Last updated: 1 November 2026 · tooldu.com
Files you use in a tool
PDF, Word, image, audio and video processing runs on your device. The tooldu.com backend does not receive those files for processing. Your browser downloads code, fonts, codecs or model files as needed. A tool that opens a remote file URL contacts that file’s host. Keep the original and download the result before closing the tab. Local processing is not an encrypted cloud vault or a backup service.
Information you choose to send us
Contact forms send your name, email, subject and message to the administrator’s private inbox. Tool Feedback sends your name, subject, description, source page and language, plus the image you submit. Feedback accepts PNG, JPG and WebP images up to 2 MB. This upload is separate from tool processing. Send a non-sensitive screenshot where possible. Contact messages and feedback images are kept for up to 90 days unless deleted sooner; an administrator can delete an image without deleting the message.
Accounts, login and recovery
Manual signup collects your name, email, country and chosen password. A phone number and postal address are not required. Existing accounts may retain a mobile login supplied earlier. Site passwords use salted hashes, and recovery codes use one-way hashes. A new Google-created account also receives a separate Tooldu password and recovery code, shown once. To deliver them across the Google redirect, an encrypted copy is held for up to ten minutes of eligibility and removed when collected; its decryption key stays in an HttpOnly cookie. Expired encrypted deliveries are removed during cleanup. These credentials are not placed in page URLs or localStorage. Manual signup also shows a recovery code once so you can save it. Manual email ownership is not verified by OTP. When Google sign-in is connected, Google supplies your account identifier, verified email and name. We do not request your Google password, Gmail messages or Drive files. Your Profile ID links your account, support history and billing records.
Trial and access checks
You get 30 minutes to try the tools that need access, without creating an account. Once that window ends, wait at least one hour before starting another. Opening an eligible trial tool starts the next window. Time keeps running while you are away. The nine free tools have no session timer. Clearing cookies or browser data does not restart the timer on the same public IP. People on the same Wi-Fi or shared network may therefore share a window and its waiting period. We cannot reliably recognise an unregistered visitor who changes both cookies and public IP. Signed-in accounts use their own access rules. Anonymous windows use a cookie identifier and a keyed hash of the public network address; anonymous trial records do not store the raw IP address or use a browser fingerprint. They become eligible for deletion at the end of the cooldown and are removed by daily cleanup, which may take up to another day. A registered account has its own 30-minute window every three hours, measured from the previous start. The same window follows your account across devices. Idle time counts, and unused minutes do not carry over. Registered window state is stored with the account. These essential access checks are separate from optional analytics.
Billing and account activity
Payment needs your name, email and country. Tooldu does not require a phone number or postal address. Razorpay processes the payment details entered in its checkout; tooldu.com does not store card numbers or CVV. We keep orders, amounts, currencies, payment references, access credits, payment-policy acceptance and operational events to support billing and investigate problems. Tool activity checks send a tool identifier, not document contents or filenames. Administrators can review account profiles, successful login history, recent activity and verified billing records.
Account messages and retention
Account support requests and administrator replies are available in the Contact and Notification sections of your account. They are not sent by SMS. Detailed successful-login history, support tickets, inbox messages, security-change events and member-trial events are retained for 90 days; daily cleanup may follow expiry by up to one day. Current access state, profile preferences, activity summaries and necessary payment records remain while needed to operate the account, resolve disputes or meet applicable obligations. You can delete your own account from Settings after confirming your identity and Profile ID. An administrator can also delete a registered profile. Sign-in credentials, Google links, sessions, personal profile details and account messages are removed; active access ends. An anonymized Profile ID, payment/refund records and the profile-action audit remain for accounting, payment support and applicable obligations. Deletion does not automatically refund a payment.
Optional traffic measurement
If you allow analytics, first-party reports collect public page paths, referral source, approximate device and country, active time and supported Web Vitals. They use a random visitor identifier and a session that changes after 30 minutes of inactivity. Identifiers are hashed on the backend and are not joined to member profiles. Document contents, filenames and form contents are excluded. Detailed visits are retained for 30 days; retained full IP addresses have a seven-day report window and are masked by default in the administrator view. Daily cleanup may follow expiry by up to one day. Claimed crawler activity is aggregated separately without storing raw IPs.
Google Analytics, Tag Manager and advertising
Google services run only when configured. Analytics and advertising storage start denied until you allow the relevant optional category. A standard Tag Manager container can still contact Google before you choose, with storage denied, and its noscript iframe can contact Google when JavaScript is disabled. Consent Mode does not by itself prevent every tag request; what tags collect also depends on their configuration. Do Not Track and Global Privacy Control suppress optional measurement and the standard Tag Manager installation when detected.
Google advertising choices
If AdSense is enabled, Google and other participating vendors may use cookies or identifiers to serve, personalise and measure ads based on visits to this and other websites. Google may receive connection and browsing information. Use this site’s Cookie Policy to change your choices, and Google My Ad Center for Google’s personalised-ad settings. The built-in AdSense placements do not serve the EEA, UK, Switzerland or an unknown country while a Google-certified consent platform is not installed. Our local cookie panel is not a Google-certified CMP. Tool pages are ad-free while you are signed in with active verified paid access.
Providers and international processing
Cloudflare provides hosting and backend storage, Razorpay provides checkout, and Google provides the configured identity, measurement, tag or advertising services. These providers may process connection and service information in the countries where they operate, under their own policies and applicable rules. This page does not claim that all information stays in your country. Sharing a public network can also affect anonymous trial identification.
Your choices and requests
You can change optional choices on the Cookie Policy page and clear browser storage through your browser settings. Stopping optional measurement does not disable essential account and trial checks. You can update your profile or delete your account in account Settings. To ask for access, correction or deletion of other support information, contact us. We may need to verify that a request concerns your information, and some billing or security records may need to be retained. If a child has submitted personal information without appropriate permission, tell us so it can be reviewed. You can also raise a concern with the privacy authority available under your local law. Do not send identity documents or confidential files unless an appropriate, necessary verification method has been agreed.
A question about this policy?
Send an inquiry to the site administrator.
Google advertising choices
How Google uses data when you use partner sites · Google My Ad Center · Participating advertising vendors and opt-out choices · Manage this site's optional cookies