Privacy Policy

Last updated: 2026-09-23

This Privacy Policy explains, in plain English, what Toolstash ("we", "us") collects when you use the Toolstash website, why we collect it, how long we keep it, and how you can see, export or delete it. By using Toolstash you agree to the practices described here.

What we collect, and why

• Account information. When you sign up with email or with Google, we store your email address, a display name, and (for Google sign-in) your Google profile name and avatar image. We never receive your Google password. Basis: this is how we give you an account.
• Content you create. Upvotes, feedback, tool suggestions, notes, saved links, and any URLs you submit for summarisation. Basis: this is the service you asked for.
• Usage and AI logs. Which pages you view, actions you take, and a record of AI features you use (so we can show you your own usage and keep the service reliable). Basis: operating and improving the service.
• Page visits. Every page load is logged with the page path, referrer, a coarse country/city, device type, and a shortened IP address (the last part is removed before it is stored, so it no longer points to one device). After 30 days even the shortened IP is cleared from that row, and the whole row is deleted after 13 months. We never show raw IP addresses in the owner console — only country. Basis: legitimate interest in knowing the site works and where visitors come from.
• Cookie choice. If you are visiting from the EEA, UK or Switzerland, we ask before loading analytics cookies and record your choice (see the cookie table below). Basis: consent, and (for the record of the choice itself) our legal obligation to be able to show what you agreed to.
• Billing. If you subscribe to Toolstash Pro, Stripe processes your payment; we store your Stripe customer/subscription id and subscription status, never your card details. Basis: performing the contract with you.

Cookies

Cookies we set, and what they do:

Vercel Analytics and Speed Insights (basic performance metrics) do not use cookies and run regardless of your choice.

How long we keep things

• Account and content: for as long as your account is active.
• Page visit IP addresses: cleared after 30 days; the visit row itself after 13 months.
• Cookie-consent records: kept for 5 years, the standard period for showing what was agreed to.

Who we share data with

We use trusted processors to run the service, and only share what each one needs to do its job: Supabase (database and authentication), Vercel (hosting, analytics, performance monitoring), Stripe (billing), Resend (transactional email), OpenAI (AI summaries and analysis of content you submit), and Google Analytics (site usage, only after consent where required). We do not sell your personal information.

Your rights

You can access, export, correct, or delete your personal information at any time:

• Download your data. Your account page has a "Download my data" button that gives you a copy of your account, credit history, saved content and cookie-consent history.
• Delete your account. The same page has a "Delete my account" option, which cancels any active subscription and permanently removes your data.
• Change your cookie choice. Use "Cookie settings" in the footer at any time.
• Anything else, including objecting to how we use your data, email us — see Contact below.

Security

We use industry-standard measures to protect your data, including encrypted connections and access controls. No method of transmission or storage is perfectly secure, but we work to protect your information and to limit who can access it.

Children

Toolstash is not directed to children under 13, and we do not knowingly collect personal information from them.

Changes to this policy

We may update this policy from time to time. When we do, we will revise the date at the top of this page. If the change is material, we'll ask for your cookie choice again.

Contact

Questions about this policy, or want to exercise any of the rights above? Email us at robertiuoras@gmail.com.