Privacy Policy

Toolun is an online toolkit that runs inside your browser. This page explains what data we handle, where it is processed, and which features talk to third-party services.

Última actualización: 2026-09-08

In one sentence

Your files stay on your device by default. Images, PDFs, audio, video and text are processed entirely in your browser (WebAssembly, Canvas and Web Workers) and are never uploaded to Toolun's servers — in fact, Toolun has no server that receives files. Only a few clearly labelled tools send data to third-party APIs when you use them; see “Tools that use the network” below.

Local processing and local storage

To make the tools work well, we store some data in your browser. It lives only in your current browser profile, and we cannot read it:

localStorage: preferences such as theme and card density; recent items and favourites; the API endpoint and model names you enter in Settings; and, when you turn on “remember the key on this device”, the API key itself (stored in plain text, with an explicit warning on the settings page).
IndexedDB and OPFS (origin-private file system): workbench projects, history, batch queues and working copies of files, used to restore your work after a reload, support undo/redo and stage large files.
sessionStorage: page-local state only (for example, a flag that avoids a duplicate refresh after a deployment update); it is cleared when you close the tab.

You can clear recent items or wipe all local data at any time under “Settings → Local data”, or through your browser's site-data controls. Deleted data cannot be recovered because we keep no backup.

Tools that use the network

Most tools work fully offline. The following features contact third-party services when you trigger them, and only send the data required for that operation:

AI tools (AI chat, writing assistant, image generation, smart translation, cloud OCR, AI background removal, API connectivity check; marked network: 'api' in the registry and badged “API” on the card): they use a BYOK (bring your own key) model, and the key and request go straight from your browser to the provider you configure (OpenAI-compatible endpoints, DeepLX, OCR.space, remove.bg, and others). Text or images you submit are handled under that provider's privacy policy; Toolun neither receives nor logs them.
Query tools (IP location, weather, DNS, Whois, URL shorteners, online translation, exchange rates, speed test and similar): they send what you type (a domain name, a city, etc.) to public data APIs to fetch a result. Do not enter sensitive information into these inputs.
On-demand engines and models (marked network: 'cdn' in the registry, or otherwise relying on large assets): the ffmpeg core loads from jsDelivr or our asset domain; AI background-removal models and image-restoration (Real-ESRGAN) weights download from sources such as staticimgly.com and huggingface.co. These requests only download program files — they never contain your files — but the remote server sees your IP address and browser information like any other asset request.

Accounts and identity

Toolun has no account system: no sign-up or sign-in, no collection of names, email addresses or phone numbers, and no cross-site tracking or user profiling.

Hosting and analytics

This site is hosted on Cloudflare. As part of providing the service, caching and security, Cloudflare processes your requests (IP address, request headers and so on) at its edge; see Cloudflare's privacy policy for details.

We may enable Cloudflare Web Analytics to understand traffic and performance. It uses no cookies, stores no identifiers on your device and does no cross-site tracking; the results are aggregate figures (page, referrer, country/region, browser type).

Advertising

The site currently shows no ads. We may enable Google AdSense in the future to fund its operation. If we do, Google and its partners may use cookies or similar technologies to serve personalised ads; where the law requires consent (for example in the EU/UK), we will show a consent prompt before any ads are served, and you can decline personalised advertising. This policy will be updated when that happens.

Cookies

This site sets no cookies of its own. The local storage described above is not a cookie and is never sent to any server. Third parties (Cloudflare's security features, and any future ad service) may set cookies under their own policies.

Children

This site targets a general audience and does not knowingly collect personal information from children; since we collect no identity information at all, there is no data processing that would require parental consent.

Policy changes

This policy may be updated as the product changes; the date at the top shows the latest revision. Material changes (for example, enabling ads) will be called out prominently on this page.

Contact us

For any question about this policy or our data handling, email legal@toolun.com. See also our Terms of Use.

In one sentence

Local processing and local storage

To make the tools work well, we store some data in your browser. It lives only in your current browser profile, and we cannot read it:

localStorage: preferences such as theme and card density; recent items and favourites; the API endpoint and model names you enter in Settings; and, when you turn on “remember the key on this device”, the API key itself (stored in plain text, with an explicit warning on the settings page).

IndexedDB and OPFS (origin-private file system): workbench projects, history, batch queues and working copies of files, used to restore your work after a reload, support undo/redo and stage large files.

sessionStorage: page-local state only (for example, a flag that avoids a duplicate refresh after a deployment update); it is cleared when you close the tab.

Tools that use the network

Most tools work fully offline. The following features contact third-party services when you trigger them, and only send the data required for that operation:

AI tools (AI chat, writing assistant, image generation, smart translation, cloud OCR, AI background removal, API connectivity check; marked network: 'api' in the registry and badged “API” on the card): they use a BYOK (bring your own key) model, and the key and request go straight from your browser to the provider you configure (OpenAI-compatible endpoints, DeepLX, OCR.space, remove.bg, and others). Text or images you submit are handled under that provider's privacy policy; Toolun neither receives nor logs them.

Query tools (IP location, weather, DNS, Whois, URL shorteners, online translation, exchange rates, speed test and similar): they send what you type (a domain name, a city, etc.) to public data APIs to fetch a result. Do not enter sensitive information into these inputs.

On-demand engines and models (marked network: 'cdn' in the registry, or otherwise relying on large assets): the ffmpeg core loads from jsDelivr or our asset domain; AI background-removal models and image-restoration (Real-ESRGAN) weights download from sources such as staticimgly.com and huggingface.co. These requests only download program files — they never contain your files — but the remote server sees your IP address and browser information like any other asset request.

Hosting and analytics

Advertising