Privacy policy

Effective October 25, 2026

This policy explains what data the Toolbox Chrome extension ("Toolbox") and its website handle, and why. Toolbox is published by Ahmed Gamal ("we", "us"). Questions: tool@appzlr.com.

The short version

• Before the extension sends anything to your Toolbox account, it shows you what it will send and why, and asks you to agree by pressing "Continue" (in the side panel, or on our sign-in page). Until you do, nothing from it reaches your account. If that list changes, the extension shows it again and holds everything back until you agree to the new one.
• Bookmarks never leave your computer, and screen recordings only do when you share one. Notes stay in your browser unless you turn on notes sync, which keeps them in your account so you can use them on our website and in your other browsers. Screenshots and PDFs you edit in Toolbox stay in your browser; with a paid subscription, screenshots are also kept in your Toolbox cloud and you can save PDFs there.
• Our server only stores what's needed to run your account, your plan (and any free trial it had), your subscription, the counts behind the free plan's limits, the short links you create, the tab sessions you save, the notes you choose to sync and the articles you save to Read later (with your highlights and notes), a short record of the free-plan limits and paid features your account runs into and of its upgrades (see "Upgrade records" below), plus, only if you turn it on, a daily count of how often you use each tool.
• Our website uses Google Analytics to count visits. The extension has no third-party analytics. Counting which tools you use is off unless you turn it on, and even then it only reports which tool you used, never what you used it on.
• When we run ads, our website uses Google's and Meta's ad tags to measure them. If you reach it from one of our ads on Google or Meta (Facebook, Instagram), the website remembers that ad click, and if you then create an account, subscribe or move up to a higher plan, our server tells that ad platform, so we can see which ads work. Nothing the extension handles is ever part of this.
• The AI writer only sends text when you ask it to write something: your request and the text it works on go to our server and to Anthropic, which runs the AI model, to write the answer. Anthropic doesn't train on it and deletes it within 30 days. Your results are kept in your Toolbox history unless you turn that off. Shared recordings are named the same way: the start of a recording's transcript goes to Anthropic to suggest its title, unless you turn AI titles off.
• We don't sell data, show ads in Toolbox, or track the pages you visit with the extension.

Your agreement in the extension

The extension asks before it sends anything. When you press Sign in in the side panel, it first says what goes to your Toolbox account and why, with "What's synced" opening the full list, tool by tool, and a link to this policy. Pressing "Continue" records your agreement in that browser and opens our sign-in page; "Not now" leaves everything as it was. If you start signing in on our website instead, the sign-in page shows the same summary and list, with the same "Continue". Until you agree, the extension sends nothing that carries your sign-in, and it doesn't take the sign-in at all. Two kinds of collection aren't needed for any tool to work and are off unless you turn them on in the extension's Settings → Privacy: counting which tools you use and video speed's time-saved stats. Each browser keeps its own agreement and switches. When we change what the extension sends, it shows the new list in the side panel and sends nothing to your account from that browser until you agree again (or sign out). Settings → Privacy → "What's sent" shows the list at any time.

Data that stays on your device

• Page access. Toolbox can run on the pages you visit so it can scroll them and capture screenshots when you ask it to. It measures and scrolls the page locally. It doesn't collect, store or transmit page content, except text you choose to send to the AI writer (see "AI writer" below).
• Screenshots and screen recordings are created in your browser. Screen recordings you save to your computer go to your Downloads folder and are never uploaded unless you share them later; recordings you share, and videos you upload to your Toolbox library, are uploaded (see "Shared recordings" below). Screenshots you edit open in the Toolbox website in the same browser and are kept in that browser's storage; with a paid subscription they're uploaded to your Toolbox cloud instead (see "Screenshots" below), unless you choose "Save to Downloads" in the extension. Your recent screenshots are also kept in the browser's own storage so the side panel can list them. When you record, Chrome asks you what to share. The recording only includes what you choose, plus your microphone and camera if you turn them on. The camera and microphone are only used on the recorder's own page, while you preview or record.
• PDFs. When you open a PDF in Toolbox, the extension downloads it from the site you're viewing (as Chrome's own viewer would) and hands it to our website's PDF editor in the same browser. Viewing, annotating, signing, organizing, compressing and converting PDFs to Word, Excel, PowerPoint, images or text all happen in your browser, and your files and saved signatures are kept in the browser's own storage until you remove them. The extension notes which of your tabs show a PDF (from the file type) so it can offer to open it; that stays on your device. If you turn on "Open PDFs from websites in Toolbox", PDF links open in our editor instead of Chrome's viewer.
• Bookmarks are read and changed with Chrome's bookmarks API, on your device. The bookmark manager page on this website works through the extension in the same browser: your bookmarks go from the extension to that page and back, and are never sent to our servers. When you run a link check (by hand or on a schedule you turn on), your browser contacts each bookmarked site directly to see if it still responds; when you ask for a saved copy of a dead page, it asks the Internet Archive's Wayback Machine about that one address. Tags and notes you add to bookmarks, and each page's preview image and description (read from the page when you save it, or when you load previews in the manager), are kept in the extension on your device. We aren't involved and see none of it.
• Open tabs and auto-save. Tabs & sessions reads the address and title of your open tabs on your device to list, search and tidy them. Its auto-save snapshots of your open windows, and recently closed tabs (only if you allow it), are kept in Chrome's extension storage on your device and never uploaded unless you choose to keep one as a session.
• Read later on web pages. The extension runs on the pages you visit so you can highlight text there and see your highlights again. On each page it only checks, on your device, whether its address is one of your saved pages with highlights; it doesn't read a page's text, or send anything about it, until you save the page or highlight something on it (see below). Your Read later settings are kept in the extension on your device.
• Notes you write in Toolbox, and the stopwatch's state, are kept in Chrome's extension storage on your device, and uninstalling Toolbox deletes them there. Notes are only uploaded if you turn on "Sync notes to your Toolbox account" (see below); the stopwatch's state never is.
• Video speed runs on the pages you visit, on your device: it changes how fast their video and audio play, and how the picture looks if you ask it to. Its settings, site rules and shortcuts are kept in Chrome's extension storage on your device, and synced to your account while you're signed in (see below). It never records which videos or pages you watch: for the time-saved stats, only if you turn them on, it adds up how long things played, per site name. When you turn on volume boost or pitch for a tab, Toolbox captures that tab's sound (Chrome shows its capture icon on the tab) and plays it back louder or at the pitch you chose. That sound is processed on your device as it plays and is never recorded, stored or sent anywhere; the capture stops when you turn them off, close the tab or it loads another page.
• Page marker. What you draw and write on a page with the page marker is kept in the extension's own browser database on your device, with that page's address and title, so your marks come back when you open the page again. It's never uploaded, unless you take a screenshot of the page and choose to keep it in your Toolbox. You can delete or export these marks from the side panel, and uninstalling Toolbox deletes them.
• Typing on web pages. To notice when you type a template's shortcut in a text box, Toolbox looks at the few characters just before your cursor, on your device. What you type on web pages is never stored or sent anywhere. A template that uses {{clipboard}} reads your clipboard only when you insert it.
• Your new tab page: while you're signed in, its settings (background, clock, search, widgets, layout, custom CSS), your shortcuts (each a name and address you chose) and your to-dos are synced to your account, so every browser you sign in to gets the same new tab and you can change it on our website. Your daily focus stays in the browser, and background photos you upload stay in the extension's own browser database and are never uploaded. "Delete from my account" on the New tab page (or "Delete synced data" on your account page) deletes the account's copy. Searches you type there go straight to the search engine you picked. Most visited sites are read from Chrome on your device, only if you turn that widget on and allow it.
• Cleaning browsing data. When you use the cleaner, Toolbox asks Chrome to delete the data you picked, on your device. It doesn't read that data or send it anywhere. Your choices, protected sites and the log of recent cleanups are kept in Chrome's extension storage.
• Settings such as scroll speed, recorder options and your recent recordings list are kept in Chrome's extension storage.

Data we receive and store

• Account. You sign in on our website with Google or with an email and password. Sign-in is run by Google Firebase Authentication, under Google's privacy terms; we never see your password. We store your account ID, email address, and the name and profile picture link your sign-in provides, plus when you first signed in.
• Connected browsers. When you sign Toolbox in, the website gives that browser its own sign-in token. We store a scrambled (hashed) copy of the token, a name for the browser such as "Chrome on Windows", and when it was connected and last used, so you can see and disconnect your browsers on your account page.
• Subscription. Subscriptions are sold through Paddle, which acts as the merchant of record. When you subscribe, we send Paddle your account's email address and name so checkout opens with them filled in. Paddle collects your payment and billing details, handles tax, and emails your receipts, underits own privacy policy. We store the subscription's number, your customer number with Paddle, the number of your first payment, the subscription's status and its renewal or end date. Your card details never reach us.
• Upgrade records. To learn which free-plan limits and paid features lead people to upgrade, our server keeps a short record with your account when it turns down something because your plan doesn't include it (which limit or feature, its tool, and how many times that day), when our website shows you an upgrade prompt or you follow it, when you open your account page from an upgrade button in the extension (the button puts the limit or feature in the page's address), when you open checkout (and for which plan), and when your account is created and your subscription starts, moves to a higher plan, renews or ends, each with the time. It never includes what you were saving or doing, or any page's address or content, and the extension sends nothing extra for it: these are requests our server answers anyway. We look at them only as totals, and each record is deleted a year after it's made.
• Welcome page counts. Right after it's installed, the extension opens our welcome page. That page counts the visit once, and our server counts an account later created in the same browser, both only as a number per day: no account, browser, address or other identifier is sent or kept with them. To tell that the sign-up came after the visit, the page keeps the visit's date in your browser's local storage, sends it along with the website's requests until you're signed in, and then stops. The counts are deleted after a year.
• Cancelling. When you cancel your subscription on your account page, we ask why. We keep your answer with your account and plan: the reason you pick, anything you choose to write, the offers we showed you (a pause, yearly billing, a cheaper plan or a discount) and whether you took one or cancelled. If you write about a missing feature or a problem, it also goes to our contact inbox so we can answer you by email. We use these to improve Toolbox and look at them as totals, and delete each one two years after it's made. A pause, discount or plan change you take is made through Paddle, like any other change to your subscription.
• Short links. When you shorten a link, the extension sends us that URL and any custom alias you typed, and a title for the link (the page's title when you shorten the tab you're on, which you can change). We store the URL, the title, the short code, the account that created it, when it was created, a click count and when it was last clicked, plus any tags, expiry date or off switch you set. When someone opens a short link, we add one to the click count, note the time and redirect them. For the link's stats we also add one to a daily total for the website that sent them (its domain only, never the full address), the country Cloudflare reports for the visit, and the kind of device (computer, phone, tablet or bot). Those are totals only: we don't record who clicked, their IP address, browser details, city or the page they came from. To keep short links from leading people to phishing or malware, our server may look up the address you shorten (and a new address you give an existing link) in Google's Web Risk service, which checks it against Google's list of unsafe sites. Only the address is sent, never who you are. Anyone can report a short link on our report page; we keep the report (the link, the reason, what they wrote and an email address if they gave one) to review it.
• Templates. The text templates you create (name, shortcut, folder and text) are stored with your account, so you can manage them on our website and use them in every browser you sign in to. We also store when each was created and changed, and how many times and when it was last inserted. Each browser keeps a copy so it can insert them instantly. Deleting a template deletes it from our server.
• Tab sessions. When you save tabs in Tabs & sessions (or keep an auto-save), we store each session's name, your note and star, and the address, title, pinned state and tab group (name and color) of every tab in it, with when it was saved, changed and last restored. This lets you restore it in any browser you sign in to and manage it on our website. If you turn on a share link, anyone with that link can see the session's name, note and tabs (never your name or email) until you turn it off. Deleting a session deletes it from our server.
• Video speed. While you're signed in, the extension syncs its video speed settings to your account so you can manage them on our website and share them between your browsers: the all-sites speed, presets, switches, keyboard shortcuts and site rules (each a site name or address pattern you typed, such asyoutube.com/shorts/*, with its speed and picture settings). Only if you turn on the time-saved stats ("Count the time video speed saves me", off until you turn it on), it sends, per day and site name (such as youtube.com), how many seconds of video and audio played and how long that took. It never sends page addresses, titles or what you watched. We keep the stats for 400 days. Each browser has its own switches for both in the extension (Video speed → Sites → Sync, and Settings → Privacy for the stats), and "Delete from my account" on the Video speed page deletes both from our server.
• Read later. When you save a page (from the side panel, a shortcut or the right-click menu), or highlight text on a page that isn't saved yet, the extension reads the article on your device and we store, with your account: its address, title, site name, author, publication date, a short excerpt, the address of its lead image, and the article's text as cleaned-up HTML. Images are never copied to our server; the reader loads them from the article's own site, without telling that site which page you're on. Saving a link from the right-click menu has the extension fetch that page (without your cookies) to read it. We also store each highlight's text, color, a little of the text around it (so it can be found again) and your note, and per article its tags, whether it's archived or a favorite, how far you've read and when. This is kept for everyone signed in, on the free plan too, so you can read and export it on our website from any browser. Importing a list from Pocket, Omnivore or Instapaper stores the links, titles, tags and highlights in that file. Deleting an article deletes it and its highlights from our server.
• Notes, only if you turn on sync. Notes sync is off until you turn it on, in the Notes tab of the side panel or on the Notes page of our website. Then the notes in that browser are uploaded once, and every change after that, so you can write and organize them on our website and see them in your other browsers: each note's text, when it was created and last edited, whether it's pinned, its folder, and the address and title of the page it's about when it has one. Turning sync on in one browser doesn't upload the notes of your other browsers; each one has its own switch. A note you move to the trash is deleted from our server 30 days later, and one you delete for good is deleted right away (a marker that it was deleted is kept for 30 days so your other browsers delete it too). "Delete synced data" on your account page deletes every synced note from our server at once and turns sync off; the notes in your browsers stay. Turning sync off in a browser stops it sending changes.
• Reminders. The reminders you set (their text and notes, time, time zone, repeat, list, and the address and title of a page, only when you attach one) are stored with your account, with a short history of when each rang, was snoozed or done, so they ring in every browser you sign in to and you can manage them on our website. Each browser keeps a copy of your upcoming ones so it can show the notification on time. If you have a paid subscription and turn on email for a reminder, we send it to your account's email address through Resend, our email provider; you can turn reminder emails off at any time from the link in every email. Deleting a reminder deletes it from our server.
• Email tracker. When you send an email from Gmail with tracking on, the extension adds a tiny invisible image and, if you track link clicks, points its links at our link host (link.appzlr.com), which forwards the reader to the real address. We store that email's subject, its recipients' names and addresses, the address it was sent from, the tracked links' addresses and when it was sent, never the message itself. When the image loads or a link is clicked we store the time, which mail app asked (such as Gmail or Outlook), and only when the reader's own device asked directly, its device type, operating system and approximate city and country. We don't store IP addresses: we keep a scrambled (keyed hash) form of the sending browser's address for at most a day, to tell your own views apart from your readers' in the first minutes after sending, and the same for a hit that arrives before its email is registered, also for at most a day. When Gmail shows you your own tracked email, the extension tells us so that view isn't counted. To spot replies it looks at the senders of messages in threads you open and at Gmail's unread feed in your browser; only the fact that a reply came is sent. Opens and clicks are kept for a year; deleting a tracked email, or "Delete all tracking data" on the Email tracker page, deletes it all. Emails to yourself and to addresses on your never-track list are never tracked, and each compose window can turn tracking off.
• AI writer. Nothing is sent until you ask the writer for something: pressing Write after typing its trigger (// by default) in a text box, picking a rewrite for text you selected, pressing Draft reply in Gmail or Outlook, or writing in the side panel or on the AI writer page. Then we receive what you asked (your instruction, the tone, length and language you picked), the text it works on (the text you selected, the text already in the text box around the caret, or for Draft reply the email thread shown on the page), and the page's title and address. We send that to Anthropic, which runs the Claude model that writes the answer, as our service provider: under its commercial terms Anthropic doesn't use it to train its models and deletes it within 30 days, unless it's flagged for breaking Anthropic's usage policy or the law requires keeping it. The answer comes back to you and only goes into the page when you press Insert or Replace. Password, card number and one-time-code boxes and code editors are left alone. With history on (the default), each result is kept with your account (the request, up to 4,000 characters of the text it worked on, the answer, the site's name and the page title) so you can find and reuse it; you can delete any or all of it, or turn history off, in the extension or on the AI writer page. Drafts you write on the AI writer page, saved prompts and writing voices are stored with your account until you delete them. We count how many AI requests you make each day, for the plan's daily limit. We never log what you send outside your own history.
• Time tracker. The time you track (each entry's description, start and end, project, task, tags, whether it's billable, and the address of the page you started it from, only when you start it from a page) and your projects, clients, tags, rates, targets, favorites and time settings are stored with your account in our database, so every browser you sign in to and our website show the same timer, timesheets and reports. Each browser keeps a copy of the last two weeks so the side panel opens at once and works offline. Idle detection uses Chrome's idle state on your device (active, idle or locked) only to ask whether to keep time you were away; it isn't sent to us. Deleting an entry, a project or "Delete all time data" on the Time tracker page deletes it from our server.
• Focus mode. Your focus settings (the sites on your block and allowed lists, your schedule, the pause screen's message and lengths, and when a strict session ends) are stored with your account, so you can edit them on our website and every browser you sign in to blocks the same sites. To pause a site, the extension checks each address you open against your lists on your device; it doesn't send us the pages you visit. For the sites focus mode stops, and only those, it counts per day how often the pause showed, how often you turned back or went in, and the minutes you chose, and sends those counts to your account for the stats on our website. We don't receive the pages, titles or times of those visits. You can clear the stats on the focus page at any time, and we delete them after a year.
• Shared recordings. Only when you choose "Share link" in the screen recorder (a paid subscription feature), the recording is uploaded to your Toolbox cloud while you record, with a still frame from it as its preview picture, its title, length, size and picture size, and when it was made. Anyone with its link can watch it on our website unless you set a password (we keep only a one-way hash of it) or an expiry date, and can download it unless you turn downloads off. If you trim or cut it on the Recordings page, an edited copy is made in your browser and stored with it, and the link plays only that copy; removing the edits deletes the copy. Deleting a recording on the Recordings page or in the recorder deletes the video, its details, its transcript and everything viewers left on it from our storage. The recording's sound is transcribed on our servers by Cloudflare Workers AI (Cloudflare hosts Toolbox, and doesn't use what it transcribes to train AI models), and the transcript is kept with the recording as its captions. A new recording is named after the tab it shows: while it records, the recorder notes which tab is in front (in your browser only) and, when it stops, uses that tab's title as the recording's title (you can turn this off in the recorder). Once the transcript is ready, unless you turn AI titles off on the Recordings page, the start of the transcript (about the first 4,000 characters), the recording's length and that tab title are sent to Anthropic, which runs the Claude model, to suggest a better title; under its commercial terms Anthropic doesn't train on it and deletes it within 30 days. A title you typed is never replaced, unless you ask for a suggestion yourself.
• Watching a shared recording. When you play a recording someone shared with you, we count the play and how much of the video you watched, so its owner sees views and how far people got. If you're signed in to Toolbox, the owner also sees your name (or "Toolbox user" if your account has no name; never your email), your photo, and when and how much you watched; if you aren't, a random ID kept in your browser lets us count you once, and the owner only sees a number. Comments and emoji reactions you leave are shown to everyone who can watch the recording, with your account's name and photo, or the name you typed as a guest; you can edit or delete your comments, and the owner can delete them too. When you comment or react as a guest, we keep a scrambled (keyed hash) form of your IP address with it for at most a day, to limit how much one address can post; nobody sees it. Reports you send go to the Toolbox team, with the email you give, if any.
• PDF cloud storage. Only when you save a PDF to your Toolbox cloud (a paid subscription feature), we store the file, its name, size, page count and when it was saved or changed, so you can open it on any browser you sign in to. Deleting it in the PDF app deletes it from our storage.
• Screenshots. With a paid subscription, when you capture a screenshot with "Edit in Toolbox" on (the default), press Edit on one in the side panel, or save one to the cloud on the website, we store the image, the page's title and address, the kind of capture, its size, a small preview, your edits (shapes, text, crop and background) and the finished image, so you can edit, find and download it on the website from any browser you sign in to. Screenshots can show whatever was on your screen, so blur or crop anything private, or switch the extension to "Save to Downloads" to keep captures on your computer only. Deleting a screenshot on the website deletes it from our storage.
• Shared screenshots. Only when you make a share link for a screenshot (a paid subscription feature), anyone who has the link can see the finished image, its name (or the page's title when you haven't named it), your name as it is on your account (never your email) and when you took it, on a Toolbox page, until the link expires or you turn it off. The captured page's address isn't shown. You choose how long the link works, and can add a password (we keep only a scrambled form of it) or turn downloads off. We count the link's views and keep when it was last viewed, with no details about who viewed it. Chat apps that preview links fetch the image too. People can report a shared screenshot to us; a report's message and optional email reach our team only.
• Messages to us. When you send a message from the side panel's Feedback & support tab or our contact page, we store the topic, subject, what you wrote, the tool it's about, the address we should reply to, your plan at the time and when you sent it, with your account, so we can read it and answer you by email. You can choose to include the page you're on and your browser and system (such as "Chrome 141 · Windows"); otherwise we don't receive them.
• Why you removed Toolbox. When you remove the extension, Chrome opens a page on our website that asks why, in one optional question. Its address carries the extension's version and the day it was installed, nothing else. If you answer, we store the reasons you picked, the tool it's about, what you wrote, the email address you give (only if you want a reply), the version, the install day and the country our hosting provider reports for the request. It isn't linked to your account, and we don't store your IP address.
• Feature requests. When you send a request from the side panel's Feedback & support tab, we store what you wrote, the kind of request, the tool it's about, the extension's version and when you sent it, with your account, so we can read it, plan what to build and show you its status. For a bug report you can choose to include the address of the page you're on; otherwise we don't receive it. If you aren't signed in, the tab opens an email to us instead.
• Tool usage, only if you turn it on. Counting is off until you turn on "Count which tools I use" in the extension's Settings → Privacy, separately in each browser. Then, while you're signed in, Toolbox tells our server when you use a tool: start autoscroll, take a screenshot, draw on a page, start a recording, save a PDF result, add or export bookmarks or run a link check, save or restore a tab session, start a note, insert a template, start the stopwatch or timer, see focus mode's pause screen, change a video speed setting, save a page or highlight to Read later, or create a short link. We keep one number per tool per day (UTC) for your account, for example "Screenshots: 4 on 2026-10-18". We don't receive the page, URL, file, note or anything else the tool was used on, or the time of day. You can see this month's counts on your Toolbox home page. We use them to show you your usage and to understand which tools people rely on, so we know what to improve.
• Announcements. When the side panel shows one of our announcements (news or an offer), it tells us that the announcement was shown, clicked or closed, once you've agreed to the extension's list. We only keep a total for each announcement; nothing about you or your account is sent with it.
• Signed-in hint. When you sign in on our website, it sets a first-party cookie (tbx_in=1) so its pages can show "Open Toolbox" instead of "Account" in the header. It holds no account details, our server doesn't read it, and signing out removes it. Otherwise it expires 30 days after your last signed-in visit.
• Website analytics. Our website's public pages (not the extension, and not the pages where you sign in, connect the extension, pay or use your tools) use Google Analytics for Firebase to understand how people find and use it: pages viewed, the site that referred you, your approximate location (country or city, from your IP address), browser and device type, and visit times. Google Analytics sets cookies in your browser to tell visits apart and processes this data underGoogle's privacy policy. We only see aggregated reports. We don't send it your account details, and we don't use it for advertising.
• Advertising measurement. When we run ads, our website's public pages (not the extension, and not the pages where you sign in, connect the extension, pay or use your tools) load the Google Ads tag and the Meta Pixel. They set cookies and tell Google and Meta which of those pages you visit, so they can measure our ads and may show our ads again to people who visited. The Meta Pixel also tells Meta when someone creates an account on our website, so our ads can reach people who signed up but haven't subscribed. If you arrive from one of our ads, the link carries a click identifier (such as gclid or fbclid) and campaign tags (such as utm_campaign). The website keeps these in a first-party cookie for 90 days. If you then sign in or create an account on our website (which is also how the extension signs in), we save them with your account, together with your browser's user agent and IP address at that sign-in. When that account is created, when it first subscribes and when it first moves up to a higher plan, our server reports the event to the platform the ad came from (Google through its Data Manager API, Meta through its Conversions API): the click identifier, the event and its time, the amount paid for a subscription or added by the new plan, your browser's user agent and IP address, and a one-way SHA-256 hash of your email address and of your account ID, which the platform uses to match the event to the ad click. Our server doesn't report accounts that didn't come from one of our ads. Google and Meta process this under their own privacy policies (Google,Meta).
• Server logs. Like any website, our hosting provider may briefly keep standard request logs (such as IP addresses) for security and reliability. We don't use them to identify or track you.

How we use it

We use this data only to provide Toolbox's features: running your account and plan, checking your subscription, serving short links, showing you your tool usage and deciding which tools to improve, understanding how the website is used, and replying when you contact us. Toolbox's use of information complies with theChrome Web Store User Data Policy, including the Limited Use requirements. We don't sell or transfer user data to third parties, except to Google Firebase to sign you in and measure website visits, to Google and Meta to measure our own ads for accounts that came from one (see "Advertising measurement" above), to Paddle to sell and manage subscriptions, to Cloudflare, which hosts the service, your PDF cloud storage, your screenshots and your shared recordings, to Resend, which delivers the reminder emails you ask for (your email address and that reminder), to Google Web Risk, which checks the addresses you shorten against its list of unsafe sites (the address only), to Anthropic, which runs the AI model behind the AI writer and the titles of shared recordings (only the request and text you send the writer, and the start of a shared recording's transcript; see "AI writer" and "Shared recordings" above), and to MongoDB, whose Atlas service stores our database (your account, browsers, subscription, short links, templates, tab sessions, reminders, synced notes and settings, PDF file list, screenshot list, shared recording list, feature requests, messages to us and tool usage counts). We don't use it for advertising, other than measuring our own ads as described above, which never includes data the extension handles, and we don't use it for creditworthiness or lending, and we don't let people read it except where needed for security, to comply with the law, or with your permission (for example, a support request or a feature request you send us).

How long we keep it

• Short links and their click stats stay until you delete them in the Shorten tab or on the Short links page, which removes them from our server.
• Articles and highlights in Read later stay until you delete them, on any plan.
• Time entries, projects, clients and tags stay until you delete them, on any plan.
• AI writer history stays until you delete it (the newest 2,000 results; past that the oldest unstarred ones are deleted), and nothing new is kept while history is off. Drafts, saved prompts and voices stay until you delete them. Anthropic deletes what the writer sends it within 30 days, longer only if it's flagged for breaking its usage policy or the law requires.
• Reminders stay until you delete them (done ones too, until you clear them). Resend keeps a record of each email it sent for its own limited retention period.
• PDFs in your cloud storage, screenshots and shared recordings in your account stay until you delete them, while a paid subscription covers them. If it ends, they're deleted 30 days later; until then you can still download or delete them, and the PDF app, Screenshots and Recordings pages show the date. A recording whose upload never finished (the browser closed mid-recording) is deleted after a day.
• Screenshots and PDFs kept in your browser stay there until you delete them or clear the site's data; we never receive them.
• Synced notes stay until you delete them. Notes in the trash are deleted 30 days after you trash them, and "Delete synced data" on your account page deletes them all at once.
• A connected browser's record is deleted when you disconnect it or sign Toolbox out, or after 90 days without use, when that browser is signed out.
• Answers to the "why did you remove it" question are deleted two years after you send them.
• Tool usage counts are kept with your account and deleted along with it.
• Google Analytics keeps website visit data for the retention period set in our Analytics settings (14 months at most).
• The ad click cookie expires 90 days after you land. An ad click saved with your account is kept with the account and deleted along with it; what Google and Meta keep is set by their policies.
• Your account is kept until you ask us to delete it. Subscription records are kept as long as tax and accounting law requires.

Your choices and rights

You can turn tool counting and video speed's time-saved stats on or off at any time in the extension's Settings → Privacy. You can delete short links, your cloud PDFs, your screenshots and your synced notes ("Delete synced data" on your account page) at any time. To see, correct or delete the other data we hold about you, emailtool@appzlr.com. from the email address you sign in with, so we can find your account. Uninstalling Toolbox removes the settings it kept in this browser. To keep your visits out of Google Analytics, block cookies for this site or use Google'sopt-out add-on. If your browser sends a Global Privacy Controlsignal, our website doesn't load the ad tags or save the ad click cookie, so nothing about you is reported to Google or Meta. Blocking cookies for this site also stops the ad click from being saved with your account. You can also manage ads inGoogle's My Ad Center and Meta's ad preferences.

Children

Toolbox isn't directed at children under 13, and we don't knowingly collect their data.

Changes

If we change this policy, we'll update the date at the top of this page. If a change is significant, we'll also mention it in the extension's release notes. If we change what the extension sends to your account, the extension shows you the new list and sends nothing more from that browser until you agree to it.