Privacy Policy

Toolaby is run by Toolaby, the operator of toolaby.app ("Toolaby", "we"). It runs accounts, licences and subscriptions for browser extensions that developers sell.

If you are a developer with a workspace, Toolaby decides why and how your data is processed: we are the controller.

If you bought a tool and signed in on a developer's address (something like their-name.toolaby.app), the developer is the controller of your account and purchase data and Toolaby processes it for them, under our terms. Questions about your purchase go to the developer first; their support address is at the bottom of every page of theirs. For the parts Toolaby decides on its own — keeping the service secure and free of abuse — Toolaby is the controller, and this policy tells you what those are.

The client library we give developers, inside their extension, sends Toolaby: the install id and the key described above, the tool's id and version, timestamps and single-use numbers that make each request unforgeable, and — once you have signed in from the extension — a token that proves the link between your account and that device. That is all it needs to answer "is this device entitled?" and "how many free uses are left?". Where the tool's developer turned counting on, its hourly check also sends how many times the paywall has been shown on that device, and what opened it, for the Analytics above.

Where counting is on, it tells Chrome which page to open if you remove the extension: an address on the developer's pages that names the install id and the extension's version, signed with the key on your device, so that no one else can answer for it. A developer whose extension sets its own page keeps theirs.

It does not send the pages you visit, what you type, or anything the extension does on a website. What the developer's own code does beyond the library is the developer's, described in their store listing and their privacy notice.

The command line (npx toolaby), and the MCP server it runs for coding agents such as Claude Code, sign you in with a code you approve in your browser. They keep that session and your email address in a file on your computer, ~/.config/toolaby/credentials.json, readable only by you, and logout ends the session and removes it.

They send Toolaby what the dashboard does: the tools, plans and features you make, and the questions you ask about your buyers. What a coding agent reads through them, such as a buyer's email address, goes into your conversation with that agent, under its provider's terms. When you ask for a check in a browser, the command line downloads Playwright and its Chromium once, from npm and Playwright's own servers, into the same folder; nothing about you is sent with it.

Our docs server for agents, at toolaby.app/api/mcp, needs no account. It keeps nothing beyond the request logs and limits described below.

Request logs. Our hosting provider keeps short-lived logs of requests — address, path, time, browser — for operating the service. We use the address of a request to rate-limit sign-in and licence checks and to recognise abuse: the same device claiming to be many, a licence key tried from an unusual number of places.

Cookies. One session cookie when you sign in — scoped to the address you signed in on, so a developer's dashboard and a buyer's pages never share one — and a display preference kept in your browser. Our public pages (the front page and the pages beside it, the docs and guides, the terms and this policy, and the access page) count visits with Vercel Web Analytics, which sets no cookie and keeps no address: it counts a page seen, where the visit came from and the country, and cannot follow you from one day, or one site, to the next. It never runs in the dashboard or on a developer's pages for their buyers. No advertising, no third-party cookies, no tracking across sites.

• To run the service: sign you in, know what you are entitled to, unlock the tool on your devices, send the emails the account needs (a sign-in link, a licence, a receipt is Stripe's).
• To let developers see and support their buyers: who bought what, on how many devices, what needs attention.
• To show developers how their extensions are used and what sells, as counts: active devices, the way from a new device to a purchase, what opened the paywall, each version, and why people remove an extension. A developer may also show a share of new devices another price for a plan, or another headline on its paywall, to compare the two; which one a device sees follows from its install id, and nothing else about you.
• To keep the service secure and fair: rate limits, replay protection, abuse detection, revoking a licence that is refunded or shared beyond its limit.
• To meet legal obligations, and to answer you when you write to us.

Not to advertise, not to profile, not to sell. Under the GDPR our bases are the contract with you (or with the developer, for buyers), our legitimate interest in a secure service, and legal obligation.

The developer you bought from sees your email, your purchases and your devices for their tool, in their dashboard. No other developer does. Their Analytics shows counts, and the answers people gave when they removed the extension, without a name or an address; the email when a paying buyer removes it is described above.

Stripe handles payment on the developer's account; what Stripe holds is under Stripe's privacy policy.

The providers that run Toolaby, processing on our instructions and nothing else:

Beyond these: a buyer's own developer, a lawful request we are obliged to answer, or a successor if Toolaby is ever transferred — with this policy still applying.

Our homepage also shows the badges of LaunchOnIt, Product Hunt and DevHunt, images your browser loads from launchon.it, producthunt.com and devhunt.org. Each sees what any website sees of a visit: your address and your browser. Toolaby sends them nothing.

In the European Union — Frankfurt and Stockholm, as listed above — except mail you send us, which is kept in our mailbox at Google and may be stored outside the EU. The providers are companies that also operate outside the EU and are bound to us by data processing terms with the European Commission's standard contractual clauses. Stripe processes payments under its own arrangements.

• Sessions end on their own; the sign-in link expires after five minutes and works once.
• Account, purchase, licence and device records: for as long as the account or the purchase exists, then as long as the developer's legal obligations require — a purchase record outlives the licence.
• The keyed hash of an inbox, with the free uses it has taken of a tool and whether it has had the tool's trial or a subscription moved to it: after the account is deleted too, so that deleting an account and making it again does not give them again. Free uses counted in total are kept while the tool exists, those counted by the day, week or month until the period ends; a trial is kept.
• Analytics: each day's counts, and the answers given when an extension is removed, for thirteen months; what is kept about a device, until it has not run the extension for thirteen months. Then deleted, and at once when the developer deletes the tool. When a buyer's data is deleted, what they wrote on that page goes with it.
• The address of a deleted workspace or tool, and nothing else of it: kept, so that nobody else can take it and receive what was meant for it.
• Security and abuse records: no longer than twelve months.
• When you ask us to delete your data, we do so within thirty days, keeping only what the law requires, the keyed inbox hashes above — and, for a buyer, what the developer must keep for the sale.

You can ask to see the data we hold about you, to correct it, to have it deleted, to receive a copy, and to object to or restrict its processing. Write to hello@toolaby.app and we answer within a month. If you are a buyer, your developer may answer, since the data is theirs to decide about; we help them do it. You can also complain to the data protection authority where you live.

Everything travels over HTTPS. Signing keys are encrypted at rest and rotated when a developer asks. Every table is protected by row-level security, and each workspace's buyers are kept in their own pool. Card numbers never touch Toolaby. If you find a weakness, tell us at hello@toolaby.app and we will act on it and thank you.

Toolaby is not directed at children under sixteen and we do not knowingly hold their data. If you believe a child has an account, write to us and we remove it.

When we change what we collect or why, we update this page and its date, and for changes that matter we email the address on your account before they take effect.

Toolaby · hello@toolaby.app