Privacy policy

This policy covers the ToolsWar website and app, including the downloader, the file tools, your file library and any connected accounts. "We" means the operator of this ToolsWar service; "you" means the person using an account.

When you ask ToolsWar to fetch a link from another website, that website's own privacy policy applies to whatever it receives from that request.

We store the following, and only for the purposes described in this policy:

• Account data: your email address, display name, preferred language and plan. Your password is stored only as a one-way hash (Argon2id) that nobody can read back.
• Sign-in methods: for passkeys we keep the public key and the name you gave the device, never your fingerprint or face data, which stays on your device. Authenticator-app secrets are encrypted, and recovery codes are stored only as one-way hashes.
• Your files: files you upload, files produced by tools and downloads, plus details such as name, size, type, folder, tags and a checksum used to spot duplicates.
• Job metadata: which tool or download you ran, the settings you chose, its status, timestamps and processing time.
• Download history: the links you submitted, the detected source, the title and the outcome.
• Sessions and security logs: IP address, browser user agent, sign-in method and times for each session, and a log of security-relevant events such as sign-ins, failed attempts, password or 2FA changes and data exports.
• Usage counters: daily downloads and monthly processing minutes, used to apply your plan's limits.
• Connected accounts: if you connect Telegram, an encrypted session for your account and its display name (see the Telegram section below).
• Plan records: which plan you are on and any plan an administrator assigned to you. We don't collect card or bank details; payments are currently switched off.

• To run the service: store your files, run the jobs you request and show you your history.
• To apply plan limits such as daily downloads, storage and processing time.
• To keep accounts safe and prevent abuse: detecting suspicious sign-ins, rate limiting, locking an account after repeated failures and investigating misuse.
• To send account emails: address verification, password resets, sign-in codes and alerts about new sign-ins or security changes.
• To diagnose failures and keep the service running reliably.

We don't sell your data, don't show ads, don't build advertising profiles and don't look through your files. Files are handled automatically only to perform the operation you asked for and, where the operator has enabled it, to scan for malware.

Each job runs in an isolated process with strict CPU, memory and time limits. Your files are stored under names generated by the server, and every request to a file is checked against your account, so one user cannot reach another's files.

When you submit a link, our servers fetch it, not your browser, so the source website sees a request from ToolsWar rather than from your IP address. Preview thumbnails shown after analysing a link may load directly from the source platform, like any image on the web.

If malware scanning is enabled, a file flagged as infected is quarantined: it can't be downloaded or processed. Files that weren't scanned are labelled as such and are never presented as "clean".

Connecting Telegram is optional and available on plans that include it. You sign in with your own phone number and Telegram code, and ToolsWar can then list the chats your account already has access to and download the media you pick.

We store the resulting Telegram session encrypted, and use it only when you browse your chats or request a download. We never use it to send messages, and we skip content its owner has marked as protected from forwarding or saving.

You can disconnect at any time from the downloader; disconnecting deletes the stored session. Deleting your ToolsWar account deletes it too.

Files are kept according to your plan; see Plans for the current values. With the current default plans:

• Free: files are deleted automatically 7 days after they're added.
• Pro: files are deleted automatically after 90 days.
• Business: files are kept until you delete them.

The retention period is set when a file is added, based on the plan you have at that moment. Expired files are removed by an automatic cleanup that runs every hour. Keep your own copy of anything you need long term.

• Sessions: removed once they expire; signed-out or revoked sessions are removed 30 days later.
• One-time links and codes (email verification, password reset): removed shortly after they expire.
• Job and download history: kept while your account exists, and deleted with your account.
• Security and audit logs: kept as long as needed for security and abuse prevention. After account deletion they remain linked only to an anonymised account record.

Deleted data can remain in encrypted backups until those backups rotate out under the operator's backup schedule.

Deleting a file or folder moves it to Trash first, so you can restore it if you change your mind. Items stay in Trash for 30 days and are then deleted permanently.

You can delete an item permanently or empty Trash at any time from My files. Files in Trash still count towards your storage until they're gone, and a file whose plan retention period ends while it's in Trash is deleted on that date.

• See and edit your profile, language and sign-in methods in account settings and security settings.
• Review activity: your own security log and active sessions are visible in security settings, where you can sign out any device.
• Export: download a machine-readable (JSON) copy of your profile, folders, file details, jobs, downloads, sessions, passkey names, connected accounts and security log. The export never contains passwords, secrets or keys.
• Delete your account: after confirming your identity, we delete your stored files and their versions, folders, download and job history, sign-in methods, connected accounts and active sessions. Your account record is anonymised so the email address can be registered again.

If you can't use these controls, reach us via the contact address shown in the app.

We use only what the service needs to work:

• tw_session: keeps you signed in. It can't be read by page scripts (HttpOnly) and is sent only over secure connections in production.
• tw_csrf: protects your actions against cross-site request forgery.
• tw_locale: remembers your language for up to a year.
• tw_theme (stored in your browser, not sent to us): remembers light, dark or system theme.

There are no advertising, analytics or third-party tracking cookies, so there's nothing to opt out of. Blocking the essential cookies will stop sign-in from working.

• Encrypted connections (HTTPS) between your device and the service.
• Passkeys and two-factor authentication (authenticator app or email code), with single-use recovery codes.
• Confirming your identity again before sensitive changes such as changing your password, managing 2FA or deleting your account.
• Rate limits and temporary lockouts against password guessing, and alerts when your account is signed in from somewhere new.
• Isolated, resource-limited processing for every job, and strict separation between users' files.
• Short-lived signed links for saving files to your device.

No system is perfectly secure. If you notice something wrong with your account, change your password, sign out other sessions from security settings and contact us.

We share data only when it's needed to run the service or required by law:

• Infrastructure providers the operator uses for hosting, file storage and sending email, acting on the operator's instructions.
• The websites you ask us to fetch links from, which receive a normal request from our servers.
• Telegram, when you use the Telegram integration with your own account.
• Authorities, when the law requires it, or to protect users and the service from fraud or abuse.

Administrators of this service can see account details, job and download records and logs when needed to support you, investigate abuse or keep the service running. Their actions in the admin area are themselves logged.

If we change this policy, we'll update the date at the top of this page. For significant changes, especially anything that affects how your data is used, we'll also let you know in the app or by email before they take effect.

For privacy questions, data requests or to report a security issue, reach us via the contact address shown in the app. Please don't include passwords or recovery codes in your message.