Privacy Policy

Who we are

ToolRoots is operated by an independent publisher. For any privacy-related inquiry, contact us at [email protected].

Data we collect

We collect only what is necessary to run the service:

• Account data — when you sign in via GitHub, Google, or X (or email/password), we receive and store your name, email address, and profile image.
• Submissions — product name, tagline, website URL, and uploaded thumbnail.
• Newsletter — your email address if you subscribe to the weekly digest.
• Session data — IP address and user agent for authentication security.
• Payment data — paid submissions are processed by Stripe. We do not store card details. We only retain the Stripe session ID to link payments to submissions.

How we use your data

• Display your submitted products on the site
• Send transactional emails (submission status, payment confirmation)
• Prevent abuse (rate limiting, duplicate detection)

We do not use your data for advertising or profiling.

Analytics

We use Umami, a privacy-focused analytics tool that we host ourselves on our own server in the EU (Hetzner, Germany). Umami does not use cookies, does not track you across sites, and does not store personal data. Your IP address is not stored: it is used only transiently to derive your country, region, and city, then discarded. It records page views, page load performance, outbound link clicks, and goal events such as signup, listing, checkout, and purchase, used only for aggregated audience statistics. No consent banner is required.

Third-party services

Your data may be processed by the following services:

• Stripe — payment processing (privacy policy)
• Plunk — transactional emails
• Cloudflare — image hosting (R2) and CDN
• GitHub / Google / X — OAuth authentication
• Umami — privacy-friendly analytics, self-hosted on our own server in Germany at Hetzner (no cookies, no personal data)

Cookies

ToolRoots uses only essential cookies required for authentication (session token). We do not use tracking cookies, advertising cookies, or any third-party cookies. Umami does not set any cookies.

Data retention

Account data is kept for as long as your account exists. Submission data is kept for as long as the product is listed. You can request deletion at any time.

Your rights (GDPR)

As a user in the European Union, you have the right to access, rectify, delete, or export your personal data. You can also withdraw consent or object to processing at any time.

To exercise any of these rights, email [email protected]. We will respond within 30 days.

Changes

We may update this policy from time to time. Significant changes will be communicated via email or a notice on the site.