Privacy Policy
Last updated 26 September 2026
Rishibha Biyani and Arth Singhal operates Toolshed and is the data controller for the personal data described here. This policy explains what we collect, why, and what you can do about it.
1. What we collect
| Data | Why | Basis |
|---|---|---|
| Email address | To identify your account, sign you in, and send account emails such as password resets | Performance of our contract with you |
| Password (hashed) | To authenticate you. Stored only as a bcrypt hash — we never see or store the password itself | Performance of contract |
| Google account id, name and picture (only if you sign in with Google) | To sign you in and show who is signed in | Performance of contract |
| Your library — tools, categories, tags and notes | It is the product. We store it so we can show it back to you | Performance of contract |
| Sign-in times and failed sign-in counts | Security, and to throttle brute-force attempts | Legitimate interest in keeping accounts secure |
| Server logs, including IP address | To operate, debug and secure the Service | Legitimate interest |
2. What we do not do
- We do not sell your personal data. Not to anyone, for any price.
- We do not use your private library to target advertising. Sponsorship on the public directory is matched to the page being viewed, never to you or to what you have saved.
- We do not load third-party advertising or analytics scripts, which is why the Service does not need a cookie consent banner.
- We do not read your notes. No administrator of this Service can open another person's library — the capability does not exist in the software.
3. Cookies
We set one cookie: a signed session cookie that keeps you logged in. It is
strictly necessary, marked HttpOnly, SameSite=Lax
and Secure, and contains no personal data beyond your account
id. Signing out clears it. We set no advertising or tracking cookies.
4. Who else processes your data
We use a small number of providers to run the Service, each acting on our instructions:
- Hosting — runs the application servers.
- Database — stores your account and library.
- Email — delivers account emails such as password resets.
- Google — only if you choose to sign in with Google.
- Payments — if and when paid features are offered, a payment provider handles the transaction. Card details go to them directly and never reach our servers.
Some providers operate outside your country. Where data is transferred internationally, we rely on the provider's standard contractual clauses or equivalent safeguards.
5. Logos and external images
Tool logos are loaded from the tool's own website or a favicon service. Your
browser therefore makes a request to those hosts when a page renders. We send
referrerpolicy="no-referrer" so they are not told which page you
were on.
6. How long we keep it
Your account and library are kept until you delete them. Deleting your account removes them permanently and immediately — there is no soft-delete and no recovery window, so export first if you want a copy. Server logs are retained for a short period for security and debugging.
7. Your rights
You can, at any time:
- Access and export everything we hold — one click on your account page produces a complete JSON file.
- Correct your data by editing it in the Service.
- Delete your account and all its contents from your account page.
- Object or restrict processing based on legitimate interest, by contacting us.
Depending on where you live, you may also have the right to complain to a data protection authority. If you are in the EU or UK, that is your national supervisory authority.
8. Security
Passwords are hashed with bcrypt. Traffic is encrypted in transit. Session cookies are signed and marked Secure. Sign-in attempts are rate limited, and state-changing requests carry a CSRF token. No system is perfectly secure, and we do not claim otherwise; if a breach affects you, we will tell you.
9. Children
The Service is not directed at children under 13, and we do not knowingly collect their data. If you believe a child has created an account, contact us and we will remove it.
10. Changes
We may update this policy. Material changes will be notified in the Service or by email before they take effect.
Questions about this page: arthsinghal24@gmail.com.