toolember
Pro

Privacy Policy

Last updated: September 5, 2026

1. Overview

This Privacy Policy describes how Toolember (“we”, “us”, or “our”) collects, uses, and shares information when you visit toolember.com. We are committed to protecting your privacy and complying with applicable privacy laws globally, including GDPR (EU/EEA), CCPA (California), PIPEDA (Canada), and the UK GDPR.

The data controller for Toolember is contactable at [email protected].

2. Information We Collect

Automatically collected data

Ordinary pages are static files that we serve without running any code of our own. A few routes are the exception, chiefly the dynamic QR redirect and the account and billing endpoints, and those do run our code; what the redirect records is set out under Dynamic QR codes below. We keep no general log of the pages you visit. Standard technical information such as your IP address, browser type, device type, referring page, and pages visited is processed by our content delivery network and by the third-party analytics, monitoring, and advertising services described in Section 4 and Section 5. This data is used to keep the site secure, understand usage, and improve performance.

Tool usage

All browser-based tools on Toolember run entirely in your browser. This includes calculators, converters, generators, testing tools, and text utilities. No input data is transmitted to or stored on our servers.

The gold price and oil price tools fetch live market data from Yahoo Finance via a proxy. Only the requested symbol is transmitted, no personal data.

2a. Accounts, Dynamic QR, and Payments

Some features are exceptions to the browser-only rule above. If you use Dynamic QR, the destination URL you set, a name you give the code, any routing rules, and its scan counts are stored on our infrastructure (Cloudflare D1) so the code can redirect and report scans.

What is recorded when someone scans a code. Every scan of a dynamic QR code is logged, on the free plan as well as paid ones. The record holds the time, the country, region, city and postal area, an approximate location rounded to about one kilometre, the time zone, the device type, operating system and browser user-agent string, the browser language, the network operator and its network number, the Cloudflare location that served the request, the referring page if the scanner arrived from a link, which routing rule matched, and a hashed visitor key. That key is a one-way hash of the IP address and user-agent used only to tell repeat scans apart; the IP address itself is never stored. Location comes from the network operator's IP allocation, not from the device's GPS, and is approximate. Nothing identifies a scanner by name, and none of it is sold or shared with advertisers.

Scan records are kept for two years and then deleted automatically. The owner of a code sees totals, country and device on the free plan, and the fuller breakdown plus a CSV export on a paid plan. For these records the code's owner is the data controller and Toolember is their processor: we hold the records on their behalf, and they decide what to do with them. A scanner who wants a record removed, or wants to know what was recorded, should ask the owner of the code they scanned, or contact us and we will pass it on. Where the owner is in the EEA or UK, our legal basis for holding the records on their behalf is their legitimate interest in measuring their own printed material.

If you sign in (Google or email magic link), we store your email address and a session to link your codes to your account. If you subscribe, payment is processed by Polar (our Merchant of Record); Polar receives the payment details you enter and shares with us only what is needed to activate your plan (such as your email and subscription status). We never see your full card number. See Polar's privacy policy for how they handle payment data.

We only send marketing email (new features, Pro offers) if you explicitly opt in after signing in; the answer is never assumed and we ask once. Every marketing email includes an unsubscribe link, and opting out (or never opting in) never affects your account, your codes, or transactional email we're required to send you (billing receipts, security notices).

Our email provider measures whether messages are opened and their links clicked, using a small invisible image and links routed via info.toolember.com. Blocking remote images in your mail app stops the open count.

3. Legal Basis for Processing (GDPR / UK GDPR)

For users in the European Economic Area (EEA) and United Kingdom, we process data under the following legal bases:

  • Contract (Art. 6(1)(b) GDPR), running your account and delivering the service you asked for: signing you in, storing the dynamic QR codes you create, keeping them redirecting, processing your subscription, and emailing you about your own account (sign-in links, changes to your plan or access).
  • Legitimate interests (Art. 6(1)(f) GDPR), telling a code's owner about activity on their own code, and keeping the service secure and working.
  • Consent (Art. 6(1)(a) GDPR), analytics, session recording, performance monitoring and advertising, none of which load for a visitor covered by the GDPR until they accept (see Section 4); and marketing email you explicitly opt into. You can withdraw any of these at any time, as easily as you gave it.

4. Analytics and Performance Monitoring

What happens here depends on where you are, and we read the country your request comes from to decide (resolved by Cloudflare at the network edge from your IP; used for that decision only, not stored). In the EEA, the UK and Switzerland we ask first and load nothing, not even a script, until you choose, with rejecting exactly as easy as accepting. Everywhere else these services start on your first visit and we tell you so, because those countries work on an opt-out basis rather than requiring us to ask up front. Either way the off switch is the same and always available on our Cookie Policy page, and turning it off stops everything in this section for good. Advertising is handled slightly differently, and Section 5 explains exactly how.

We use Google Analytics 4 (GA4) to understand how visitors use our site. GA4 collects usage data such as page views, session duration, and device type using cookies and similar identifiers. IP addresses are anonymized by GA4 and not stored. This data is subject to Google's Privacy Policy. You can opt out via the Google Analytics opt-out browser add-on.

We use New Relic Browser to monitor site performance and reliability. It measures page load speed and Core Web Vitals, records JavaScript errors, and collects technical details such as browser type, device type, and approximate location (country and region) derived from your IP address. New Relic does not store your full IP address alongside this data, and none of your tool input is collected. A cookie may be set to group page views from the same visit into a session. See the New Relic privacy notice.

5. Advertising

The Google AdSense script is loaded on Toolember, though no ads are being served at present. Google and its advertising partners may use cookies and similar technologies to serve and measure ads based on your visits to this and other websites. Learn more about how Google uses cookies in advertising, and control personalized ads in your Google Ad Settings.

Advertising and analytics storage starts denied for every visitor through Google Consent Mode v2, and ad data is redacted. That denial is lifted only if you accept on our consent banner. If you reject, ads may still be shown, but as Google's limited ads: not personalized, not based on any profile of you, and using no advertising cookies or similar storage beyond what Google uses to detect fraud and invalid traffic. If you ignore the banner, no advertising script is loaded at all. The same banner gates New Relic separately, and rejecting turns it off entirely (see Section 4).

6. Cookies

We and our service providers use cookies and similar technologies for analytics (Google Analytics), performance monitoring (New Relic), and advertising (Google AdSense). You can manage or disable cookies in your browser settings, but some site features may not function as expected.

Google Analytics cookies are retained for up to 2 years. Advertising and performance-monitoring cookies are set and retained according to the respective providers' policies. None of these are set before you accept them where consent is required, and rejecting means the scripts that would set them are never loaded. See our Cookie Policy for the full list, including how to opt out.

7. Data Retention

Most tools run entirely in your browser and we store nothing from them. Where a feature needs an account, we do store personal data on our own servers: your email address, the codes you create in the dynamic QR generator, and scan records for those codes, which include an approximate location derived from the scanner's IP address rather than the address itself. Scan records are deleted after two years, and immediately when you delete the code. Analytics data held by Google Analytics follows Google's retention settings (default 14 months). New Relic retains browser monitoring data according to its data retention settings. Advertising data is governed by Google's policies.

8. Your Rights, EU / EEA / UK (GDPR)

If you are located in the EEA or United Kingdom, you have the following rights under GDPR / UK GDPR:

  • Right of access, request a copy of personal data we hold about you.
  • Right to rectification, request correction of inaccurate data.
  • Right to erasure, request deletion of your personal data (“right to be forgotten”).
  • Right to restrict processing, request that we limit how we use your data.
  • Right to data portability, receive your data in a structured, machine-readable format.
  • Right to object, object to processing based on legitimate interests.
  • Right to withdraw consent, withdraw consent at any time where processing is consent-based.
  • Right to lodge a complaint, file a complaint with your local data protection authority (DPA). UK residents may contact the ICO.

To exercise any of these rights, email us at [email protected]. We will respond within 30 days.

9. California Privacy Rights (CCPA / CPRA)

California residents have the following rights under the CCPA and CPRA:

  • Right to know, request disclosure of categories and specific pieces of personal information we collect, use, and share.
  • Right to delete, request deletion of personal information we have collected.
  • Right to correct, request correction of inaccurate personal information.
  • Right to opt out of sale / sharing, we do not sell your personal information for money. We use Google AdSense for advertising, which may involve sharing online identifiers with advertising partners for personalized ads; you can opt out of personalized advertising in your Google Ad Settings (Section 5) or through your browser cookie settings. Analytics and performance data shared with Google, Microsoft, and New Relic does not constitute a sale under the CCPA.
  • Right to limit use of sensitive personal information, we do not collect sensitive personal information.
  • Right to non-discrimination, we will not discriminate against you for exercising your rights.

To submit a CCPA/CPRA request, email [email protected].

10. Canada (PIPEDA)

Canadian residents have the right to access personal information we hold about them and to challenge its accuracy. All data is handled in accordance with the Personal Information Protection and Electronic Documents Act (PIPEDA). For inquiries, contact us at [email protected].

11. Third-Party Links

Our site may contain links to external websites. We have no control over the content or privacy practices of those sites and are not responsible for their policies.

12. Children's Privacy

Toolember is not directed at children under 13 (or under 16 in the EEA/UK). We do not knowingly collect personal information from children. If you believe we have inadvertently collected such information, please contact us immediately at [email protected].

13. Changes to This Policy

We may update this Privacy Policy from time to time. Changes are effective when posted on this page with an updated date. We encourage you to review this page periodically.

14. Contact

For any privacy-related questions or to exercise your rights, contact us at [email protected].