Privacy Policy

Who we are

Toolhast is operated by Al-Raziq Studio, based in Pakistan. For anything in this policy, including requests about your data, contact us at hello@toolhast.com.

Al-Raziq Studio is the data controller for personal data described in this policy.

What the tools collect: nothing

This is the part most privacy policies get to last, so it goes first here. Every tool on this site runs entirely in your browser. The word lists are downloaded to your device and all filtering, solving and scoring happens locally in JavaScript.

What you type into a tool is never transmitted to us. It is not logged, not stored, and not processed on any server. We could not produce a record of your searches if we were asked for one, because no such record is created.

Some tools keep small preferences in your browser's local storage — for example whether you chose the light or dark theme. That data stays on your device and is never sent to us. You can clear it at any time through your browser settings.

What we do collect

Contact form submissions

When you send a message through the contact form, we receive and store:

• the name and email address you enter;
• the subject category you choose and the message you write;
• a one-way cryptographic hash of your IP address, used only to limit how many messages a single sender can submit per hour; and
• your browser's user agent string, used to diagnose form problems.

We do not store your IP address itself. It is converted to a hash using a secret key before anything is written, and the original address is discarded. The hash cannot be reversed to recover your IP.

We use your email address only to reply to you. We do not add it to a mailing list, and we do not share or sell it.

Legal basis (GDPR): legitimate interests — responding to people who contact us, and protecting the form from automated abuse.

Analytics

We use Cloudflare Web Analytics, which is privacy-focused and does not use cookies, does not fingerprint visitors and does not track people across sites. It reports aggregate figures such as how many people viewed a page. It does not tell us who you are.

Legal basis (GDPR): legitimate interests — understanding which pages are useful, with no identification of individuals.

Hosting and security logs

The site is hosted on Cloudflare. Like any hosting provider, Cloudflare processes technical request data, including IP addresses, to deliver pages and protect against attacks. This happens at the infrastructure level and is governed by Cloudflare's privacy policy.

Legal basis (GDPR): legitimate interests — delivering and securing the service.

Cookies

We currently set no cookies of our own. The site does not use analytics cookies, and there is no tracking cookie behind a banner.

Your theme preference is kept in your browser's local storage, not a cookie, and is never sent to a server.

This will change if advertising is enabled, which is covered next.

Advertising

There are currently no ads on this site. We may display advertising in future, and this section describes how that would work so you know in advance.

If and when advertising is enabled, we may use Google AdSense. In that case:

• Third-party vendors, including Google, may use cookies to serve ads based on your prior visits to this website or other websites.
• Google's use of advertising cookies enables it and its partners to serve ads to you based on your visit to this site and/or other sites on the internet.
• Third-party vendors and ad networks may also use cookies, web beacons or similar technologies to collect information about your visits in order to measure and serve advertising.

You can review how Google uses this data at How Google uses information from sites or apps that use our services.

You can opt out of personalised advertising through:

• Google Ads Settings — for Google's personalised ads;
• aboutads.info/choices — for participating US advertising networks; and
• Your Online Choices — for participating European networks.

Before any advertising is shown to visitors in the EEA or the UK, we will present a consent banner meeting the requirements of Google's consent policy, so that advertising cookies are set only with your permission. Declining will not restrict your use of any tool on this site.

How long we keep things

Who we share data with

We do not sell personal data, and we do not share it for cross-context behavioural advertising. We use a small number of service providers to run the site:

• Cloudflare — hosting, the database storing contact messages, and analytics.
• Resend — delivers the notification email when you submit the contact form.
• Google — only if advertising is enabled, as described above.

International transfers

We are based in Pakistan, and our service providers operate globally. If you are in the EEA or the UK, your data may therefore be processed outside your country. Where that happens we rely on the safeguards our providers put in place, including standard contractual clauses. You can reach us at hello@toolhast.com for details.

Your rights

If you are in the EEA or the UK (GDPR)

You have the right to:

• access the personal data we hold about you;
• have inaccurate data corrected;
• have your data erased;
• restrict or object to how we process it;
• receive your data in a portable format; and
• lodge a complaint with your local data protection supervisory authority.

If you are in California (CCPA/CPRA)

You have the right to:

• know what personal information we collect and why;
• request deletion of your personal information;
• request correction of inaccurate personal information;
• opt out of the sale or sharing of your personal information — though we do not sell or share personal information, so there is nothing to opt out of; and
• not be discriminated against for exercising any of these rights. Every tool works identically either way.

How to exercise them

Email hello@toolhast.com and say what you would like. In practice the only personal data we are likely to hold is a contact form message, so a request usually means finding and deleting that message. We will respond within 30 days.

Children's privacy

This site is not directed at children under 13, and we do not knowingly collect personal information from them. The tools themselves collect nothing from anyone. If you believe a child has sent us personal information through the contact form, email us and we will delete it.

Security

The site is served over HTTPS. Contact messages are stored in a database that is not publicly reachable, IP addresses are hashed before storage, and API keys are held as encrypted secrets rather than in our source code. No system is perfectly secure, but we keep the amount of data worth attacking as close to zero as we can.

Changes to this policy

If this policy changes — most likely when advertising is enabled — we will update the "Last updated" date at the top. Material changes will be described here rather than made quietly.

Contact

Questions about privacy go to hello@toolhast.com, or through the contact form.