Privacy Policy
Last updated: September 15, 2026
About this site
This website ("nicolinoo's Toolbox") is operated by a private individual for personal, non-commercial purposes. It contains no advertising, no tracking, and no analytics, and no personal data is ever sold or shared for marketing purposes of any kind.
If you have questions about this policy or want to exercise your rights, contact the site operator using the Feedback page.
Data we collect and why
| Data | When | Legal basis (GDPR) | How long |
|---|---|---|---|
| Account data: username, display name, email address. Your password is stored only as a one-way hash. | When you sign in to a protected tool | Art. 6(1)(b) - necessary to provide the service | As long as the account exists; deleted on request |
| Session data: session token, your IP address and user agent | When you sign in | Art. 6(1)(f) - legitimate interest in security and abuse prevention | Until the session expires (up to 7 days) |
| Pass Share metadata: creator username, creator IP address, visit count and expiry. Never the secret itself - only its encrypted form. | When you create a secret link | Art. 6(1)(f) - rate limiting and abuse prevention | Maximum 7 days; deleted earlier on the last allowed visit or manual deletion |
| IP address (transient, in memory only - not written to disk) | On each tool request (rate limiting / DoS protection) | Art. 6(1)(f) - service availability | Minutes only (5-minute windows max) |
Cookies
The only cookie this site sets is the login session cookie, which is strictly necessary to provide the authenticated tools you request. No tracking, advertising or analytics cookies are used, and no consent banner is required.
Pass Share - zero-knowledge design
Secrets are encrypted in your browser (AES-256-GCM, Web Crypto API) before anything reaches the server. The decryption key exists only in the URL fragment (#…), which browsers never transmit to servers. The database stores only ciphertext plus the metadata listed above; anyone without the full link - including the site operator - cannot read your secret. People who merely open a secret link are not identified and no viewer log is kept.
Hosting and third parties
- The site is hosted on a server located within the European Union. No personal data is transferred to servers outside the EU by this site.
- All fonts and scripts are self-hosted. Your browser loads no third-party resources - no Google Fonts, no analytics providers, no external APIs from your device.
- Character Downloader: when you use this tool, our server (not your browser) queries Roblox's public API to resolve usernames and fetch avatar data. Only the username you enter is transmitted in that request.
Your rights
You have the right to:
- access a copy of your personal data (Art. 15 GDPR),
- request correction of inaccurate data (Art. 16),
- request deletion of your data, including account deletion (Art. 17),
- restrict processing in certain cases (Art. 18),
- receive your data in a portable format (Art. 20), and
- object to processing based on legitimate interest (Art. 21).
Changes to this policy
If we change how we process data, this page will be updated and the "Last updated" date above will reflect the new version.