Privacy Policy

How your data is processed

Every tool on TooloSea declares how it works, and that declaration is shown on the tool's own page. There are five kinds:

• In your browser. The tool runs as JavaScript on your own device. What you type or drop in never leaves the machine you are sitting at. You can disconnect from the internet after the page loads and the tool will still work — that is the simplest way to verify the claim for yourself.
• In your browser via WebAssembly. Same guarantee, used for heavier work such as image and PDF processing. Your file is read into your browser's memory, processed there, and never uploaded.
• On our server. A small number of tools genuinely cannot run locally. Where that is the case the page says so plainly before you use it. Your file is sent over an encrypted connection, held only while it is being processed, and deleted automatically within 60 minutes. We do not read the contents and we do not keep a copy.
• Via an external lookup. Tools such as DNS and IP lookups have to ask a network service a question. Only the value you enter — a domain name, an IP address — is sent. Nothing else about you goes with it, and we store neither the question nor the answer.
• From your request alone. Your browser has to tell our server its address in order to ask for any page, so a tool that only reads something back out of your own request looks nothing up and sends nothing anywhere. What Is My IP shows your address this way: it is read from the request, displayed, and never written to our database or our logs. The connection details beneath it — provider, connection type, approximate location — are a separate external lookup of that address, described above. That is why the page declares itself an external-lookup tool rather than this kind, and says so in the notice above the result.

What we record

We keep aggregate, non-identifying usage counts so we can tell which tools are worth improving and which are broken. For each event we store: the event name, which tool it concerned, a coarse device class (mobile, tablet or desktop), a two-letter country code, your interface language, and the hostname of the site that linked you here.

We also store a visitor identifier, which is a salted hash that changes every day. It lets us count how many distinct people used a tool today. It cannot be reversed into an IP address and cannot be used to connect today's activity to yesterday's.

Searches on this site. When you use the search box here, we keep a count of the search term itself — lowercased, with a tally of how many times it has been searched and how many tools matched. A search that finds nothing tells us which tool to build next, which is the only reason we keep it. That count is stored on its own, with no visitor identifier, no country and no time of day attached, so it cannot be connected to you or to anything else you did here. This applies to our own search box only, never to anything you type into a tool.

When a tool fails. If a tool breaks while you are using it, we record what went wrong so we can fix it: the type of error, the error message, the line of our code it happened on, which tool it was, and a coarse browser name — Chrome, Safari, Firefox and so on, never your full browser identification string. Identical failures are stored once with a count, not once per person.

An error message can accidentally quote what caused it, so before anything is stored we strip file names and paths, email addresses, web addresses' query strings, long codes and tokens, and any long quoted passage — first in your browser, before it is sent, and again on our server. Stack traces are reduced to the lines that point at our own JavaScript; anything belonging to a browser extension or another site's script is discarded rather than recorded. We never store the content you were working on, the file you were processing, or its name.

What we deliberately do not record

The following are never written to our database or our logs, by design rather than by policy:

• Your IP address, in raw form, anywhere
• Your user-agent string — only the device category and, on an error report, the browser name derived from it
• The full referring URL — only its hostname, because a full URL can contain a search query or a private document path
• Anything you type into a tool
• Any file you process, its name, or its contents
• Any output a tool produces for you

Our application logger strips values whose keys look like credentials or payloads before writing anything to disk, as a second line of defence behind never collecting them in the first place.

Cookies

We use as few as possible:

• Theme preference — stored in your browser's local storage, not sent to us at all, so the site remembers whether you chose light or dark.
• Session cookie — set only when you submit a form, to protect that submission against cross-site request forgery. Public tool pages set no session cookie.
• Consent choice — records whether you agreed to analytics, so we do not ask again on every visit.
• Bot protection — on the network tool pages only, Cloudflare Turnstile may store a short-lived value in your browser to avoid re-challenging you repeatedly. It is set by Cloudflare rather than by us, carries no advertising identifier, and is not used to track you between sites. See the section on bot protection below.

Analytics and advertising

We use Google Analytics to understand overall traffic patterns. It loads only after you agree — our Content-Security-Policy does not permit Google's domain to load at all until the consent cookie is set, so declining is enforced by the browser rather than trusted to our own code. IP anonymisation is enabled.

Bot protection on the tools that make an external lookup

A small number of tools answer your question by querying a paid data service — the Network lookups such as DNS, WHOIS, SSL and IP, and a few elsewhere on the site that work the same way, such as the currency converter. These are the only pages here that cost us money each time somebody uses them. To stop automated scripts running that bill up, they carry a Cloudflare Turnstile check.

You can tell which pages these are without taking our word for it: every tool states how it works in the notice directly beneath it, and the ones that say they query an external service are exactly the ones that carry the check. Every other page on this site loads no third-party script at all.

On those pages, your browser loads a script from challenges.cloudflare.com and Cloudflare sees that a request came from your address, in the same way any site you visit does. It is a privacy-preserving alternative to a traditional CAPTCHA: it does not ask you to identify traffic lights, it does not set an advertising identifier, and it does not track you across other websites.

Two things are worth being explicit about. First, this check is not gated behind the cookie banner, unlike analytics or advertising would be. It is a security measure necessary to provide a service you asked for — under the GDPR that is a different legal basis from consent, and making it optional would simply mean the tools could be used for free by exactly the automated traffic the check exists to stop. Our Content-Security-Policy names Cloudflare's domain on those pages and on no others, so the boundary described above is enforced by your browser rather than trusted to our own code.

Second, we do not send Cloudflare your IP address ourselves. Their verification endpoint accepts one and we deliberately leave it out: your browser has already spoken to them directly by that point, so passing it a second time from our server would add nothing and would contradict what this page says above about never sending your address anywhere.

Cloudflare's own handling of this is described in their privacy policy.

Public registry data shown by the lookup tools

WHOIS and IP registry records are public information published by domain registries and regional internet registries, and our lookup tools show you what those sources return. Since the GDPR, most registries redact the registrant's name, email, phone and address before publishing, and where that has happened our tools say so rather than pretending the record was empty. A few registries still publish contact details, and for those we show the record as published.

We are not the source of that data and we keep no copy of it: the record is fetched when you ask for it, rendered to your screen, and never written to our database. To have a registry record corrected or withheld, contact the registrar or registry named in the result — they are the only party who can change it.

Who is responsible for this site

TooloSea is published from Sri Lanka as an independently operated project, and is the data controller for the limited processing described on this page. Our publisher information page has the full details.

Your rights

Because we do not collect personal data, there is in practice nothing held about you to access, correct or delete. If you believe otherwise, or you want to ask about any of this, write to [email protected] and we will answer.

Wherever you live, you are welcome to exercise whatever rights your own law gives you — access, correction, deletion, portability or objection — by writing to that address. We do not ask which country you are in before answering, because the answer is the same everywhere: we hold nothing that identifies you.

Where the GDPR or UK GDPR applies, our lawful basis for the aggregate usage counts described above is legitimate interest in operating and improving the service. Consent is the basis for anything third-party, and you can withdraw it at any time by clearing this site's cookies.

Children

TooloSea is not directed at children and we do not knowingly collect information from anyone, of any age. Since no tool requires an account, we hold no user records of any kind — there is no sign-up in which an age could be given, and nothing that could be collected from a child that is not equally not collected from an adult.

Where a law sets a minimum age for consenting to online services — 13 under the United States' COPPA, 13 to 16 depending on the member state under GDPR Article 8 — that threshold applies to processing that relies on consent. The only thing here that does is analytics, and it is off until anyone of any age agrees to it.

Changes

If this policy changes we will update the date at the top. Material changes will be announced on the site rather than made quietly.