Privacy-First Design

1. Privacy and data protection approach

Tool Fly is built to make a large set of practical utilities available without requiring an online account. Many common operations—such as editing a document, formatting text, resizing an image, calculating a value, or transforming a supported file—run in JavaScript in your browser. When a particular tool is operating locally, its working input and output remain in browser memory on your device rather than being uploaded to the Tool Fly application backend for that task.

“Privacy-first” describes a design objective, not a claim that the website makes no network requests or that every feature is offline. The browser must fetch the website and its resources. The contact form, speech service, admin sign-in, and local-profile password reset can communicate with a backend or email provider. External directory links take you to third-party services. We identify these exceptions so you can decide what to submit.

We aim to collect only what a selected feature needs to operate. We do not currently run a shared user database for ordinary profiles, build an advertising profile from the files you process, or use the local admin charts as global visitor analytics. However, local storage, mail delivery, web hosting, browser providers, and network infrastructure each have their own data handling behavior. This overview explains those boundaries instead of treating all processing as identical.

For the detailed legal notice covering purposes, choices, retention, service providers, and applicable privacy rights, see the Privacy Policy. This security overview is supplementary and should be read alongside feature-specific notices shown in the interface.

2. Product security: browser-based processing

What “processed in your browser” means

A browser-based tool uses code delivered to your browser to read the input, perform the requested calculation or transformation, and present a result. For tools that use this model, the application does not need to receive the source file for the operation. The browser may temporarily hold file bytes, image pixels, video frames, text, or generated output in memory while the tool is open. When the task completes, you can normally download the result or copy it elsewhere.

This approach can reduce file transfers and avoid storing many ordinary work files on an application server. It also means the task uses your device’s processor and available memory. Very large files, unsupported formats, low-memory devices, browser crashes, and tab closure can interrupt work. Do not close the page until a result has finished downloading, and keep your own source copy when the work matters.

Local processing is not the same as encrypted storage

Browser memory and browser storage are controlled by your browser and operating system. Tool Fly does not currently add a separate encryption-at-rest layer to data stored in localStorage or IndexedDB. Another person who can unlock the same browser profile or device may be able to access saved drafts, tool history, favorites, local profile data, or saved files. A browser extension, malware, device administrator, backup utility, or synchronization feature may also interact with browser data under its own permissions and settings.

When you select a file for a local tool, the browser can expose information needed for the task, such as the file contents, name, type, size, image dimensions, or duration. The local tool may use temporary object URLs, canvas data, media decoders, or in-memory buffers. These are implementation details of the browser task and do not imply that the original file is saved to our server. Your browser may maintain its own caches, crash reports, or download history independently.

Tool-specific limitations

Not every feature in a catalog entry is guaranteed to support every file or device. PDF forms, encryption, fonts, signatures, metadata, video codecs, audio formats, color profiles, and advanced document features can behave differently across browsers. A conversion may omit unsupported details. A video upscaler can enlarge a frame but cannot guarantee restoration of real image detail that was never captured. Review the output before sending, publishing, filing, or replacing the original.

The AI Assistant included in this project currently uses local rule-based functionality rather than sending your text to a remote generative model API. Temporary email is a local simulation; it does not provide a real external mailbox or receive incoming email. These statements describe the code currently in this project and must be revisited if a remote model, real mail provider, or other network integration is added later.

3. Data privacy and security by feature

Different features need different information. The table below summarizes the current intended data flows. Hosting and provider settings can vary between local development and a production deployment, so the site operator should verify these details against the services actually enabled.

The contact destination for public reports, requests, complaints, and feedback is toolfly8@gmail.com. The admin mailbox is reserved for operator authentication and is not the contact address shown to visitors. The backend uses the sender address supplied in the form as the reply-to address. It applies a rate limit and is configured not to log the contact message body. Once sent, the message can remain in sender, recipient, provider, and backup mailboxes according to their settings.

Text submitted to Text to Speech is sent to the configured Python service because synthesis is performed by that service. The current application is configured not to log submitted speech text or retain generated audio as an application feature. The process or hosting provider may still record ordinary request information. Do not submit confidential material unless you are comfortable sending it to the configured service.

When a profile password reset is requested, the email address is sent to the backend so it can deliver a one-time code. Ordinary registration and login remain browser-local. The reset flow does not turn the local profile into a cloud account or synchronize profile data across devices.

4. Browser profiles, passwords, and saved files

A profile is an optional browser convenience. The current implementation stores profile records in localStorage and associated saved files in IndexedDB. Profile records include the email address and creation time plus a random salt and derived password hash. The password is processed in the browser using the Web Crypto API with PBKDF2 and SHA-256; the current code configures 210,000 derivation iterations. This is a browser-local profile credential, not a server account credential.

The profile's password hash and salt are kept in the same browser storage origin as the profile record. Password hashing helps avoid storing the original password as plain text, but it does not encrypt the entire browser database or make a compromised browser profile safe. Someone who can read or alter the browser storage can access other local profile data, attempt password guessing against a hash, or bypass the interface by changing local data. Do not use a local profile as a vault for secrets.

Saved files may contain sensitive content. They are deliberately written to IndexedDB only after you use the save-to-profile feature. Their file contents, names, types, sizes, and save times remain in that browser profile until you delete them or clear site data. The current interface enforces a per-file size limit, but this is a usability limit, not a security boundary. Browser storage quotas can also vary and the browser may evict data.

Profile favorites, history, and drafts are stored locally and do not synchronize. Logging out removes the active-profile marker, but it does not automatically erase the profile, its history, saved files, favorites, or all local tool drafts. Use the relevant delete or clear controls, or clear this site's storage through browser settings if you want broader removal. Export anything you need before clearing data; deletion is not recoverable through Tool Fly.

Use a local profile only on a device and browser profile you control. On shared devices, sign out, delete saved files and drafts, and clear site storage after use. Private browsing can limit persistence after the private session closes, but does not prevent network providers from seeing requests or another person from viewing an open session.

5. Network communications and HTTPS

Whenever a browser loads a hosted website or calls an API, the request travels through network infrastructure. The requested host needs the source network address to return a response. Web servers, reverse proxies, hosting platforms, firewalls, email providers, and other services may process connection metadata such as an IP address, timestamp, URL path, status code, browser user-agent, and diagnostic information. These records are separate from the contents of a file processed entirely in the browser.

Production deployments should serve the website and APIs over HTTPS. The backend production mode requires a trusted TLS-terminating proxy to mark the request as HTTPS using the expected forwarded-protocol header; otherwise, it rejects the request. The hosting configuration in this project includes an HSTS directive and a content-security policy that upgrades insecure requests. These source settings do not prove that the deployment host applies them correctly, that every domain and subdomain is covered, or that certificates and proxy trust are configured properly. The live production deployment must be checked after publishing.

Local development may run over HTTP on localhost. Such local traffic does not receive the same protection as a publicly deployed HTTPS origin across an untrusted network. Do not expose development servers to the public internet. Before production, verify TLS from the browser to the edge, from the edge to the backend where applicable, redirect behavior, HSTS response headers, mixed-content warnings, and the exact set of allowed origins.

The browser may request third-party resources, including Google Fonts. A request for an external font can reveal connection information to Google under its own policies. Blocking the request may cause a fallback font to display. The AI Tool Explorer is also a directory of outbound links; Tool Fly does not generally proxy those visits or control the destination provider.

6. Admin sessions and privileged access

The admin workspace is an operator feature and is separate from ordinary visitor profiles. The admin sign-in sends a one-time code to the authorized operator mailbox through the configured email service. Successful verification creates a server-validated session. The browser receives an HttpOnly, Secure, SameSite=Strict session cookie scoped to the admin API. The session has no inactivity timeout and remains active until sign-out or the browser session ends. The local backend persists only a hash of the session token so a backend restart does not automatically sign the administrator out. Signing out removes the server-side session and expires the cookie.

HttpOnly prevents ordinary page JavaScript from reading the cookie; Secure instructs browsers to send it only over secure transport; SameSite=Strict limits cross-site cookie sending. These attributes reduce certain risks but do not protect a compromised device, malicious browser extension, stolen mailbox, unsafe server deployment, exposed app password, or insecure proxy. OTP email security depends on access to the operator mailbox and the security of the mail provider.

The backend currently keeps session state in process memory. Restarting the process can invalidate sessions. The admin dashboard's usage analytics and department/tool availability settings remain in browser storage until a shared database is connected. Those controls are not site-wide visitor surveillance, and local admin login should not be presented as a fully hardened production admin system without deployment-specific access controls, monitoring, backup, and recovery design.

We do not publish the admin mailbox on this page. It is reserved for administration and must not be used to submit public support requests. Never share an OTP, session cookie, Gmail app password, or backend secret with anyone claiming to be Tool Fly support.

7. Storage, encryption, retention, and removal

Browser storage

LocalStorage and IndexedDB can persist after you close a tab. They are scoped by browser origin and profile, not encrypted by a Tool Fly-managed key. Browser settings, private mode, storage quota, cleanup utilities, device resets, or browser updates can remove them. The user should not assume that a local profile or saved file is backed up or recoverable.

Server and email retention

The current code does not establish a single, fixed retention period for hosting logs, operating-system logs, reverse-proxy logs, delivered feedback email, email provider backups, or external resource requests. Some rate-limit counters and one-time-code/session records exist temporarily in backend memory and are lost when that process restarts. Actual log retention depends on how the backend and production host are run. The operator should set and document retention periods for production services and remove data when it is no longer needed, subject to applicable law.

The contact email provider receives the public feedback message. Copies can persist in the sender's sent folder, recipient mailbox, mail queues, backups, or security scanning systems. Deleting a message from one mailbox may not immediately remove every provider copy. The operator is responsible for securing the feedback mailbox and applying an appropriate retention process.

What deletion can and cannot do

Deleting a saved file or clearing browser storage removes the Tool Fly copy available to that browser profile, subject to browser storage behavior. It does not remove downloaded files, screenshots, device backups, email already delivered, records held by a network or hosting provider, or content submitted directly to an external AI service. Tool Fly cannot remotely erase files that never reached our systems. To request action on an email or backend submission, contact the public address and identify the feature and approximate submission date.

We do not claim a particular cloud storage vendor, encrypted backup service, key-management system, or data-center region for this project. If those services are introduced in production, the operator should name or describe them in the Privacy Policy and update the retention and transfer details.

8. Providers, disclosures, and international access

Information may be handled by providers where a feature needs them: a website host to deliver pages, a backend host to run optional APIs, an email provider to send feedback or authentication messages, a configured speech model/service for speech synthesis, and Google Fonts for font files. The project may also include external directories linking to independent services. The providers and their locations may differ between development and production.

Providers can process connection data on systems in countries other than yours. Tool Fly does not currently publish a verified, complete subprocessor list, data-residency guarantee, or international transfer mechanism for all deployments. These details must be confirmed against actual provider accounts and contracts before launch. When you follow an external directory link, the destination provider handles its own interaction directly with you under its policies.

We do not sell personal information or use submitted files to build advertising profiles. Data can be disclosed if needed to deliver the feature you requested, protect the site from abuse, respond to a valid legal requirement, or protect the rights and safety of people and infrastructure, subject to applicable law. Any disclosure should be limited to what is reasonably relevant to the request or protection need.

9. Certifications, compliance, and trust claims

Tool Fly does not currently claim ISO/IEC 27001 certification, an independent security audit, eIDAS qualified trust-service status, SOC 2 attestation, or formal certification by a privacy regulator. No certificate should be inferred from the presence of security headers, a privacy page, a secure cookie, or a browser-based tool.

We also do not state that Tool Fly is universally GDPR compliant or compliant with every privacy law in every country. Whether a law applies depends on the operator, user, service, and relevant circumstances. The site is built to reduce some routine file uploads, but that design choice alone does not establish legal compliance. The project has not published an audited privacy management program or jurisdiction-by-jurisdiction legal assessment.

We will not display certification marks, compliance badges, or claims about infrastructure providers unless the operator can verify the claim, its scope, the certified entity, and the current validity period. Where legal rights apply, they depend on the relevant law and are not granted or removed by marketing language on this page.

10. Internal security and continuous improvement

This project is maintained as a software application. The code includes controls such as backend origin checks, security response headers, production HTTPS checks, rate limits on selected endpoints, input validation for contact messages, one-time-code authentication for the admin workspace, and server-side session validation. These are technical measures in the current source; their effectiveness depends on correct configuration, code maintenance, deployment controls, and the security of the surrounding systems.

Tool Fly does not currently operate a publicly documented centralized identity-management system for employees, a corporate password-rotation program, mandatory staff 2FA program, controlled office-access system, or formal employee onboarding/offboarding program. This project does not maintain those corporate facilities or programs, and it would be misleading to claim otherwise. The admin account is configured separately from public feedback and should be protected through the operator's email account security settings.

During development, changes may be reviewed, dependencies may be updated, and reported bugs may be addressed. This is not a promise of continuous security monitoring, guaranteed patch deadlines, a bug bounty, or a formal incident-response SLA. Independent testing and production security review are recommended before the site handles sensitive data at scale.

Responsible security reports

If you believe you found a security issue, report it privately to toolfly8@gmail.com. Describe the affected page or endpoint, approximate time, and safe steps to reproduce. Do not access another person's account, download their content, publish secrets, or include passwords, OTPs, or private files. We will assess reports based on the information available, but do not promise a specific response time or reward.

11. Security limitations and your shared responsibility

No website, browser, computer, mobile device, email account, or network is completely secure. Local processing can reduce transfers, but it cannot protect data from malware, a compromised browser, unsafe extensions, a shared login, screen capture, physical access, cloud sync on your device, or a malicious download. HTTPS protects transport to the endpoint when correctly configured; it does not encrypt your files after download or secure an infected device.

You choose whether to submit optional information. Avoid entering passwords, authentication codes, payment-card data, health records, confidential business documents, or another person's personal information unless a feature specifically requires it and you have determined that its handling is appropriate. Use a device you trust, keep it updated, use a screen lock, secure your email account, and remove local data from shared computers.

For important documents, legal records, financial decisions, employment submissions, school work, and safety-related tasks, verify the output independently and keep a separate original. A browser utility can fail, produce an incomplete result, or encounter a file it does not support.

12. Privacy controls available to you

• Use the website without creating a local profile. Most tools do not require an account.
• Before starting an operation, check whether its page describes local processing or a backend connection.
• Do not submit text to speech, contact forms, profile reset, or other network features if you do not want that information transmitted.
• Use profile controls to delete saved files, clear favorites, clear tool history, and sign out.
• Use your browser's site settings to clear this site's localStorage, IndexedDB, cache, and other site data. Clearing all site data may also sign you out and remove drafts.
• Use browser controls or extensions to block third-party font requests; the page may use a fallback font.
• When following an AI directory link, review the destination provider's current privacy and security information before submitting anything.
• Keep separate copies of important outputs; clearing the browser or losing the device can remove local data.

Browser menu names and controls differ by operating system and browser version. Clearing Tool Fly data does not erase browser history, downloads, email copies, external-provider records, or network and host logs.

13. Privacy rights and requests

Depending on applicable law, a person may have rights to be informed, request access, correct inaccurate information, ask for deletion or restriction, object to some processing, withdraw consent where consent is the basis, or receive a portable copy. These rights have local requirements and exceptions; this page does not claim that GDPR or another single law applies to every visitor. For example, the European Commission describes several rights available under GDPR when that law applies.

For a request about information sent to Tool Fly, email toolfly8@gmail.com with “Privacy request” in the subject and tell us which feature and approximate date are involved. Do not send passwords or one-time codes. We may ask for proportionate information to verify a request and prevent us from disclosing another person's information.

We cannot remotely inspect or erase data that remains only in your browser. Use the relevant profile controls or clear this site's data in your browser. If an email was already sent, deletion may need to be handled in the mailboxes and provider systems that hold it. We will review requests according to applicable law and the information available; if we cannot fulfill a request, we will explain the reason where appropriate.

14. Ongoing evaluation and policy updates

Privacy depends on the feature code and production setup, not just the wording of a policy. Before enabling a new API, analytics platform, advertising integration, online account system, cloud file storage, AI provider, payment feature, or email workflow, the operator should identify the information involved, the purpose, the provider, security controls, access, retention, and user choices. The relevant policy and feature notice should then be updated to match that real flow.

We may revise this page when the site changes, a provider is replaced, or a review identifies a clearer way to explain the current design. The date above indicates the most recent published revision. Review the sections on backend features, browser storage, network communications, and providers when a change affects those parts of the service. We will not treat this page as a substitute for verifying configuration in the live deployment.

Before deployment, the site operator should confirm the actual domain, TLS and HSTS behavior, API host, allowed origins, email providers, speech model, error logging, log retention, backups, support mailbox access, and any required jurisdiction-specific disclosures. The local development configuration can differ from production, and this page should be adjusted if that difference changes what visitors' information is handled.

15. Contact and complaints

For privacy questions, security concerns, requests, complaints, or feedback, email toolfly8@gmail.com or use the contact page. The feedback form sends your email address, topic, and message to the configured backend for delivery. Please include enough detail to identify the feature, but do not include passwords, OTPs, payment details, or private source files.

This page is a plain-language description of the current project, not a legal opinion, certification, audit report, or guarantee that all configurations are secure. It intentionally avoids claims about certifications and controls that have not been verified. Read the Privacy Policy for the separate legal notice describing personal information, purposes, retention, providers, and choices. The operator should obtain qualified legal and security review before production deployment.