Tools stay on your device. Live data asks for as little as possible.

The facts

• Accounts are optional, and every tool works without one. Sign in with a link to your email, or with Google — there is no password here. With Google, we receive your email address and Google’s number for your account, nothing else: no name, no picture, no access to your Google account.
• ToolsDev sets no cookies, shows no ads and runs no third-party script: the only code on these pages is ours. Page visits are counted without knowing who made them.
• We count how often each page is opened — per page, kind of screen, country and day — and, for the whole site, browser and system families, the sites that link here and how many people visited each day. No address, browser string or cookie is kept, and the daily visitor count uses a code that is deleted when the day ends, so nobody can be followed from one day to the next. Countries come from IP Geolocation by DB-IP (db-ip.com, CC BY 4.0). Do Not Track and Global Privacy Control are respected, and you can turn it off on the Your data page.
• Tools never upload: files, text and numbers you enter are processed in your browser.
• The camera, microphone and screen are used only by the tools that need them — device tests, the recorders, the audio tools and the QR scanner — only after your browser asks you. What they capture stays in the browser and is never uploaded; a recording reaches your files only when you save it.
• Reading a story aloud uses your browser’s own voices. Most speak on the device; a voice marked “online” is spoken by your browser maker’s service, which receives the text being read. Nothing is read aloud until you press Listen.
• Live pages contact only the open data sources listed below, and only for what they show.
• Your city, favourites, recent tools, saved lists, the last few inputs of the developer tools that offer “Recent”, the settings those tools were left with, requests you save in the Request Builder (always without their credentials), flashcard decks, planner tasks and habits, the documents and Billing Studio records you save, watermark sets you save in Image Studio, and your place, bookmarks, highlights, notes and saved words in Stories are kept on this device only. If you sign in, you choose whether your favourite tools, recently used tools and appearance are kept with your account to sync your devices — only those names and settings. What you type into a tool is never sent — with one exception you choose by using it: Smart Split keeps your groups, the names (and any emails) of the people you add, expenses, notes and recorded payments on your account, because everyone in a group must see the same books. Other members see names, never email addresses.
• Signed in, you can download everything your account holds from /my. Deleting the account erases it from our server at once and from our backups within 14 days. Sign-ins last 30 days.
• “Buy me a coffee” has no payment gateway: the UPI QR code is drawn on your device and the money goes from your UPI app straight to the owner’s bank. We never learn who paid, how much, or whether anyone did.
• If a page breaks, it sends us a short error report with personal details removed. You can turn that off on the Your data page.
• If a tool gives a wrong answer, “Report a wrong result” under it sends us the tool’s name and what you write — never what you entered in the tool. A person reads every report.

Data sources this site can contact

Nothing is requested until you use a live feature. Weather, news, currency rates, holidays, the dictionary (on its page and in Stories, where only the word you look up is sent), bank branches, jokes and book search all go through our own server, which fetches from the original source itself, so that source never sees your browser. Text recognition in the PDF tools downloads its language files from this site; your document stays in the browser. The few sources below that your browser does contact see your IP address and our site’s address, never the page you are on.

• ToolsDev API (Operated by ToolsDev) — Our own server at api.toolsdev.in. Before its first request a page solves a small puzzle the server sets, which takes a fraction of a second, and gets a pass for half an hour; the pass holds a scrambled form of your connection’s address so it only works from there, lives only in the page’s memory and is sent with each request. For weather: the place name you type into the city search, and the rounded coordinates (about 1 km) of the city you chose — or, once after you tap “Use my location”, of your position, to name the nearest town. For an IFSC lookup: the code you type. For world holidays: the country and year you pick. For a dictionary lookup: the word — sent inside the request rather than in its address, so it stays out of the server’s access log, and stored as a definition of that word with nothing recorded about who asked. The search box asks the same way, and only once you stop typing: “weather in Pune” sends the place name, then its rounded coordinates; “meaning of ephemeral” sends the word; an IFSC code sends the code. Sums, unit conversions and bank-holiday questions are worked out on your device; a currency question fetches the day’s rates and sends nothing about what you asked. Each page you open: its path, whether your screen is a phone, tablet or desktop and, for the first page of a visit, the name of the site that linked to it — added to daily counts. The server also reads, from the request itself, the country your connection is in (looked up in our own copy of DB-IP’s database) and your browser and system families (“Chrome”, “Android”), and counts you once a day as a visitor using a code made from your address and browser under a key that is thrown away when the day ends. The address and browser details themselves are never stored, no cookie is set, and nothing links one day to the next. Never sent if your browser asks not to be tracked, and you can turn it off on the Your data page. If a page breaks, an error report: the page’s path, the site version and the error message with quoted text, emails, link details and long numbers removed — no address or identity is stored, only a daily count per error, kept 30 days, and you can turn it off on the Your data page. If you use “Report a wrong result” on a tool page: the tool’s name, the kind of problem you pick and the note you write, with email addresses and link details removed — nothing you entered in the tool unless you type it into the note yourself, and no address or identity is stored; kept 180 days for a person to check. For jokes: the language you pick. For stories written for ToolsDev: the number of a story you open. For Buy me a coffee: nothing — the page only asks for the owner’s UPI details, and the payment itself never touches our server. For books: what you type into the book search — in the request body, never its address — and the id of a book you open; a search is kept a day under a scrambled key, with nothing about who asked. It fetches news, jokes, currency rates, holiday lists and branch details itself, on a schedule or on request, so none of those sources ever sees your browser. Answers are cached and nothing is linked to you. If you choose to sign in: your email address, so we can send the link and know whose account it is — there is no password anywhere. Signing out ends that sign-in; deleting your account removes the address and everything with it (see the table below). For Smart Split, once signed in: the groups you create, the names and any email addresses of the people you add (an address is used only to join that person’s account to the group when they sign in, or for one invitation email if you ask for it), and each expense, note, tag and payment you record — stored so that the members of the group see the same figures; other members see names, never addresses. A receipt or payment screenshot you attach is sent to our server, which keeps only a re-drawn copy (no location, camera or other details from the original file), outside the public website, shown only to that group’s members; removing one hides it from them. Reading the total off a receipt happens on your device and sends nothing. If you save a UPI ID in Smart Split’s settings, it is shown to the people in your groups so they can pay you; your email address never is. Smart Split emails you about payments to confirm, reminders and expenses you are in — as they happen (bundled), once a day, or never, as you choose in its settings. Deleting your account removes your address and account; your name stays on the groups you were in so the other members’ books still add up. Everything on this site that does not need an account works without one. Like any web server, its hosting keeps standard access logs (IP address, time, address requested) for security.
• Have I Been Pwned — Pwned Passwords (No licence or attribution requirement) — The first 5 characters of a password’s SHA-1 hash — never the password.
• Wikimedia (CC BY-SA 4.0) — Nothing about you — article images load from Wikimedia’s image servers. The text comes through our server.
• Open Library (Catalogue data CC0; covers belong to their publishers) — Book covers load straight from Open Library’s cover store (run by the Internet Archive), so it sees your IP address and which covers are shown, as any image host does. Your searches and the books you open go through our server, not to Open Library.

Cookies and storage on your device

ToolsDev sets no cookies, and no one else can set one through these pages. The site keeps your settings, favourites, saved cities and similar things in your browser’s own storage, on this device, because you used the feature that needs them; none of it is sent anywhere unless you sign in and turn syncing on. Your data page lists it, lets you download it and deletes it.

The separate administration site, used only by the people who run ToolsDev, sets one sign-in cookie for them. Visitors never reach it.

No ads, no trackers

ToolsDev shows no advertising and carries no analytics, tracking or advertising script. Every script on these pages is our own: the site’s security policy forbids loading code from anywhere else, and our build fails if an ad network or tracker ever appears in it. What you type into a tool, your account details and your saved data are never given to anyone.

What our server keeps, and for how long

Using the tools leaves nothing on our server. This is everything it can hold about you.

Your account

Email address; with Google, also Google’s number for your account. The name you choose, the exams you follow, your language, the day you joined and when you were last seen.Until you delete the account.

Practice and saved questions

Papers you attempted and your answers, saved questions, and your plan.Until you delete the account.

Synced settings

Favourite tools, recently used tools and appearance — only if you turn syncing on.Until you turn syncing off or delete the account.

Sign-ins

A scrambled copy of the key your browser holds.30 days, or until you sign out.

Sign-in links

The email address a link was sent to, and the first part of the internet address that asked.1 day, used or not.

Record of a deleted account

That account number so-and-so was deleted, when, and the first part of the internet address. Never the email address.2 years, as part of the security record.

Error reports

The page, the site version and the error, with personal details removed, counted per day. No address or identity.30 days. You can turn them off on the Your data page.

Reports of a wrong result

Only if you send one from a tool page: the tool, the kind of problem you picked and the note you wrote, with email addresses and link details removed. Nothing you entered in the tool, no address or identity.180 days.

Visit counts

How many times each page was opened each day, on phones, tablets and desktops. No address, no cookie, nothing about who.400 days. You can turn counting off on the Your data page.

Abuse limits

A count of recent requests under a scrambled form of your internet address.Minutes — each count ends with its time window.

Server error logs

What went wrong and on which address of ours. No internet address or account.14 days.

Backups

A nightly copy of the database, so everything above.14 days, so a deleted account is gone from every copy within 14 days.

Access logs

Your internet address, the time and the address requested, kept by our host for security.Under the hosting provider’s own policy; we do not set or read the period.

We do not sell or share any of it, and none of it is used for advertising. Our server and database are hosted in Hostinger’s data centre; email sign-in links are sent through our mail provider; with Google sign-in, Google confirms who you are.

How that is enforced

The site is served with a Content Security Policy that lets the page connect only to its own address and the sources listed above. Even if a tool wanted to send your data somewhere else, the browser would block it.

Your location is never read unless you tap “Use my location”, and your browser asks you first. Coordinates are rounded to about a kilometre before they are used or saved.

Processing locally means nothing is uploaded. It does not make a shared or compromised device safe, and it does not make a file forensically clean — each tool's notes say where that matters.

Export or delete what is stored

The Your data page forgets your city, downloads everything this device has saved as one JSON file, or deletes all of it. Clearing your browser's site data does the same. Signed in, the same page downloads everything your account holds and deletes the account.

To correct something, ask a question about your data or complain about how it is handled, write to us from the contact page.