Privacy protection
Your data, explained plainly
This policy explains what ToolBarKit processes, what it stores, and which tools work entirely inside your browser.
Effective date: September 27, 2026
JWT stays local
Tokens are decoded in your browser and never sent to our backend.
No data sales
We do not sell personal information or JWT contents.
Usage analytics
Google Analytics and Microsoft Clarity help us understand site usage. We do not sell personal information.
GetMyPic event photo matching
With your agreement, GetMyPic stores your name, email address and selfie in MongoDB for your event. Your organizer downloads these details to their own computer to match your face against event photos and manually review the results. Matching can make mistakes, particularly with small, obscured or similar faces.
Registration uses a live camera with a quick blink check. Face detection runs in your browser and our backend checks the captured frames before accepting your selfie. Challenge frames are processed in memory and are not stored; the final selfie and a verification timestamp are retained with your registration. This basic check helps deter static photos, but does not verify your identity or guarantee protection against replayed videos or deepfakes.
Approved photos are placed in a Google Drive album shared with your email address, and the organizer sends you the album link. Group photos may appear in several attendees’ albums. Your selfie metadata is removed before storage. Registrations and selfies expire automatically when the event retention period ends (30 days by default, up to 90 days).
Local copies and Google Drive albums are managed separately by your organizer. Contact them to request correction or deletion, or to ask how long they retain these copies. Camera access is requested only when you choose to take a selfie.
Image resizing
The image resizer uploads your selected image to our server when you request a plan and again when you resize. The tool processes images in memory without saving them to a file or database. Downloads remove the original image metadata, including embedded location information. Preview and download links stay in your browser and are not public result pages.
PDF tools
The PDF tools upload your documents to our server when you review them or calculate a plan, and again when you resize, merge, split, reorder or extract pages. Documents and ZIP downloads are processed in memory in a temporary worker process, without saving the upload or result to a file or database. Download links exist only in your browser. PDF metadata, form fields and other existing document content may remain in the result; these tools do not sanitize documents or remove confidential information.
Who we are and what this covers
ToolBarKit is operated by Mansi Kesharwani and Shailesh Kumar Sahu. This policy covers the ToolBarKit website, its browser-based tools, and the ToolBarKit backend service. Links to other websites are governed by those websites' own policies.
Information handled by ToolBarKit
| Feature | What is handled | How |
|---|---|---|
| JWT decoder | Token, header, and payload | Browser only; never transmitted or stored by us |
| Utility tools | Text, measurements, and values you submit | Sent to the backend to return a result; not intentionally saved in the application database |
| Notes | Username, title, body, note key, and optional password hash | Stored so notes can be retrieved, updated, and deleted |
| Short links | Destination URL, username, key, dates, and visit count | Stored to provide redirects and link history |
| Site analytics | IP address, device type, visit timestamp, pages visited, approximate location, browser details, clicks, scrolling, and interaction data | IP address, device type, and visit timestamp are stored in our application database; other analytics are processed by Google Analytics and Microsoft Clarity, including session recordings, to help us understand and improve use of the site |
| Technical requests | IP address, browser details, timestamps, and requested paths | Hosting providers may process these in access and security logs |
The interface may save a theme preference in your browser. Google Analytics and Microsoft Clarity may use cookies or similar technologies to distinguish visits and measure site usage. You can limit this processing through your browser's cookie controls or tracking-protection settings.
Why we process information
We process information to provide the tool you request, save content when you choose a storage feature, secure and maintain the service, diagnose failures, prevent abuse, and comply with applicable law. Depending on your location, processing may be based on providing the requested service, legitimate interests in operating it safely, your consent, or a legal obligation.
Sharing, retention, and security
We do not sell personal information. Information may be processed by infrastructure providers that host the frontend, backend, or database, and by Google and Microsoft as our analytics providers, or disclosed when required by law or necessary to protect the service and its users.
Saved content is retained while needed to provide its feature or until it is deleted where a deletion option is available. Operational logs are controlled by the relevant hosting provider and may follow that provider's retention settings. We use reasonable safeguards, but no internet service can guarantee absolute security. Avoid placing sensitive personal information in notes, URLs, or other server-backed tools unless necessary.
Your choices and rights
Depending on where you live, you may have rights to request access, correction, deletion, restriction, portability, or objection, and to withdraw consent where consent is the basis for processing. You may also have the right to complain to your local data-protection authority. We may need enough information to verify and complete a request.
You can delete a saved note through the Notes tool. For other privacy questions or requests, contact the maintainers through the project owner's GitHub profile.
Children and international processing
ToolBarKit is a general-purpose utility site and is not directed to children. Hosting providers may process information in countries other than your own, where privacy laws may differ.
Policy changes
We may revise this policy when ToolBarKit's features or data practices change. The effective date at the top of this page will identify the latest version.
Verify JWT privacy yourself
You do not need to trust our statement. Use your browser's developer tools to confirm that clicking Decode JWT creates no network request and sends nothing to the ToolBarKit backend.
1. Open developer tools
Open the JWT decoder, right-click the page, and choose Inspect. You can also press F12 or Ctrl+Shift+I (Cmd+Option+I on macOS).
2. Prepare the Network panel
Select Network, choose the Fetch/XHRfilter, and clear the request list after the page has loaded.
3. Decode a token
Paste a JWT and select Decode JWT. The header and payload appear immediately because the browser performs the work.
No requests
4. Confirm nothing was sent
The filtered list remains empty. There is no web request and no request payload containing your JWT.