Privacy Policy
Last updated: August 22, 2026 — Effective: August 22, 2026
1. Overview
GetFreeToolsHub ("we", "us") operates https://getfreetoolshub.com. We build 100+ free online tools for PDF, image, SEO, AI and developer use. This policy explains what we collect, why, and your choices. Contact: privacy@getfreetoolshub.com, support@getfreetoolshub.com.
2. Information We Collect
Account data: name, email, password hash, OAuth profile (if you sign in with Google/GitHub). File data: files you upload for a tool (e.g., PDF for merge). Usage data: anonymized page views, tool slug, success/error, device type. We do not intentionally collect sensitive personal data.
3. How We Use Your Information
To run the tool you requested, authenticate you, enforce plan limits, prevent abuse, process Stripe payments, and improve reliability. Files are used solely for the single operation you triggered and never for training, profiling, or resale.
4. File Processing & Deletion
Files are processed ephemerally. Uploaded inputs and generated outputs are stored under storage/processed/<executionId>/ and linked via a short-lived HMAC download token (60s). Workers delete outputs after download or via daily 3am FilesCleanupService. We do not retain your file content after processing.
5. Cookies & Local Storage
Essential cookies only: auth_token / admin_token (SameSite=Lax, 7 days), oauth_state (HttpOnly, 10 min for Google/GitHub), next-nonce (CSP). No advertising, cross-site tracking, or third-party marketing cookies. You can block cookies in browser settings but login will fail.
6. Third-Party Processors
Stripe (payments), AWS S3 or local storage (temporary files), OpenAI (AI tools, only the prompt you submit), Redis/Bull (queue), Prisma/Postgres (metadata). Each has its own policy; we share only the minimum needed (e.g., email to Stripe, file chunks to S3). No sale of data.
7. Data Retention
Uploaded files: seconds to minutes. ToolExecution / UsageLog metadata: retained for support and billing, deleted on account deletion. Analytics: anonymous counts retained 12 months. Verification tokens: 24h. Stripe event idempotency keys: 30 days.
8. Security
Helmet + CSP nonce, CORS allowlist, per-user throttling (30/min on /tools/execute, 5/min on auth), SSRF guard, SVG file filter, HMAC download tokens, bcrypt cost 12, JWT jti blacklist in Redis. See our security contact: security@getfreetoolshub.com.
9. Your Rights (GDPR/CCPA)
Access, correction, deletion, portability, restriction, and objection. To exercise, email privacy@getfreetoolshub.com or dpo@getfreetoolshub.com (EU). We respond within 48 hours (GDPR: 30 days). You may lodge a complaint with your local supervisory authority.
10. Children & Contact
Not directed to children under 13. For questions contact privacy@getfreetoolshub.com or GetFreeToolsHub, Legal — 8 The Green, Dover, DE 19901 (placeholder). Updates to this policy will be posted with a new "Last updated" date.