Privacy Policy

This Privacy Policy describes how ToolsGravity ("we", "us", or "our") handles information when you visit toolsgravity.com, use any of our free online tools, or subscribe to our Pro plan (collectively, the "Service").

We built ToolsGravity on a single principle: your files belong to you. Some of our tools run entirely inside your browser and upload nothing at all. Most send your file over an encrypted connection to our own processing servers, which do the work and then delete it. AI tools send your input to the AI service that runs the model. Either way we keep no copies, our staff never browse your files, and nothing is used for training or advertising. Every tool page tells you which of these applies before you upload anything. This policy explains exactly what we collect, when, and how you can control it.

By accessing or using the Service, you acknowledge that you have read and understood this Privacy Policy. If you do not agree, please discontinue use.

What we do NOT collect

• Copies of your files. Content processed by our browser-based tools never leaves your device at all. Content sent to our processing servers is deleted as soon as the operation finishes — we retain no copies, and it is never used for training, analytics, or advertising.
• Your output. Anything you generate — resized images, compressed PDFs, paraphrased text — is returned to you and then deleted from our servers. We do not keep a library of your results.
• Browsing history outside this site. We have no visibility into what you do elsewhere on the web.
• Biometric or sensitive personal identifiers beyond what's strictly necessary to provide the Service.

What we do collect

• Tool usage statistics: Counts of how often each tool is opened, run and completed, with the device type (mobile, tablet or desktop) and country, recorded by our own servers and by Google Analytics 4. For visitors who are not signed in, these counts are not tied to any identity, and we never store your IP address with them. They are used to understand which tools people rely on and to improve the Service.
• Account information: If you sign in, we store your email address, and the name and profile picture your sign-in provider shares. If you buy credits or subscribe, we also keep your purchase and subscription history. Payments are handled by our payment processor (see the Third-Party Services section); we never see or store your full payment card number.
• Account activity (signed-in users): A record of how you use your account — when you sign in, which tools you use and whether each run finished, and for AI tools the action, the size of the input, the AI runs it cost and whether it succeeded. It powers the activity history on your dashboard and lets us answer billing and support questions. It never includes your content: no text, code, prompts, images or file names.
• Operational metadata for AI features: When you use an AI-powered tool (e.g. background removal, paraphrasing), the relevant input is sent to a third-party AI provider over an encrypted connection. We do not retain a copy of this input on our servers — see AI-Powered Features.
• Messages you send us: If you use the contact form or leave feedback on a tool, we store what you write, the name and email address you give (email is optional for feedback), a one-way hash of your IP address to help stop spam, and for feedback your browser's user-agent string. Each message is deleted automatically two years after it was sent.
• Technical logs: Standard web server logs (IP address, user agent, request path, timestamp) are retained for up to 30 days for security and abuse prevention. These logs are automatically purged afterward.

We use the limited information we collect to:

• Operate, maintain, and improve the Service
• Process Pro subscriptions and provide customer support
• Detect, prevent, and respond to fraud, abuse, security incidents, or violations of our Terms of Service
• Comply with legal obligations, court orders, and lawful requests from authorities
• Send transactional emails (sign-in links, a one-time welcome email when you create an account, billing receipts, security alerts) — we do not send marketing emails without your explicit consent
• Show you your own account activity and answer billing and support questions about it

We do not sell, rent, or trade your personal information to any third party for marketing purposes, ever.

Our tools fall into three groups, and every tool page states which group it belongs to before you upload anything:

• In your browser. Most text tools, developer utilities and a few image tools run entirely client-side, using Web APIs such as Canvas, the File API and Web Crypto. Nothing is uploaded to us, and most keep working with your connection switched off once the page has loaded. The few that rely on a browser feature which itself works online — speech recognition, some text-to-speech voices, or downloading an OCR language model — say so on their page.
• On our own servers. Most PDF and image tools send your file over an encrypted HTTPS connection to processing services we run ourselves. We use real engines (Stirling-PDF and sharp/libvips) because they produce materially better results than a browser can. Your file is processed and then deleted immediately; it is never passed to a third party.
• Via an AI provider. Tools marked with an "AI" badge send your input to a third-party AI service. We keep no copy and it is not used to train models, though a provider may keep a request for a limited period solely to detect abuse (see AI-Powered Features).

For browser-based tools, your file stays in the tab's memory and is discarded as soon as you close or navigate away. For the other two groups, retention is limited to the duration of the operation itself.

If you are working with something genuinely confidential and would rather nothing left your device, prefer a tool marked as running in your browser.

A small subset of our tools require AI inference that cannot reasonably run in a browser (e.g. background removal, large-context paraphrasing). For these:

• Input is transmitted over HTTPS to one of two places: the image AI tools (background removal, upscaling, colourising, portrait enhancement, object removal) run on AI models we operate on a specialised GPU cloud provider; the text, code, PDF and image-editing AI tools use Google's Gemini API.
• Inputs are not retained by us — we use a stateless proxy that forwards your request and returns the result. The models we operate keep nothing once your image is processed.
• Under Google's terms for the paid Gemini API, which we use, your prompts and outputs are not used to improve Google's products or train its models. Google may log them for a limited period, solely to detect abuse and meet legal obligations.
• AI tools need a free account. Each account's AI requests are rate-limited to prevent abuse, and each plan comes with its own allowance of AI runs.

If you would prefer nothing leaves your device, choose a tool marked as running in your browser — every tool page shows where it runs before you upload anything.

We use the following limited cookie/storage technologies:

Strictly necessary

• Session cookie to keep you signed in, if you have an account
• Local storage for tool preferences (theme, panel sizes, recently used tools) and, in AI Text Studio, your unsaved draft and recent instructions — kept only in your browser, never sent to us, and the draft and instructions are cleared when you sign out
• CSRF tokens to protect form submissions from cross-site request forgery

Analytics (only with your consent)

• Google Analytics 4 cookies (_ga, _ga_*) — set only if you allow analytics, and used for aggregated usage statistics. Without your consent no analytics cookies are set, though Google may still receive basic, cookieless measurement signals.
• You can change or withdraw your choice at any time with Cookie preferences in the site footer.

Advertising (when enabled)

• Google AdSense cookies — only when ads are explicitly enabled in your region. You can opt out at adssettings.google.com.

You can clear or block these cookies via your browser settings. Doing so may impair some functionality but will not prevent you from using the core tools.

We partner with a small number of vetted third-party providers to operate the Service:

• Vercel — Web hosting and edge delivery. See Vercel's Privacy Policy.
• Google Analytics — Anonymous usage statistics. See Google's Privacy Policy.
• Google Gemini API — AI inference for the text, code, PDF and image-editing AI tools. Under its paid terms inputs are not used for model training; Google may log them for a limited period to detect abuse.
• GPU cloud provider — Runs the AI models behind our image AI tools. Images are processed in memory and not kept.
• Cloud infrastructure providers — Host our PDF and image processing servers and our database, and deliver account emails (such as sign-in links and receipts).
• Error monitoring provider — When a page or one of our servers hits an error, a report is sent so we can fix it: the error message, the page address (with sensitive parameters removed) and your browser and device type. If you are signed in it also carries your account identifier and plan, so we can see whether a fault affects one account or everyone — never your name or email address. IP addresses are not stored with error reports. Reports describe what went wrong, not what you were working on — they do not include the files or text you process — and they are deleted after 30 days.
• Google Sign-In — If you choose to sign in with Google, Google shares your name, email address and profile picture with us.
• Razorpay — Payment processing for subscriptions and credit purchases. We never see your full card number. See Razorpay's Privacy Policy.
• Google AdSense (where enabled) — Advertising. See Google's ad policy.

We do not authorize these providers to use your information for any purpose other than providing services to ToolsGravity.

We protect the limited data we hold using industry-standard measures:

• HTTPS (TLS 1.2 or newer) for all data in transit
• Encryption at rest for all stored account data, provided by our database host
• Restricted access — production systems are accessible only to the people who run the Service
• Security reviews of our code, dependencies and infrastructure
• Responsible disclosure — if you find a vulnerability, please report it to security@toolsgravity.com

No system is 100% secure, however. If we ever detect a breach that may affect your information, we will notify you within 72 hours of discovery as required by GDPR and similar regulations.

Depending on your jurisdiction, you have certain rights regarding your personal information. ToolsGravity honours these rights globally, regardless of where you live:

• Right to access — Request a copy of any personal data we hold about you
• Right to rectification — Correct inaccurate or incomplete data
• Right to erasure ("right to be forgotten") — Delete your account and associated data
• Right to portability — Receive your data in a machine-readable format
• Right to object — Object to certain types of processing, including direct marketing
• Right to restrict processing — Limit how we use your data
• Right to withdraw consent — Where processing is based on consent

Region-specific protections

• European Economic Area (EEA), UK, Switzerland: GDPR and UK-GDPR rights apply. You may lodge a complaint with your local supervisory authority.
• California, USA: CCPA/CPRA rights apply, including the right to know, delete, correct, and opt out of sale (we don't sell data).
• Brazil: LGPD rights apply.
• Other regions: We extend the same baseline rights to all users worldwide.

To exercise any right, email hello@toolsgravity.com. We will respond within 30 days.

ToolsGravity is not directed at children under 13 (or under 16 in the EEA, and the applicable minimum age in other jurisdictions). We do not knowingly collect personal information from children.

If you are a parent or guardian and believe your child has provided us with personal information, please contact us at hello@toolsgravity.comand we will delete it immediately.

Our servers are located in multiple regions to provide fast, reliable service. When you use our Service, your data may be transferred to and processed in countries outside your country of residence.

For transfers from the EEA, UK, or Switzerland, we rely on:

• Standard Contractual Clauses (SCCs) approved by the European Commission, where applicable
• Adequacy decisions for countries deemed to provide adequate protection
• Your explicit consent in specific circumstances

We retain personal information only as long as needed to fulfil the purpose for which it was collected:

• Google Analytics data: at most 14 months, the longest Google Analytics allows
• Tool usage statistics without identity: kept as aggregate counts per tool per day; they cannot be linked back to a person
• Server logs: 30 days
• Error reports: 30 days
• Account activity: records of individual tool uses, 30 days; records of AI runs and sign-ins, 400 days (long enough to answer any billing question); your account's activity summary, while your account exists
• Account data: Retained while your account is active. When you ask us to delete your account, we first cancel any active subscription so you are not charged again, then delete your account, its activity records and any messages you sent us, except where retention is required by law (e.g. payment and tax records). To prevent the free AI allowance from being claimed again, we also keep a minimal record after deletion: your email address and how many free AI runs it has used.
• Contact form, feedback and email correspondence: up to 2 years, for context on follow-up support requests. Contact-form and feedback messages are deleted automatically two years after they were sent.

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors.

• Minor changes (typos, clarifications) take effect immediately upon posting.
• Material changes (e.g. new data types collected) will be announced via a banner on the site and, for Pro users, an email notice at least 30 days before they take effect.

We always display the "Last Updated" date at the top of this page. We encourage you to review this policy periodically.

If you have any questions or concerns about this Privacy Policy, please reach out:

• Email: hello@toolsgravity.com
• Security disclosures: security@toolsgravity.com
• Mailing address: Available on request — we're a fully remote team

For EEA residents, you also have the right to contact your local data protection authority directly.