site data.
9. Your rights and choices
Depending on where you live, you hold the right to access, correct, delete, or export your personal data, to object to or restrict our use of the data, and to opt out of targeted advertising. EU and UK residents also hold the right to complain to a data protection authority.
Email info@toolexe.com and we will reply within one month. Tell us what to look for:
- Newsletter records: your email address.
- Visit log records: your IP address and rough dates. These records carry no name, so we cannot find yours without them.
We hold no copy of data collected by Google or by ad partners, so send those requests to them, or use the controls below.
- Google Analytics: the opt-out add-on.
- Interest-based ads in the US: the DAA opt-out page.
- Interest-based ads in Europe: Your Online Choices.
- Any cookie: block or delete cookies in your browser settings. Server-backed tools need the session cookie, so blocking every cookie breaks them.
For EU and UK law, our legal bases are as follows. We answer lookup and generator requests because you asked for the result. We run the visit log and security measures under our legitimate interest in keeping the site working. We send the newsletter with your consent. Analytics and advertising cookies rely on consent where your local law requires consent.
10. Children, transfers, security
Children. Toolexe is not aimed at children under 13, or under the higher age your country sets. We do not knowingly collect their personal data. If you believe a child sent us personal data, email us and we will delete the data.
International transfers. Our providers process data in the United States and other countries. Your data leaves your home country as a result, and those transfers rely on the safeguards each provider offers, such as standard contractual clauses.
Security. Pages load over HTTPS and send security headers. One gap: our server reaches ip-api.com over plain HTTP, so an IP or hostname lookup travels unencrypted between those two servers. No system is free of risk, which is one more reason to keep secrets out of server-backed tools.
11. Changes and contact
When this policy changes, we update the page and the date at the top. We send no separate notice, so check back if a change matters to you. The Terms of Service cover the rules for using the tools.
Send privacy questions to info@toolexe.com.