Legal
Privacy policy
Last updated . This policy covers Toolspike and the tools published on it.
Summary
Toolspike does not want your files. Most of the tools run inside your browser, so the contents of the documents, images and spreadsheets you open are never sent to us and never stored by us. There is no advertising.
The exception is the AI and OCR tools. Those cannot run in a browser, so they send your file to an external provider. The providers are named in the section below. If you never use those tools, no file of yours ever leaves your device.
Accounts are optional. Every tool has a free trial each day without one, and you are never asked who you are in order to use that free trial. Runs beyond that use credits, which belong to an account; the section on accounts below sets out exactly what is collected and by whom.
The sections below describe the full picture, including the things that do happen, such as ordinary web server request logs at the hosting layer.
Files you process
Every browser-based file tool on this site reads your file with the browser File API, works on the data in the page, and returns the result as a download. No request carrying the file is made, because there is no endpoint to receive one.
As a consequence, for those tools we cannot see your files, cannot recover them, and have nothing to delete on your behalf. File contents are never transmitted, never written to a server and never retained. Once you close or reload the tab, the working copy in memory is gone.
When a tool page opens, and again before each run of a browser tool, the page asks our server whether the run is free or needs credits; if a run then fails, a second request gives back what it used. Like every request to this site, these carry the tool’s name, your cookies and your IP address. They never carry your file or anything taken from it.
You can confirm this yourself: open the Network panel in your browser developer tools and run a conversion, or disconnect from the network after the page has loaded and process a file anyway.
The AI and OCR tools are different
Handwriting recognition, equation and table extraction, screenshot-to-code and translation cannot run inside a browser. Every one of those tools transmits the file or text you give it to an external provider for processing. The providers used are Google Gemini, Mathpix, Google Cloud Translation and USDA FoodData Central.
Your file or text is not transmitted until you act: it stays on your device until you press the button that starts the job.
We do not write your uploads or the results to our logs, and we do not keep a copy. What the provider does with the content is governed by that provider’s terms, not ours.
Where a provider is used on a free tier, it may use the content you send to train and improve its own products, and its staff may review it. Do not use these tools for material you are not permitted to send to a third party, and treat them as unsuitable for confidential, sensitive or personal documents.
If that is not acceptable for a particular file, use one of the browser-based tools instead, or do not use the tool.
Accounts
Creating an account is optional: the free daily run of every tool works without one. If you choose to sign up, authentication is handled by Clerk, a specialist identity provider, and not by us. Your password is never seen by, sent to or stored by Toolspike.
Clerk holds the identity record on our behalf as a processor. Depending on how you sign up, that is your email address, a password hash, and — if you use “Continue with Google” — the name, email address and profile picture Google returns. Clerk also records sign-in events and the device and IP address they came from, which is what makes it possible to detect a stolen session.
Signing in sets a session cookie. It is strictly necessary: it is what keeps you logged in between pages. It is not used for advertising, profiling or cross-site tracking, and there is nothing to consent to because the site cannot log you in without it.
Your account is never linked to the files you process. For browser-based tools the files are never transmitted at all; for the AI tools we do not record which account sent which file. Signing in does not change where a tool runs.
Your credits are stored with your account at Clerk: the balance and its expiry, today’s free credits, whether the sign-up bonus has been given, and the IDs of recent purchases. The record holds amounts only, not which tool or file credits were spent on. Deleting your account deletes it, including any unused credits.
You can view, correct or permanently delete your account at any time from the account page. Deleting it removes the identity record from Clerk.
The email checker
When you check email addresses, they are sent to our server, which looks up each domain’s public DNS records through the public resolvers of Cloudflare and Google. The addresses are processed in memory and are not logged or stored, and no connection is made to the recipient’s mail server. The DNS answers for a domain are kept in memory for up to ten minutes so repeated checks are faster.
To stop abuse, the number of checks is limited per network. The count is kept only in memory, against a pseudonymised form of the IP address.
What is stored on your device
The site stores a few things in your browser: your appearance preference, the free-trial cookie described under cookies below and, if you install the app, cached page files so the browser tools open offline.
- A theme preference (light, dark or follow the system) is written to localStorage so the site does not flash the wrong theme on your next visit. It stays on your device, is never transmitted, and you can remove it by clearing site data in your browser.
- Some tools keep the settings you last used within the current page session so that the form is not reset while you work. This is held in memory or in browser storage on your device and is not sent anywhere.
Server request logs
The site is served by a hosting provider, and like almost every web host it may record standard request information for operational and security purposes. That typically includes the requested URL, a timestamp, an HTTP status code, the user agent string and the originating IP address.
These logs are a property of the hosting infrastructure rather than something the application creates, and they are not joined to any profile because no profile exists. They contain nothing about the files you process, because browser-tool files are never part of a request and the AI tool routes do not log what they receive.
Third parties
Fonts, styles and the site’s own scripts are served from the same origin as the site, so loading a page does not disclose your visit to a separate font or script service. The two analytics scripts described above are the exceptions: Google Analytics loads from Google’s servers and Cloudflare Web Analytics from Cloudflare’s.
Clerk is a further exception, and only on pages where the sign-in controls are present. Its interface loads from Clerk’s own domains and talks to Clerk directly, which means Clerk can see your IP address and browser when that happens. It is bound by its own privacy policy and acts as a processor for the identity data described above.
Paddle is another, and only if you open the checkout. Paddle is our Merchant of Record: it is the seller for the purchase, and it collects your billing details and payment information directly. We never see or store your card details. When you open checkout we pass Paddle your account’s email address and an internal account ID, so the purchase is added to the right account. Paddle tells us only that a purchase succeeded and which pack it was, so we can add the credits to your account.
The tools are built on open-source libraries that are bundled into the site and executed in your browser. They are code running on your device, not services being called; using a tool does not send anything to the projects that wrote those libraries.
Links to external sites are occasionally included in written content. Once you follow one, the privacy practices of that site apply instead of this policy.
Some of those links are affiliate links, and they are labelled where they appear. An affiliate link carries a code identifying us as the referrer; following one lets the destination set its own cookies and see that you arrived from here. We receive only aggregate commission reporting from the partner — not your name, your payment details or what you browsed on their site.
Contact and request forms
The contact form and the tool request form send what you type to our own mailbox through a transactional email service, Resend, so that a person can read and answer it. Where no mail service is configured, the form says so and refuses to submit rather than pretending to send.
What is transmitted is exactly what you type: for the contact form your name, email address, chosen subject and message; for the request form the tool name, the problem you describe and your email address if you choose to give one. Your address is attached as the reply-to so we can answer you.
Those messages, and any email you send directly to [email protected], exist in that mailbox for as long as is needed to answer you. Nothing from either form is written to our application logs.
Children's data
The site is not directed at children. No identifying information is requested to use a tool, and the free daily run of every tool works without an account.
Accounts are intended for adults. If you are under 18, please do not create one without the consent of a parent or guardian. If we learn that an account belongs to a child and was created without that consent, we will delete it.
Your data and your choices
We do not make legal certification claims here, and no external body has audited this site. What we can describe accurately is the practice: analytics limited to aggregate page-view measurement, no advertising identifiers, no sale or sharing of data, and no transmission of file contents.
If you have never created an account, the application keeps nothing that names you: only the short-lived, in-memory network counters described above and the cookies and preferences on your own device, which clearing site data in your browser removes.
If you do have an account, you can see and edit what is held from the account page, and delete the account outright from the same place. You may also email us to ask what is held, to have it corrected, or to have it erased. If you have emailed us, you can ask for that correspondence to be deleted.
Security
The site is served over HTTPS. Keeping your files on your own device removes an entire category of risk, since there is no stored copy to be exposed by a breach on our side.
The corresponding responsibility is yours: a file processed on a shared or compromised computer is only as protected as that computer, and any result you download is an ordinary file on your disk.
Changes to this policy
This policy may change as the site changes, for example if a contact form is connected to a real inbox or if error reporting is introduced. When that happens, the text will be revised and the date at the top of this page will be updated.
Material changes, meaning anything that begins collecting information that was not collected before, will be described in the relevant section rather than absorbed silently into general wording. Previous behaviour will not be misdescribed as if it had always been the case.
Continuing to use the site after a change means the revised policy applies to your use of it, so it is worth checking the date if you rely on the specifics.
Questions
Questions about this policy can be sent to [email protected].
See also the terms of use and the explanation of how the tools are built.