Privacy Policy

We value your privacy and are committed to protecting your personal information

Ads and privacy

Where applicable, open “Ad privacy settings” to change your preferences or withdraw consent. If you decline, Google may still show limited ads where permitted. Microsoft Clarity is controlled separately in “Analytics settings”; allowing analytics does not give consent for advertising.

Last updated: October 16, 2026

Current service operations and retention

This section describes our current handling of personal information on this site.

ToolAct is operated by Bin as an individual. We process account email addresses; account-profile details you choose to provide; per-account tool-usage records; and blog content that you choose to publish. Avatars are account-profile data retained without a fixed expiry. Blog content remains public until deletion; when it is deleted, we do not retain a backup copy.

Our primary application servers and file-processing services are located in mainland China. We use Tencent Cloud Email Push for account activation, password reset, and necessary service notices; its email-open and link-click tracking is not enabled. We use Tencent Cloud EdgeOne for global content delivery and security protection. We also process the account-profile information you choose to provide, such as your nickname, avatar, gender, birthday, and profile description.

For security and troubleshooting, we retain only the server logs needed for those purposes, for up to 30 days. Sensitive fields are redacted. EdgeOne offline access logs and delivery to Tencent Cloud Log Service (CLS) are not enabled. Uploaded source files and temporary processing files are deleted automatically when processing finishes. Converted results remain only until you download them or they expire. No conversion file is retained for more than 24 hours.

Microsoft Clarity is optional and loads only with your consent. You can change your preferences in “Analytics settings” at any time. We use Google AdSense to show ads, with separate ad privacy settings. EdgeOne provides global content delivery and may process technical data at the edge locations that serve your requests.

Tencent Cloud Email Push receives the recipient email address and the content required to deliver account emails. EdgeOne processes technical request data, such as IP address and request metadata, to deliver and protect the site. The DNS lookup tool sends the queried domain directly to the resolver you select (Cloudflare, Google, or Alibaba Cloud); the LAN-transfer tool uses Google STUN, which receives your public IP address and port to establish a peer-to-peer connection.

Access and refresh tokens are stored in your browser’s local storage. The access token is sent in the Authorization header for authenticated API requests; the refresh token is used only to renew or revoke the session. We also store your analytics choice locally so that we can honor it. We configure Clarity to mask the main page content and the account area, but you should not enter sensitive information into a site that uses session analytics.

To exercise your rights under applicable law, including access, correction, deletion, data portability, objection, restriction of processing or withdrawal of analytics consent, contact Bin at contact@toolact.com. We will respond within the time required by applicable law. Where available, you can also change your ad preferences or withdraw consent in “Ad privacy settings”.

Introduction

This policy explains how ToolAct handles information when you use the site. Most tools run entirely in your browser. Tools that require a server are identified on their pages. We also process account and profile data, usage history, published content, security logs and technical request data, essential service emails, and optional Microsoft Clarity analytics as described below.

Data Collection

We handle the following categories of information: files and conversion results used by server-side tools; account email and optional profile details; authentication and session data; per-account tool-usage records; blog content you publish; search terms; security logs and technical request data such as IP address and request metadata; service-email content; and optional Microsoft Clarity analytics. The sections below explain the purpose, recipients, and retention for each category:

For browser-only tools, we do not receive the text, code, images, or other content you input
For server-side tools, uploaded files are processed and then deleted from our server after processing
We do not sell personal information. We share data with the providers listed below as needed to run, protect or analyze the service. Google and its advertising partners may also process advertising data in accordance with applicable rules and your choices; see “Ads and privacy”.

Accounts and User Content

You do not need an account to use the tools on this site — the vast majority work without signing in. If you choose to register or sign in, we handle the following account-related data:

Email address: used to sign in, send activation emails, reset a forgotten password, and send essential account notices; never used for marketing
Sign-in credentials: after you sign in, the access token and refresh token are kept in your browser’s local storage to keep you signed in and renew the session automatically. Signing out removes the local credentials immediately. The site also asks the server to revoke the refresh token, but that revocation can be delayed or fail when the network or service is unavailable.
Content you publish: anything you submit on pages that support publishing, such as the blog, is stored on our servers and displayed publicly; you can edit it at any time, and to delete it please contact us at the email address at the bottom of this page — we no longer keep it after deletion
Usage records: once signed in, we record per account which tools you used and when, to power the "Recently used" sidebar and the usage-history page; you can delete individual records or clear them all from the history page at any time

Local Processing

Most tools on this site run in your browser using client-side JavaScript, so the data you enter stays on your device and is never transmitted over the network. A smaller set of tools must run on a server — Office↔PDF conversion, e-book conversion (EPUB/MOBI/AZW3), image format conversion and compression, network diagnostics, the pairing signalling used by LAN transfer, and the account and blog-publishing endpoints — and the relevant pages say so, with uploaded data deleted automatically after processing.

For most tools, your data is processed entirely in your browser and never leaves your device. A small number of tools (Office↔PDF / e-book conversion / image format conversion and compression / network diagnostics / LAN transfer signalling) require server-side processing — those pages clearly say so, and uploaded files are deleted from our server after processing.

Cookies and Local Storage

We use cookies and local storage in your browser, in the following categories:

Local storage used for sign-in and requested features: the language is carried in the URL path. Your browser may store sign-in tokens, a local sign-in-state cache, your analytics choice, tool settings, and—where a tool offers persistence—content or history such as generated-password history, saved editor or teleprompter text, random-picker results, and scoreboard names. This data remains on your device; signing out removes sign-in data, and clearing browser data removes all local copies.
Analytics cookies: Microsoft Clarity sets these only after you consent to analytics. You can change your preferences or withdraw consent at any time in “Analytics settings”.
Temporary data: while pairing devices, the LAN transfer tool briefly writes connection handshake information to your browser's local storage and removes it as soon as it has been used
Advertising cookies and local storage: Google AdSense and its advertising partners may use these technologies, including to store your ad preferences, in accordance with applicable rules and your choices. Some limited ads may also use storage solely to prevent fraud. Google’s privacy information explains the purposes and retention periods. Analytics and ad preferences are managed separately.

Third-Party Services

Microsoft Clarity processes optional usage analytics, including session recordings, heatmaps, and interaction events, only after you consent. Tencent Cloud Email Push receives the recipient email address and the content required for account activation, password reset, and essential notices. Tencent Cloud EdgeOne processes IP addresses and request metadata to deliver and protect the site. The DNS lookup tool sends the queried domain directly to the resolver you select (Cloudflare, Google, or Alibaba Cloud), and LAN transfer uses Google STUN, which receives your public IP address and port to establish a peer-to-peer connection. We also use Google AdSense to show ads. Ad privacy settings are separate from analytics settings. We do not use Google Analytics or Facebook Pixel.

Ads and privacy

We use Google AdSense to show ads on this site. Google and its advertising partners may process your IP address, device and browser information, the pages you visit and your interactions with ads. They may also use cookies and local storage in accordance with applicable rules and your choices. In the European Economic Area (EEA), the UK and Switzerland, Google’s consent management service collects and stores your ad preferences and passes them to its advertising systems. Google’s privacy information explains how this data is used and how long it is kept.

Usage analytics

Microsoft Clarity loads only after you allow analytics. It may process session recordings, heatmaps, interaction events, device and browser information, screen size and an approximate location derived from your IP address. ToolAct marks the main page content and account area for masking, and Clarity masks input fields by default. Do not enter sensitive information on public or untrusted devices. You can change your preferences or withdraw consent in “Analytics settings” at any time. Withdrawing consent removes Clarity cookies and stops further tracking until you consent again.

Data Security

Most browser-only tools do not send their input to our servers. Server-side tools use uploaded data only for the requested operation and delete uploads, temporary files, and results automatically, no later than 24 hours. Account, profile, usage-history and published-content records, together with server-side session records, are protected with measures including HTTPS in transit, access controls, token expiry, and session revocation.

Your Rights

Under applicable data protection laws (such as the EU GDPR and the California CCPA), you have the following rights regarding your data. To exercise any of them, contact us at the email address at the bottom of this page and we will respond within a reasonable period:

Access and information: know what data relating to you we process
Correction and deletion: request that inaccurate data be corrected or that your data be deleted (including your account, usage records, and published content)
Data portability: receive the data you provided us in a structured format
Objection and restriction: object to or restrict certain processing of your data
Analytics controls: change your preferences or withdraw consent at any time in “Analytics settings”, or block analytics cookies in your browser settings.
CCPA rights: California users have the right to know the categories of personal information we collect, request deletion, and opt out of our "sale" of personal information (we do not sell personal information)

Children's Privacy

This site is not directed at children under 16, and we do not knowingly collect personal information from children. If you believe a child has submitted personal information without a guardian's consent — for example, by registering an account — please contact us so we can delete it.

Policy Changes

We may update this Privacy Policy from time to time. Any changes will be posted on this page with an updated "Last updated" date. We encourage you to review this policy periodically to stay informed about the latest privacy practices. We will flag significant changes prominently on the site, such as on the changelog page.

Contact Us

If you have any questions, comments, or suggestions about this Privacy Policy, or wish to exercise any of the data rights above, please contact us using the following method. We will respond as soon as possible.

contact@toolact.com