Privacy Policy

This policy applies to the Toolsy website, workspace, supplier directory, and related services (collectively, the “Service”). “Toolsy,” “we,” “us,” and “our” refer to the independent Toolsy project.

For workspace content, Toolsy acts as a processor on behalf of the account that owns the workspace. For account and website data, Toolsy acts as a controller.

We collect the following categories of information:

• Account information — name, email, company, password hash, and account timestamps.
• Workspace content — material lists, extracted line items, RFQ packages, supplier selections, quotes, and notes you enter.
• Server data — IP address, browser type, and request timestamps in server logs, used for security and debugging.
• Analytics data — page views and device information when analytics is enabled.
• Communications — messages you send to the contact address.

We use information to:

• Provide the Service, including extraction, directory matching, RFQ drafting, and quote tracking.
• Authenticate users, enforce workspace access, and prevent abuse.
• Show RFQ, quote, and account activity inside the workspace.
• Debug failures using server logs that do not include workspace text.
• Measure page usage when analytics is enabled.
• Comply with legal obligations and enforce our terms.

We do not sell personal information.

Toolsy does not use workspace text to train models. Your model provider's data terms still apply.

We share information with:

• Suppliers you select — when you send an RFQ from your own email, the supplier receives the line items, delivery location, project reference, and notes you put in that email. You control which suppliers receive each package.
• Service providers — hosting, database, model inference, and analytics providers (PostHog and Vercel Analytics, when enabled) acting under contract.
• Legal authorities — where required by law or to protect the Service.

Workspace content is retained while the account is active. You can clear workspace content from the workspace at any time. To delete your account and its workspace record, email [email protected]. Some records may be kept where required by law.

Passwords are hashed with scrypt, sessions use HTTP-only cookies, and workspace records are scoped to the signed-in account. In production, traffic is served over HTTPS. No system is perfectly secure, and we do not claim an audit certification.

You can access, correct, or delete your account information from the workspace, or by emailing [email protected]. You can clear local browser storage through your browser, though doing so will sign you out of the cached workspace on that device.

Questions about this policy can be sent to the same address.