Privacy Policy

File processing — tools that run in your browser

Most ToolMink tools process your file entirely inside your browser. When you use one of them, the file is read and transformed on your own device. It is never transmitted to ToolMink or to any third party, and no server-side copy is created. When you close the tab, everything is cleared from memory.

You can confirm this yourself for any browser tool: open your browser’s developer tools, watch the Network tab while you convert a file, and you will see no upload of your document.

File processing — tools that upload

Several tools use our server for processing, and they say so before you pick a file: PDF repair, image extraction from PDF, PDF encryption, PDF decryption, and Excel/PPT conversion, alongside the other online processing tools. When you confirm on the page, your file is uploaded over an encrypted connection to our conversion server and processed there; tools that need one (such as encryption or decryption) also send the password you enter, only when the tool requires it. In the implementation shipped today, the conversion service holds your file (and job parameters) only in a per-job temporary working directory. That directory is deleted when the conversion request ends — normally after the converted file has been delivered to you, and earlier if the job fails or the request is canceled. The temporary copy is not shared and not used for anything else. File names and passwords are not logged and are not permanently stored, and your original files on your device are left untouched.

Upload tools are limited to 25 MB per file and share a daily free quota. This paragraph describes the behavior implemented in our own code today: the cleanup steps run on the normal ways a request can end (completion, failure, cancellation). We have not verified how the deployment recovers from an abnormal event such as a container or host crash, so we do not claim that a crash could never leave a temporary file behind. We have also not commissioned an independent audit of the production deployment, and we do not claim a retention schedule beyond what is described here.

Browser verification

Before a server upload or feedback submission, Cloudflare Turnstile verifies your browser. Cloudflare receives your IP address and browser signals for this security check. Our application does not log or store verification tokens, and files and feedback messages are not included in the Turnstile verification request.

AI planning in the Workbench

The Workbench can use an AI model to turn a plain-text description of your task into a suggested workflow. When you generate a plan, we send our server a short planning request containing:

• your instruction text;
• system aliases for the formats, sizes, and optional details such as pixel dimensions or page counts that the page offers you;

Our server forwards this planning request to the AI provider configured for the service. The files themselves — and their names, paths and contents — are not sent as part of a planning request. Files are processed in your browser unless you are using a tool that separately confirms an upload on its own page.

Please do not put secrets or personal details (passwords, keys, account numbers) into the instruction text — it is the one part of the request that is shared with the AI provider. In our own application code, the planning instruction body is not logged or stored. How long the provider keeps the request is governed by that provider’s own retention terms.

Planning requests are rate-limited with a separate daily quota, counted per UTC day using a salted hash of the trusted client IP, with per-request concurrency leases. This planning quota is distinct from the 5-conversions-per-day allowance that applies to file-conversion upload tools.

Usage statistics

Usage measurements on ToolMink do not capture file names or file content:

• Cloudflare Web Analytics — a cookie-free analytics script is loaded on every page. It counts visits and page views without cookies and without fingerprinting, and it does not build an advertising profile.
• First-party conversion events — tool pages send small metadata events to our own /api/evt endpoint. Each event records: a random per-session identifier (kept in sessionStorage, so it groups events within one browser session — it is not a permanent user identifier; the value is random, is not linked to who you are, and is not designed to recognize you over time), the tool path, input and output formats, the number of files, file sizes rounded to kilobytes, the processing duration, an error category, and the referring domain. Our server adds the timestamp, a two-letter country code and a coarse device class (desktop / mobile / other). Events never contain file names, file contents, IP addresses or cookies.

Self-hosted Umami — our analytics service records page paths, allowlisted UTM campaign tags, referring domains, browser and device categories, country, page performance and conversion metadata. It uses no tracking cookies. Account pages and automated tests are excluded. File names, file contents, account identifiers and unrelated URL parameters are not sent. Session replay and heatmaps are disabled.

The event rows are stored in our first-party analytics database. We have not yet configured an automatic deletion schedule for them. You can block these beacons with any content blocker — every tool keeps working without them.

Optional free account

File tools remain available without an account. An optional account saves your email, display name, password hash, sign-in sessions, favorites and settings. Workflow definitions are stored only when you choose to save them. Files you process are not added to your account.

Account data is stored in a separate Cloudflare D1 database. Passwords are hashed; we do not store their original text. Sign-in sessions include an IP address and browser information for security, expire after seven days and can be revoked from your account. Expired sessions, expired reset records and rate-limit records are removed daily. Unverified accounts are removed after seven days.

Resend receives your email address and verification or password-reset links to deliver account emails. These links expire after 30 minutes. We do not add you to a mailing list. Our application code does not log passwords, session tokens or email links.

You can change your display name, download your account data or delete your account from the account page. Deleting the account removes its saved favorites, settings and workflows. We do not sell account data or combine it with conversion analytics to build an advertising profile.

The optional feedback form stores the message, product, version and optional contact email you submit so we can investigate and reply. Feedback does not automatically upload files, paths or diagnostic logs.

Cookies, analytics and advertising

Essential preference: the "tm_lang" cookie remembers only the language you choose and is kept for 365 days. It stores nothing else — no files, contact details or tracking.

Account sign-in uses an essential, secure, HttpOnly session cookie with the tm-account prefix. It is used for authentication, lasts up to seven days and is removed when you log out. File tools do not require this cookie.

Cloudflare Web Analytics is cookie-free. Cloudflare Turnstile is used before protected uploads, account requests and feedback submissions. First-party conversion events go to our own domain. We do not set advertising or tracking cookies.

We use these measurements to understand which tools people use so that we can improve them. The measurements are not tied to your files and do not identify you.

Advertising is not enabled on ToolMink today. If we add advertising or another analytics service, we will name it in this policy — with what it sets and how to control it — before it starts collecting anything.

Server logs

Like any website, ToolMink is served through a hosting provider (Cloudflare), which may keep standard request logs — such as IP address, browser type, the page requested, and the time of the request — in order to operate and secure the service. For the tools that run in your browser, these logs record only the page you asked for. For online processing tools, the conversion request appears in those standard logs; the content of your file is not part of any log, and the uploaded file itself exists only for the duration of the conversion job described above.

Advertising

ToolMink is free to use. Advertising is not enabled on the site today: no advertising vendor — including Google — currently receives data from this site or sets cookies through it. This section stays in the policy so the rules are clear before any change:

• If we enable advertising, we will name every vendor in this policy before it goes live, together with the third-party cookies or similar technologies it would set and how to opt out of them.
• If third-party advertising cookies are ever used, they would typically be set by vendors such as Google on domains like doubleclick.net, to serve and measure ads, cap how often the same ad shows, and detect invalid traffic.

You can already control personalized advertising on other websites: change Google’s ad settings at Google Ads Settings, or use the Digital Advertising Alliance choice tool at www.aboutads.info. These choices are stored per browser and per device, so you need to repeat them on each browser and device you use. Opting out does not remove ads — it stops them from being personalized based on your prior browsing.

Changes to this policy

We may update this policy as the service changes. Material changes will be reflected in the "Last updated" date above. If we add an advertising partner or an analytics service, it will be added to this policy before it starts collecting anything.

See also our Terms of Service. For questions about this policy, or to make a privacy request, see how to contact us.