Privacy Policy

ToolsOnDuty ("we", "us", "our") respects your privacy. This Privacy Policy explains what information we collect, how we use it, and the choices you have when you use toolsonduty.com (the "Service"). It applies to visitors worldwide, including in the European Economic Area (EEA), the United Kingdom and the United States.

Shared wish background images

When you upload a custom background for a wish, the image is held in non-public cloud storage and made available through the card's hard-to-guess shared reference. Anyone with the greeting link can view the image. Supported JPEG, PNG and WebP images are limited to 2 MB and five uploads per IP-based daily limit.

The uploaded image expires after 24 hours. After expiry, the greeting remains usable with its selected built-in background. Creation limits use a secret-keyed one-way hash of the connecting IP address; the raw IP address is not stored in the image record. Do not upload confidential images or images you do not have permission to share.

Tools run in your browser

Most of our tools run entirely in your browser. The text, files and values you enter into a tool are processed on your own device, are not transmitted to our servers, and are not stored or seen by us.

A tool that transmits or temporarily stores user-submitted data displays a clear notice above its interface before you use it. Selecting a file in a browser-only tool does not upload that file. A file leaves your device only when the tool explicitly says that it uses server processing or temporary cloud storage.

Network-assisted tools

Some tools need a network request to perform a public lookup, measure a connection or create a shareable service. Public lookup tools transmit the value needed for the request, such as a domain name, IP address or URL, to ToolsOnDuty or the named lookup provider. They do not upload a locally selected file unless an on-tool notice explicitly says so. Those providers may process standard network and security logs under their own policies.

Information we collect

• Usage and analytics data: aggregated, anonymised information such as which pages are visited, approximate region and device or browser type, collected using cookies or similar technologies to help us improve the site.
• Technical and log data: standard server, CDN and security logs (such as IP address, browser type and timestamps) processed by our hosting and security providers to keep the Service running and protect it from abuse.
• Information you send us: if you contact us by email, we receive your email address and whatever details you choose to share.
• Temporary shared data: when you create a greeting link, use the URL Shortener, create an Online Clipboard share, Webhook Inspector bin or Temporary Mock API, we receive and store the information needed to make that feature work, as described below.

We do not require an account, name or payment details to use the tools, and we do not knowingly collect sensitive personal information.

Online Clipboard storage

Online Clipboard content is held temporarily in non-public cloud storage. We process the shared content and limited operational information such as its access code, type, filename, size, creation and expiry times, and retrieval count. Anyone with the code or private link can retrieve the content, so share them only with the intended recipient.

A share expires after 24 hours or three confirmed retrievals, whichever happens first. The creator receives a private deletion token that can remove the content and its operational record immediately. The token itself is not stored; only its one-way hash is retained. Failed or interrupted file transfers are not acknowledged as completed retrievals.

Creation and retrieval attempts are limited using a secret-keyed one-way HMAC hash of the connecting IP address. Do not upload passwords, private keys, medical records or other sensitive information. Online Clipboard is temporary transfer storage, not an encrypted vault or backup service.

Short links and temporary storage

A short link cannot redirect without a stored mapping. When you use the URL Shortener, we store the original destination URL, generated short ID, approved service name, source site, creation time and expiry time in Cloudflare D1. The short link works for 10 days. After expiry, the mapping is no longer returned and is removed through scheduled or opportunistic cleanup.

To enforce the free limit of 10 links per IP address per UTC day, our Cloudflare Worker converts the connecting IP address into a salted one-way HMAC hash. The short-link record does not contain the raw IP address. Cloudflare may still process IP addresses in standard network and security logs as described above.

Do not shorten URLs containing confidential access tokens, private document keys or personal information you do not want stored temporarily. The allowlist checks the destination host and path, but cannot guarantee or endorse user-created content hosted by an approved platform.

Temporary developer tools

Webhook Inspector stores captured request methods, paths, query values, bounded headers and bodies in Cloudflare D1 for up to one hour, with at most 50 requests per bin. Authorization, cookie and common API-key header values are redacted before storage. Deleting the bin removes its stored events immediately.

Temporary Mock API stores the status, safe response headers, content type, delay and static response body you configure in Cloudflare D1 for up to 24 hours. Requests sent to the generated endpoint are served but their headers and bodies are not stored. Deleting the endpoint removes its configuration immediately.

Shared greeting and wish cards

Creating a compact greeting or wish link stores the card text and selected design settings in Cloudflare D1 for 30 days. Photos selected in the general Greeting Card Studio stay in the browser and are excluded from shared links. For focused wish cards, a custom background is uploaded only when you choose the upload option and is handled as described under Shared wish background images.

Cookies and similar technologies

We use a small number of cookies and similar technologies:

• Essential: needed for the site to work and to remember your cookie choices.
• Analytics: help us understand aggregated usage so we can improve the Service.
• Advertising: if enabled, our advertising partners use cookies to serve and measure ads.

In the EEA, the UK and other regions that require it, non-essential cookies are only set after you consent through our cookie banner. You can change or withdraw your consent at any time, and you can manage or delete cookies in your browser settings.

Advertising and Google AdSense

We may display advertising, including through Google AdSense and its partners. Third-party vendors, including Google, use cookies to serve ads based on your prior visits to this and other websites. Google's use of advertising cookies enables it and its partners to serve ads to you based on your visits to our site and/or other sites on the internet.

• You can opt out of personalised advertising in Google Ads Settings.
• Learn how Google uses data from sites that use its services at Google's partner sites policy.
• You can opt out of some third-party vendors' advertising cookies at aboutads.info and youronlinechoices.eu.

Where required by law, we ask for your consent before advertising cookies are used.

Legal bases for processing (EEA / UK)

If you are in the EEA or UK, we process personal data on these legal bases: our legitimate interests (to operate, secure and improve the Service), your consent (for non-essential cookies and personalised ads), and compliance with legal obligations.

International data transfers

We and our providers may process data in countries other than your own, where data protection laws may differ. Where required, appropriate safeguards (such as standard contractual clauses) are used to protect your information.

Data retention

Because most tools run on your device, we do not retain the content you enter. Technical logs and aggregated analytics are kept only as long as needed for security and to improve the Service, and are then deleted or anonymised. URL Shortener mappings stop working 10 days after creation and are then eligible for automated deletion. Online Clipboard shares expire after 24 hours or three confirmed retrievals and can be deleted sooner by their creator. Webhook Inspector bins expire after one hour, Temporary Mock API configurations after 24 hours, and compact greeting or wish card data after 30 days. Custom wish background images expire after 24 hours, after which the selected built-in background is shown. Rate-limit hashes are retained only for short-term limit enforcement and cleanup.

Your privacy rights

Depending on where you live, you may have rights over your personal data, including the right to access, correct, delete or receive a copy of it, to object to or restrict certain processing, and to withdraw consent at any time.

• EEA / UK: you have rights under the GDPR and UK GDPR and may lodge a complaint with your local data protection authority.
• California (CCPA/CPRA): you have the right to know, delete and correct personal information, and to opt out of its "sale" or "sharing". We do not sell your personal information.

To exercise any right, email us at [email protected].

Children's privacy

The Service is not directed to children under 13 (or the minimum age required in your country), and we do not knowingly collect personal information from them. If you believe a child has provided us with personal information, please contact us and we will delete it.

Third-party links

Our site may link to third-party websites. We are not responsible for their content or privacy practices, so please review their policies before sharing information with them.

Third-party services

We rely on trusted providers for hosting, content delivery, security, analytics and advertising. These providers process limited data on our behalf to operate the Service.

Changes to this policy

We may update this policy from time to time. The date at the top shows when it was last changed, and significant changes will be reflected here.

Contact

Questions about this policy? Email us at [email protected].