Privacy Policy

1. Introduction

This policy sets out what ToolPool.Garden does with your data, in as much detail as we can give. ToolPool.Garden is operated by IllumAlign LLC ("we", "us", "our") and helps people who already trust one another organize the lending and borrowing of tools: members form private pools, list tools into them, and coordinate borrows through a one-on-one chat.

This Privacy Policy explains what information we collect, how we use and share it, and your rights regarding your information. This policy applies to users of our website and services, people invited to use them, and people who receive individual outreach from us. That outreach includes a founder welcome and contact with someone in a role with a property, neighborhood group, or makerspace. For the personal data processed through the platform and our business outreach, IllumAlign LLC acts as the data controller.

2. Information We Collect

Information You Provide

• Account Information: When you create an account, we collect your name, display name, email address, and password (stored only as a secure hash). We ask for your date of birth at sign-up only to confirm your eligibility to use the service; we store only the fact and time of that verification, never the birth date itself. We also ask which country you live in at sign-up, so that we can confirm it is one we offer the service in; that answer is checked as you register and is not stored. If you enable two-factor authentication, we also store your chosen method and, for the authenticator-app method, the shared secret used to verify your codes and the time the last code was accepted, which is how we stop the same code being used twice; emailed login codes are stored only as short-lived hashes, and your one-time recovery codes are stored only as hashes. If you choose to log in with Google, we also store the permanent identifier Google uses for your Google account, so that we can recognize you on later logins; you can only use Google to log in to an account you already created here, and only when Google has verified the email address on it.
• Profile Information: Your public profile may include a display name, an avatar image, a bio, and links to social media accounts you choose to share. You control who can see your profile with a Public profile setting: when it is on (the default) anyone can view your profile; when you turn it off, only you and people who share a pool with you can view it.
• Legal Signatures: When you sign the Terms of Service and the Liability Waiver, we record the document version, the name you typed as a signature, and a timestamp. That is all we keep about a signature. Waiver signatures used to store a copy of every clause as it read at the time, and the oldest of them the initials you entered against each clause; we have deleted that data. These records form an auditable signing history and are retained as evidence of your agreement.
• Pool Data: We collect the information you provide about a pool, such as its name, description, an optional logo image its admins upload, and the geographic location of its map pin, along with its membership and settings. A pool's logo is shown to everyone who can see the pool, which for a public pool includes people without an account. We also record when the pool was created, and show the month it was created in on the pool's page and wherever the pool is listed.
• Tool Listings: We collect the tool listings you create, including names, descriptions, photos, and which pools a tool is shared into. Your identity is shown on a listing only to people you have revealed yourself to in a chat about that tool. The details and photos you add can identify you. By default, a listing is public. While you share it with at least one public pool, anyone can see it on that pool's page or open the listing at its own web address, including people without an account. You can instead mark a tool as unlisted. You and members of the pools you share it with can see its details. Public pool pages and embeds include it in the pool's private tool count. The count does not reveal the tool's details or owner.
• Supply Listings: Supply listings follow the same visibility and identity-reveal rules as tools. We store their amount, capacity, unit, and usage chats. Stock amounts are visible wherever the supply is visible. Only the owner can change stock. Links between an owner's tools and supplies are visible only to that owner and included in their account export. Deleting a listing removes its links. We send a supply's name to TypeSafe to suggest a unit, both while you type it and when you open a supply that already has one. Public pool pages and embeds include an unlisted supply only in that pool's private supply count. The count does not reveal the supply or its owner.
• Maintenance: We store your maintenance tasks, schedules, the points on each task and automation, supply stock thresholds and whether they are waiting for restocking, completion records, the due time last processed for a reminder, and checkout counts on maintenance automations. Tasks and automations with no listing start private, and their owner chooses the pools. A task or automation linked to a tool or supply uses that listing's pools, and those shares change when the listing's pools change. The owner chooses whether only they can mark tasks done or undone. Otherwise, current members of an open selected pool can do so. Only the owner edits or deletes them. We store the account that completed each task and its completion time. A private calendar link lets anyone holding it read your maintenance until you replace it or turn it off. We keep the link's secret so you can copy it again, and we leave it out of exports. Your export includes owned maintenance records, permissions, pool shares, checkout counts, the points on each owned task and automation, and your own completion IDs and times without another person's task content. Deleting an account or listing removes its owned maintenance records. Deleting a completing account clears its identity from other people's tasks. Leaving a pool removes your maintenance shares there.
• Skill Listings: We collect the skill listings you create to offer teaching, including names, descriptions, photos, and which pools a skill is shared into. Skill listings follow the same anonymity, public/unlisted, and reveal rules as tool listings above. Your identity is shown on a listing only to people you have revealed yourself to in a chat about that skill. The details and photos you add can identify you. By default, a listing is public. While you share it with at least one public pool, anyone can see it on that pool's page or open the listing at its own web address, including people without an account. You can instead mark a skill as unlisted. You and members of the pools you share it with can see its details. Public pool pages and embeds include it in the pool's private skill count. The count does not reveal the skill's details or teacher.
• Request Listings: We collect the requests you post asking to borrow a tool or receive help, including titles, descriptions, photos, which pools a request is shared into, and its status in each pool. Each pool stores its own status labels and order. A request is attached to you by name inside the pools you share it into. Your name and avatar appear beside it for the members of those pools, linked to your profile. People who respond to you stay anonymous until they choose to reveal themselves. Members see you when your Public profile setting is off too. That setting controls who may open your profile page. By default, a request is public. While you share it with at least one public pool, anyone can read it and its pool status on that pool's page or open it at its own web address, including people without an account. Your identity stays hidden from those readers. You can instead mark a request as unlisted. You and members of the pools you share it with can see its details; those members can also see your name and profile. Public pool pages and embeds include it in the pool's private request count. The count does not reveal the request's details or poster. Status labels appear on the pool's Requests page alongside visible requests, including any identifying details those requests contain.
• Chats and Checklist Data: We store the messages you exchange in borrow, teaching, and request-response chats, in direct messages between people who share a pool, and in pool-admin threads, along with the state of each tool chat's discussion checklist and a record of when you reveal or hide your identity on a particular listing.
• Notification Settings: We store your choices about how we notify you, separately for each kind of notification: whether we may email you, and whether we may send you browser notifications. Four kinds can be switched on and off: new chat messages, new requests posted in a pool you belong to, maintenance due reminders, and the leaderboard newsletter. Maintenance reminders use email only and are on by default. They tell only the task owner that maintenance is due, without task or listing details. The leaderboard newsletter also uses email only and is on by default, with one switch for all your pools. Each pool's admins choose how often it goes out, from weekly to yearly, or turn it off for that pool. It goes to the pool's members and draws on the same leaderboard and maintenance list they can see in the pool. It names the period's top scorers with the maintenance points they earned in that period, and the all-time leaders with their leaderboard score. That score is each leader's maintenance points, plus 5 points for each person who can currently see them because that leader chose Reveal. A private profile is shown as *******. It does not name the people who can see them. Up to five open maintenance tasks shared with the pool are listed too, with their titles and dates. It also says how many tools, supplies, skills, requests, and maintenance items were newly shared with the pool, without naming who shared them. Apart from that newsletter, no notification quotes what somebody wrote, and none carries another person's name. A chat notification tells you only that a message arrived, so reading it means signing in. A notification about a new request gives the name of the pool it was posted in and nothing about the request or the person who posted it. It links to the request, which anyone can read without an account if the poster marked it public. If you turn on browser notifications, your browser gives us a subscription for that browser, which we store: an address supplied by your browser's push service (Google, Mozilla, Apple, or Microsoft, depending on the browser you use), two keys used to encrypt each notification so only your browser can read it, and a description of the browser. We send that push service the encrypted notification so it can pass it on to you; it cannot read the contents. You can turn browser notifications off at any time in your settings, which deletes the subscription, and logging out deletes them for every browser. Every email we send carries an unsubscribe link in its headers, except the outreach letters described below. Email apps such as Gmail show that link as an Unsubscribe button. On a notification email, it turns that kind of email off. On any other email, it puts your address on our do-not-email list. We then stop emailing that address. We still send the emails that keep an account or a pool working: email confirmation, password resets, sign-in codes, the confirmation for a new email address, the notice that an invitation created your account, confirmations for deleting an account or a pool, data exports, and the warning that a pool you pay for is close to needing a subscription. The list stores only a keyed fingerprint of the address, and keeps it after an account is deleted so the address isn't emailed again. If your account uses that address and you have confirmed it, you can take it off the list with the Email from ToolPool.Garden switch in your notification settings. If you change your account's email address while Email from ToolPool.Garden is off, we add the new address to the do-not-email list once you confirm it, and the old address stays on it.
• Announcements You Have Read: The home page shows announcement cards, and you can mark one read. We store which cards you have marked and when, so that your next visit opens the carousel on a card you have not seen. No one else sees any of this, and unmarking a card deletes the record.
• Reviews: We store the star ratings and review text you write about other users, and those written about you.
• Pool Reveal Rankings: When you choose Reveal in a chat about a tool, skill, or request, that choice is already stored on the chat. A pool's profile rankings add up how many distinct people can currently see you that way in that pool. Each person counts once, even across several listings. The pool leaderboard adds 5 points for each of those people to your maintenance points. The 5 points go to you, the person who chose Reveal. Hide removes a person when they can no longer see you in any such chat in that pool. Direct messages and pool-admin threads are not included. If you delete your account, you leave any count that included you, because the chat no longer names you. Members of an open pool can see the profile total, your rank, and the leaderboard score. Visitors can see the leaderboard when the pool is open and public. When they can open your profile, they can see the profile total and your rank for an open public pool. The numbers do not name the people or the listings. A program that can open your profile can read the same profile total.
• Listing Stars: You can star any tool, skill or request that you can view. We store a record linking your account to the listing, along with the time you starred it. The record stays until you remove the star or the listing or your account is deleted. Anyone who can view the listing can see its total star count without seeing which accounts starred it.
• API Tokens: If you create an API token so that a program can act as your account, we store the name you give it, the date you created it, and the date it was last used, so that you can recognize a token and revoke it. The token itself is stored only as a hash; we show you the token once when you create it and cannot recover it afterwards. A token can create, change, and delete your own listings and read the pools you belong to. In a pool where you are an admin, it can also invite someone by email address, which adds them to the pool if that address already has a confirmed account and otherwise emails them an invitation; we store the address and any name given, the same as when you invite someone yourself. It can cancel a pending invitation, which deletes it so the link no longer works. The email already sent stays in the recipient's inbox. It can also post a request on your behalf and share it into your pools, which notifies the other members of those pools by email and browser notification, the same as if you had posted it yourself. It cannot read your chats or write a review, and anything done with it is recorded as done by you. If you connect an AI assistant or any other outside service using a token, it reads your listings and, while a pool is open, the tools, skills, and requests other members have shared there, including the unlisted ones. It also reads a listing's star count, a short-lived link to each finished photo, and the reviews and pool rankings you can already open. A review it reads has no author name. A request it reads carries the poster's account id, not their name. Rankings are numbers for one pool. They include your average star rating from the reviews you have received, and the points on completed maintenance tasks shared with that pool, except a task marked done while only its owner could mark it done, and except a task owned by a disabled account. They also include how many distinct people in that pool can currently see you because you chose Reveal in a tool, skill, or request chat there. Each person counts once, even across several listings. Direct messages and pool-admin threads are not included. Hide removes a person when they can no longer see you in any such chat in that pool. The numbers do not name the people, the listings, or the tasks. A completed maintenance task it reads names whoever marked it done, unless that person's profile is private, or the task was marked done while only its owner could mark it done and the program isn't acting as that owner. For each pool you belong to, the program can see that pool's member count, how many tools, skills, and requests the pool holds, and whether the pool is closed, disabled, or needs an active subscription. A closed pool is one that is disabled, needs an active subscription, or both. Its listings stay unreadable. The counts still come back. What it reads reaches whoever runs that service and is then handled under their privacy policy rather than ours. We do not detect which service you connected; the only indication we hold is the name you chose for the token. You can revoke a token at any time in your account settings, and doing so ends its access immediately.
• Connected Apps: Some programs connect to your account by sending you to a page here where you allow or refuse them, rather than by taking a token you created. When you allow one, we store which program it was: the name and web address it registered with us, neither of which we verify, along with the date you allowed it and the date it last acted. We also store the credentials it uses, as hashes only. A connected app can do exactly what an API token can do, and the paragraph above applies to it in full, including what reaches whoever runs it. Any program can register itself with us under any name, so what you are trusting is the app you started the connection from rather than the name on the page. Your connected apps are listed in your account settings, and disconnecting one ends its access immediately.
• Chat App Connections: If you connect a Slack or Discord account to ours, we store the identifiers that platform uses for you, its workspace or server, and the group channel if you connected from one. We also store its name, when you connected, when it last acted, whether request posts are on, and whether the platform says it can post. Separately, when a Slack workspace installs the app, we store the workspace identifier and name, the permissions it granted, and its bot token; the token is encrypted at rest. We use this data to recognize you when you run a command and to post new public requests from the public pools the connection searches. You can choose which pools it searches, move request posts to the channel where you run /garden requests on, or stop those posts with /garden requests off. The app cannot post a listing, read your chats, or open a conversation for you. A search result and an automatic post never carry the listing owner's name; an automatic request post also leaves out the poster's name. Your search words, replies, and automatic request posts pass through Slack or Discord and are handled under that platform's privacy policy. A search is answered in the channel where you ran it, so everyone who can read that channel can see the words and results. Automatic posts go to the saved group channel. Search results include only public listings shared with a public pool, and automatic posts include only public requests shared there. Other command replies are visible only to you. A search reply carries a Remove this button that only the person who ran the search can use. You can disconnect from account settings or the chat app, which ends its access immediately.
• Photo Upload Links: A program acting as your account can ask us for a link to upload a photo to one of your own listings, so it can send us the file itself instead of typing it out. We store a hash of that link, which listing it is for, how many uploads are left on it, and when it expires. A link lasts about fifteen minutes, covers a few photos on that one listing, and can do nothing else with your account. Revoking a token, disconnecting an app, or connecting that app again cancels every upload link on your account, because a link does not record which app asked for it. Expired links are deleted.
• 3D Sign Generator Files: You can use our free 3D sign generator without an account. Selecting an image makes an automatic preview in your browser and does not send the image to us. When you press Generate my sign, we store the PNG or JPG and the settings you chose in our database while a background task builds the model. We clear the image in the same database write that records success or failure. Queued and running jobs keep their images while they wait for an outcome. A successful generation keeps a zip containing the STL and 3MF models, preview, and filament-change instructions for repeat downloads for 1 hour after the result is saved. You can use Delete now in the creating browser to remove the completed job and its files sooner. Success or failure schedules cleanup for 1 hour after the outcome is saved. A recovery task runs every 15 minutes to remove expired sign rows missed by scheduled cleanup; an outage can delay deletion after access has ended. The background worker's ordinary execution record keeps only the generation ID, worker name, queue, timestamps, and sanitized error state, with no image, settings, or generated files. Completed execution records are deleted after 7 days; cancelled, discarded, or orphaned executing records may remain indefinitely. The sign generation stays separate from every account, and its database row contains no IP address. One random secret in your browser session protects every sign generation from that browser. We derive a separate access token for each generation and store only a hash of that token.
• QR Code Generator: You can use our free QR code generator without an account. The text you type, and an image you add to the middle of the code, are sent to our server so we can draw the code. We hold both in memory while that page is open. We reduce the image to a small PNG while it is in memory. We do not write them to the database. If the page crashes, an error report can include the text you typed. The image is not in that report. If you are signed in, that report includes your account id and email. If the text includes an upload link, a pool join confirmation link, a community confirmation link, or an unsubscribe link, the secret part of that link is removed. The rest of the text stays in the report.
• Payment Information: When you subscribe a pool, our third-party payment provider (currently Stripe or Dodo Payments), acting as our merchant of record, securely collects and processes the recurring billing details for the $4.99/month subscription. To start a subscription checkout we send that provider a reference to the pool you are subscribing, plus, when you are signed in, your email address and an account reference, so the subscription is linked to the right pool and subscriber. No raw card data ever touches our servers; we store a record of the subscription and each charge, which includes customer, subscription, and payment references, discount references, transaction totals, and the raw event payload from the provider.
• Invitation Data: When you invite others to join a pool, we collect the invitee's email address and, if the person inviting them provides one, their first and last name; an invitation can be sent with an email address alone. We also collect a unique invitation token and a record of when the invitation is used. An invitation that has been accepted is kept, so the pool's admins can see it was accepted and when, and if you created your account from one we record which invitation it was. A pool may also have a join code, a unique token an admin can turn on, regenerate, or turn off, which lets people request an invitation by following its link or scanning its QR code.
• Join Requests: When you request to join a pool, we store the email address you enter, the pool, and when you sent the request. You can send a request without an account. The pool's admins can see the address and accept or decline your request. Guests confirm through an emailed link before admins see the request. Signed-in users use their account email, with no extra link if it is already confirmed. We also store verification timestamps and hashes of the confirmation token and any pool join code used. Confirmation tokens expire after 24 hours and are cleared when used. Accepting adds an existing confirmed account to the pool or sends an invitation to the address. Submitting a request alone does not give access to the pool.
• Community Submissions: If your community is not on the Garden map or list, you can send us its name, your email, your name, and a phone number if you want to. We email you a link that expires in 24 hours. We treat the submission as a lead only after you open that link and confirm. Sending a submission does not create a pool or an account, and it does not confirm an account.
• Data Export Information: If you ask for a copy of your data, we build you a zip holding your data as a JSON file and a copy of every photo it refers to, and we keep a record of that export: the data in it, its status, when it expires, and a secure link to download it. The zip is stored privately and can only be downloaded by you, signed in. Exports are deleted automatically after they expire, which takes a day.
• Reports: If you report a chat message, user, pool, review, tool, supply, skill, request, or maintenance item, we store the report and its contents so it can be acted on. A report about a chat message, a user, a tool, a supply, a skill, a request, or a maintenance item is shown to the admins of the pool it concerns (and, if you chose to escalate it, to the platform), including your identity as the reporter and, for a reported message, the message and who wrote it. A reported tool, supply, skill, or maintenance item is shown to those admins by name, but its owner's identity is not revealed to them by the report; a request's poster is not anonymous in the first place. Reports about a pool or a review go only to the platform. Reports are confidential: a report goes to the admins of the pools it is sent to and to us, and to nobody else. A report is never part of a copy of your data, because a report written about you would often tell you who wrote it, whatever we removed from it. Reports you file yourself are included in your copy.

Information We Collect Automatically

• Audit Records: We keep an audit log of platform-significant events, such as moderation actions, account and pool deletions, data exports, legal-document acceptances, and reveal or hide events between users. This log supports security, abuse investigation, and legal compliance. When you delete your account, references to you in this log are removed.
• Pool Activity Records: Each pool's page shows an activity feed of what is in the pool and when it arrived: the tools and skills shared into it and the members who joined, with the date each happened. We keep no separate record for this; the feed is assembled from the tools, skills, and memberships that exist at that moment, so removing a tool or leaving a pool removes it from the feed. Only that pool's members can see which tools, skills, and people the feed is about; anyone else sees counts alone, and the feed never says who shared a tool or a skill.
• Signed-In Devices: When you sign in, we record when it happened and the browser identification string your browser sends with every request, which names the browser and the operating system it runs on, such as Chrome on macOS. We also record when each of these devices was last used to load a page, updated at most once a minute. Your account settings page lists the devices you are signed in on using this, most recently used first, so that you can recognize one and log it out. We do not store your IP address or your location alongside a session, and we do not keep a history of which pages a device visited. The record is deleted when that session is logged out, either by you or from another device, and in any case within a day of the session expiring, which happens sixty days after you signed in.
• Usage Data: We automatically collect information about your interaction with our services, such as your IP address, browser type, pages visited, and the dates and times of your visits. We measure this with our own first-party analytics, hosted on our servers; we do not use any third-party analytics service, and these analytics records are never sent to an advertiser. The separate advertising measurement described below is the only place anything about your visit reaches one, it happens only if you accept advertising, and it does not draw on these records.
• Sign Generator Rate Limits: To keep the free 3D sign generator available, we count generation attempts by IP address. This short-lived rate-limit record contains the address, the generator path, a time window, and the number of attempts. The counter stops applying when its window ends and is swept from memory within 10 minutes. It stays separate from every sign and account. Fly.io's proxy passes your IP address to the application for this check.
• Error and Session Diagnostics: We use Sentry to find and fix failures. So that we still learn about crashes for everyone, we always run basic error monitoring, which records the technical details of an error when one happens, such as the browser and the page you were on. It sets no cookies. If a live page, one that keeps a connection open after it loads, is still connecting after 10 seconds, or you leave after 4 seconds while it is still connecting, we send an error report every time. An embedded pool, the page that confirms a request to join, the page that confirms a community submission, and the unsubscribe page do not run browser error monitoring. The report says how long the browser waited, whether it was using a WebSocket or long polling, how many times the connection failed, how many times it closed, the code from the last close, whether the browser was online, whether the tab was visible, how long our server took to send the first byte, and how long the page took to arrive from our server. If the page connects after that report, we send those same details once more. When a click or a page change on a live page is already waiting, we send one timing if the wait finishes after 1 second or longer, or if the connection times out or drops. A timeout or a drop is included when the wait is shorter than 1 second, and after the page has already connected. The timing says how long the browser waited, whether it used a WebSocket or long polling, and whether the wait finished, timed out, or the connection dropped. We do not send a timing for a dropped connection while nothing is waiting. This timing sets no cookies and does not include the reason the connection closed. It does not include your IP address unless you have accepted the cookie consent banner. On every report the browser sends, we remove the query string, the fragment, and any password-reset, confirmation, account-deletion, unsubscribe, invite, join, or data-export code from the page address before sending the report. A report also lists the last few things that happened in that page before it failed, such as the pages you moved between and the values you submitted in a form, so that we can work out how to reproduce the problem. We remove passwords, password confirmations, and login and join codes from that list before sending it. If you were signed in when the error happened, the report also includes your account identifier and email address, so that we can tell which account ran into the problem and write to you about it. We also send Sentry timing measurements for a sample of the requests our servers handle, so that we can find and fix slow pages: these record which page was requested, how long our server took to answer it, and which database queries and background tasks ran while it did. A live click or page change that takes 1 second or longer is sent every time. That timing includes the callback, the template render, and the database queries. They are measured on our servers rather than in your browser, set no cookies, and record none of the content you type, upload, or read. If you accept our cookie consent banner, we additionally collect richer diagnostics: your IP address is attached to error reports, we measure sampled page-load and navigation performance in your browser, and we record occasional session replays, a reconstruction of how you interacted with a page (clicks, navigation, page changes), captured in your browser and stored in your browser's session storage while you are on the site. Session replays mask the text you type and block images and other media, so they capture layout and interaction rather than your content. You can decline this, and withdraw it later, in the cookie consent banner.
• Cookies: We use strictly necessary cookies to operate the service, such as keeping you signed in and protecting forms against cross-site request forgery; these are always set. Our self-hosted analytics uses one non-essential first-party cookie holding a random, short-lived session identifier so that consecutive page views count as a single visit; it expires after a few minutes of inactivity, is never shared, and is not used for advertising. Because this analytics cookie, and the richer error and session diagnostics described above, are not strictly necessary, we enable them only after you accept them in our cookie consent banner, and you can decline. Advertising cookies are a separate question in that banner, are set only if you accept that question specifically, and are described in the next item; accepting analytics does not turn them on. Each choice is recorded in a cookie that holds the choice and the date you made it, so you can see when you gave it.
• Advertising Measurement: We advertise ToolPool.Garden on Reddit and on Google, and we measure which of those ads lead anywhere, so that we do not keep paying for ads that do not work. This is off unless you accept it, in the Advertising question in our cookie consent banner, which is separate from the analytics one and stays unticked until you tick it. When you create an account, the answer you gave there is the answer we record on it. If you do accept, two things happen. When you click one of our ads, Reddit or Google adds an identifier to the address you land on, and we store it in a cookie of ours; if you go on to register, we save it on your account, so that a subscription charge weeks later can still be matched to the ad you came from. And at a few points afterwards our servers tell that advertising partner it happened. Those points are: you finish registering, you confirm your email address, you join or create your first pool, you set up a subscription, and a subscription charge goes through. Not every partner is told about every one of them: we tell Google about all five, and Reddit about four, because Reddit has no way to make use of the email confirmation, so we do not send it. Each message carries the identifier from the ad, the amount for a charge, and your email address and account identifier, both converted into an irreversible hash before they leave our servers, which is how the partner matches the event to the ad account that showed you the ad. Neither partner is sent the content of your listings or messages, your name, your location, or anything about which pools you belong to or who else is in them. Neither runs any code on our site: there is no advertising script, and neither sets a cookie here. Everything they are told, we send from our own servers. That also means we do not tell them about people who simply visited, only about the events listed above. We record that you accepted, and when, on your account, because those later events happen when there is no browser present for us to ask again. You can decline this, and withdraw it later, in the cookie consent banner. Withdrawing deletes the advertising cookies, erases the identifiers and the record of your acceptance saved on your account, and stops all further reporting. If you have an account, there is also an Ad measurement switch in your account settings, described under Your Choices below, which covers more than the banner can.

Information We Receive from Others

Some information about you can reach us from another person rather than from you directly. If someone invites you to a pool, we receive your email address from the person inviting you, along with your first and last name if they provided them, and we use that information only to deliver and honor the invitation. Other users may also submit information about you when they write a review about you or file a report concerning you or something you posted; we handle that information as described in the Reviews and Reports items above.

Business Outreach Information

When we contact someone in their role with a U.S.-based property, neighborhood group, or makerspace about ToolPool.Garden, a staff member enters the contact's work email address and location in a form that sends one email at a time, and confirms that the recipient is acting in that role. Apartment and makerspace letters require the contact's name. An HOA letter and a neighborhood association letter can be sent with that name left blank, and the message does not include it. The welcome choice on that form is separate. A staff member enters a first name and an email address, reviews the letter, and confirms they want to send it. The form does not ask for a location, and the confirmation does not describe a property role. We use an encrypted SMTP check to ask a mail server for the recipient's domain whether it will accept the address for delivery; if the server cannot establish verified encryption, we do not send it either address. Garden then prepares the message and sends it through Olivia's Google Workspace account. The form clears after Google Workspace accepts it for sending and also if a connection failure leaves the handoff uncertain, because retrying an uncertain handoff could send a duplicate; in that case the operator checks Olivia's sent mail before taking another action. Garden stores the recipient's address and the exact sent message, including the location and any name that was entered, alongside a numbered template version. Google Workspace also retains the sent message. Garden imports replies linked by email thread headers and stores their text, sender, import time, word-based rating suggestions, and staff ratings. Only authorized staff can read or rate these conversations. Staff can change a rating as a conversation develops. Word matching is automatic and can be wrong; staff can override it. Email content is not sent to AI. Our audit log keeps the location and a versioned, keyed fingerprint of the normalized email address. If the recipient opts out, our do-not-email list keeps only that fingerprint and blocks outreach and all other email to that address, apart from the emails that keep an account working. HOA, neighborhood association, apartment, and makerspace messages identify Olivia and ToolPool.Garden, include her postal address, and explain how to stop future outreach. The welcome is sent from [email protected]. It thanks the person for signing up. It does not include a location, a landing page, the postal address, or that stop line. An address on the do-not-email list still cannot receive it.

Device Location

Where a feature needs your position (for example, the "Center on my location" button on the world map, the "Sort by distance" button on the pool list, or the pool location picker), we use your browser's device geolocation prompt exclusively, and only when you press the button. We do not derive your location from your IP address. On the map and the location picker your position stays in your browser. Sorting the pool list by distance is the one place we receive it: your coordinates are sent to our server so it can order the pools by how far away they are, held only in memory for as long as that page is open, and never written to our database, attached to your account, or put in the page's web address, so a link you share or bookmark cannot carry your location. A pool's pinned location, which its admin chooses, is stored as part of the pool.

3. How We Use Your Information

We use the information we collect for the following purposes:

• To Provide the Service: To operate pools, tool and skill listings, member requests, borrow, teaching, and request-response chats, direct messages between members of a pool, reviews, and pool subscriptions and billing.
• To Communicate With You: To send service-related notifications you have enabled, and operational or legal communications (such as account-status notices and policy updates) that are sent regardless of notification preferences.
• To Follow Up on a Community: After you confirm a community submission, our staff use your name, email, and phone, if you gave one, to contact you about setting that community up.
• For Security and Integrity: To protect our platform from fraud and abuse, investigate reports, and ensure the security of your data.
• To Comply with Legal Obligations: To meet our legal and regulatory requirements.
• To Promote the Platform: To show what the platform does: for example, a tool listing, photo, or review appearing in a screenshot, demonstration, or marketing material. The Terms of Service include a release for this use. It does not change your anonymity between users on the platform, and you can ask us to stop using a particular piece of your content in our marketing.

Automated Tools

We use automated systems, which may include hash-matching against databases of known illegal imagery (such as child sexual abuse material) and spam, fraud, and malware detection, to help identify and address harmful content, in some cases proactively. These tools scan the content you submit, such as tool and skill photos, listings, and messages, and may flag, restrict, or remove content that appears to be illegal or to violate our Terms of Service. Where the law requires it, we report certain content, such as suspected child sexual abuse material, to the appropriate authorities.

4. Anonymity, Reveal, and Other Users

Anonymity between users is a core feature of the platform, and it affects what other users can see about you. Tools are listed anonymously inside their pools, and so are the skills you offer to teach. When someone requests one of your tools, you see who is asking; they do not learn who you are unless you choose to reveal your identity in the chat. A reveal covers only the tool, skill, or request that chat is about, so your other listings stay anonymous to that person unless you reveal yourself on those too, and you can hide your identity again on any listing where you revealed it.

Marking your own maintenance task done can also identify you as the owner of the linked listing, as described under With Other Users below.

Requests run the other way around. Members of the pools you share a request into can see your name and avatar next to it, linked to your profile. It is the people who offer to help who stay anonymous until they choose to reveal themselves to you. Turning off your Public profile setting does not change what those members see, because it controls who may open your profile page rather than whether your name is shown on your own request. Anyone outside those pools sees a public request without its poster. A public pool page or embed includes an unlisted request in the pool's private request count. The count does not reveal the request or its poster. When you share a request into a pool, we email the other members of that pool to say a request was posted there, and send a browser notification to those who have turned browser notifications on. The notification gives the pool's name and no one else's, and it links to the request, where your name is shown.

Direct messages are outside the anonymity system. Anyone who shares a pool with you can write to you from your profile page, and a direct message names each of you to the other from the start. There is no anonymous way to write to someone, and there is no reveal step afterwards, because neither of you was hidden. Turning off your Public profile setting does not stop this, because people you share a pool with can open your profile either way. Pool-admin threads work the same way. Both kinds of thread belong to a pool, and that pool's admins see a reported message along with who wrote it.

Information you place in free-text fields is outside this protection. In particular, reviews are shown without the author's name, but the body of a review cannot be scrubbed after the fact, which is why the review form warns against including identifying details. Images you upload (tool, skill, and request photos, your avatar, and a pool's logo) are stripped of embedded metadata such as EXIF camera details and GPS location tags. We remove that metadata during processing shortly after you upload: the original file is held privately and only briefly while it is processed, is then deleted, and is never shown to anyone; only the stripped version is ever displayed or shared. The link a photo is shown through is built from the listing it belongs to rather than from your account, so the address of a tool or skill photo does not say whose it is. If you delete your account, people you had previously revealed yourself to will see you as "Deleted user" everywhere.

Anonymity applies between users, not to the platform, to moderation, or to legal process. We always know which account is behind an anonymous listing or review: our staff can see it when moderating, and we may disclose it as described in "How We Share Your Information", including in response to a valid legal request. Likewise, if a chat message you wrote is reported, the admins of the pool it was posted in see the message and your identity as its author so they can handle the report, even if you are anonymous to the other person in that chat, and even when the admin handling the report is that other person.

Anonymity is also not a limit on what leaves the platform. Any member of your pool can connect an outside program, such as an AI assistant, either by creating an API token or by allowing the program on our own connection page, and it then reads what that member can read. While a pool is open, that includes its tools, skills, and requests, unlisted ones included. Your listings stay anonymous in what it reads, and your chats are not readable through a token at all. If you mark your own shared maintenance task done and anyone in the pool could have marked it, your name shows the same as another member's would, which can reveal that the linked listing is yours. A program also cannot write a review or open a chat. It can read a star count and a short-lived link to each finished photo. It can read reviews and rankings on any profile that person can already open. A hidden profile gets the same answer as an unknown one. The review still has no author name. It can also see who marked a shared maintenance task done. A private profile shows as *******, and a task marked done while only its owner could mark it done shows no name, unless the program is acting as that owner. A request carries the poster's account id, which is also the address of their profile, and anything you wrote in a title, description, or photo goes with it. You will not be told when someone in your pool does this. If that matters for something you are sharing, a pool is a group of people you have chosen to trust, and this is one of the things that trust covers.

5. Why We Process Your Information

We process your personal data for the following reasons:

• Performance of a Contract: We process your data to provide the services described in our Terms of Service.
• Consent: We may process certain data based on your consent, which you can withdraw at any time. This applies to promotional updates sent to people who subscribe to our updates list (every such email includes an unsubscribe link); to our non-essential first-party analytics cookie; to our richer error and session diagnostics (IP address in error reports, sampled browser page-load and navigation performance measurement, and session replays); and to our advertising measurement with Reddit and Google. The last three we enable only if you accept them in our cookie consent banner, where advertising is a separate question from the other two; if you accepted advertising when you created an account, we record that consent on the account.
• Legitimate Interests: We process data for our legitimate interests, such as for security, abuse prevention, service improvement, the basic error monitoring we run for everyone to detect and fix failures, a timing for a live click or page change that is already waiting and then finishes after 1 second or longer, or times out or drops, and individual outreach to people working with U.S.-based properties, neighborhood groups, and makerspaces that may have a use for ToolPool.Garden, provided these interests are not overridden by your own interests or rights. HOA, neighborhood association, apartment, and makerspace outreach emails explain how to stop future marketing emails.
• Legal Obligations: We process and retain certain data, such as payment records and legal-document signatures, to comply with the law.

6. How We Share Your Information

After you choose to Reveal in the chat for a tool, skill, or request, either participant can share a suggested post through Facebook, X, Bluesky, or Threads, or by copying it. Facebook shares a link to the listing, or to the home page if the listing isn't public. It does not include the suggested wording. If the listing is public, the post includes its name and link. If it isn't, the post uses general wording and a link to the home page. We add no account names or messages from the chat, but a public listing's title can contain identifying details. We don't post automatically or record whether you publish it. Hide identity can't remove a post you've already shared, and whatever you publish is under that service's privacy policy.

We do not sell your data. We only share your information in the following circumstances:

• With Other Users: A verified join request shares your email address with the admins of that pool. By default your profile is public and anyone can view it; if you turn off the Public profile setting, only you and people who share a pool with you can view it. Anyone who shares a pool with you can also write to you from your profile page, and that message shows each of you the other's name and profile picture on your chat lists; the Public profile setting does not change this, since a pool co-member can open your profile either way. Members of a pool you belong to can see your membership and the tools and skills you have listed into that pool (anonymously, until you reveal yourself on one of them in a chat). Requests are the exception: that pool's members can see your name and avatar next to a request you post, and can open your profile if your profile is visible to them; people outside the pool see a public request without its poster. We also email those members to say a request was posted in the pool, and send a browser notification to those who have turned browser notifications on; the notification gives the pool's name and no one else's, and links to the request. Listings you set as public are additionally visible to anyone who views a public pool you share them with, including people without an account. Public listings shared only with private pools stay visible in detail only to you and members of those pools. Listings you mark as unlisted stay visible in detail only to you and members of the pools you share them with. A public pool page and its embed state how many unlisted tools, supplies, skills, or requests the pool contains. That total is labelled as private listings. It does not show which listings or people make up the total. Chat participants see the messages you send them, and a message that is reported is also shown to the pool's admins as described under Reports. Reviews appear on the profiles they are written about. Anyone who can view your profile sees your maintenance points for one pool chosen from a menu on the profile. The points come from completed maintenance tasks shared with that pool, except tasks you marked done while only you could mark them done and tasks owned by a disabled account. The total is ranked against the pool's other current members, and it does not name the tasks behind it. Your profile already shows the average star rating from the reviews you have received. That average is ranked the same way, among members with at least 3 reviews. Your profile shows no count of your tools, supplies, or skills. It does show how many people in the selected pool can currently see you, because you chose Reveal in a chat there. Each person counts once, even across several listings. The total does not name those people or the listings. Direct messages and pool-admin threads are left out. Hide removes a person when they can no longer see you in any such chat in that pool. The menu on your own profile lists pools you belong to. Another person sees a private pool in that menu only when they belong to it. Anyone who can view the profile sees your public pools there, signed in or not. A pool that is disabled, or one that needs an active subscription, stays off that menu. Your profile has a Pools tab. You see every pool you belong to. Someone else who can view your profile sees your public pools that are not disabled, and any private pool you both belong to. Someone who is not signed in sees those public pools. Maintenance shared with a pool shows task titles, notes, dates, and completion times to its members. A public profile shows the completing person's name. A private profile is shown as *******. A task marked done while only its owner could mark it done shows the completing person's name only to that owner. Everyone else sees that it's done and when. In public, open pools, visitors see the same. When embedding is on, that pool's embed shows the same completion names a logged-out visitor already sees on the public pool page, with the same masks. Sharing a task does not identify its owner or grant access to its attached listing. If you mark your own task done and anyone in the pool could have marked it, your name shows the same as another member's would, which can reveal that the linked listing is yours. Internal notes on a maintenance task or automation are visible only to the person who created it. Marking a task undone clears its completion name and time. Unshared tasks, checkout counts on maintenance automations, and private calendar links stay private. A public, open pool's Maintenance tab also has a public calendar link that anyone, signed in or not, can subscribe to in a calendar app. It carries the task titles, notes, dates, and done status shown on the tab, without the name of a task's owner or of the person who marked it done. The link stops working once the pool is private or closed. A calendar app can keep showing what it already fetched, including a task that is no longer shared. The pool leaderboard gives each member one score. That score is the member's maintenance points, plus 5 points for each person who can currently see them because that member chose Reveal in a tool, skill, or request chat there. The maintenance points are the points on the tasks that member completed that are still shared with that pool, except a task marked done while only its owner could mark it done, and except a task owned by a disabled account. The 5 points go to the member who chose Reveal. One person counts once, even across several listings. Members of an open pool can see the score. Visitors can see it when the pool is open and public. The leaderboard newsletter emails period scores and all-time scores to members who have it switched on. A period score is the maintenance points earned in that period. An all-time score is that same leaderboard score. The email does not name the people who can see the member. It lists a private profile as *******. When embedding is on, the embed shows those same leaderboard names and the same masks. Your profile has a Pools tab. You see every pool you belong to. Someone else who can open your profile sees your public pools, and any private pool you both belong to.
• With Our Staff, for a Community Submission: After you confirm, our staff can see the community name, your name, your email, your phone if you gave one, and when you confirmed. They may call or email you about setting that community up. Other visitors do not see the submission.
• With Service Providers: We share information with third-party vendors and service providers who support our business. We provide a detailed list of our major service providers in the following section.
• With Reddit and Google, for Advertising Measurement: Only if you accept advertising, in our cookie consent banner, we tell Reddit and Google when you register, join or create your first pool, set up a subscription, or are charged for one, and we tell Google alone when you confirm your email address, together with the click identifier from the ad you arrived through, the amount for a charge, and a hashed form of your email address and account identifier. Each of them uses this to report on and target its own advertising. That is a use of your information beyond working on our behalf, so U.S. state privacy laws may treat it as 'sharing' for cross-context behavioral advertising. It does not happen unless you turn it on, and unticking Advertising in the banner stops it. With each event sent to Google we also send your consent decision itself, and we always tell Google not to use the data to build advertising audiences.
• With a Service You Connect Yourself: If you give an outside program access to your account, such as an AI assistant, by creating an API token and pasting it in or by allowing the program when it sends you to our connection page, that program can read and change your own listings, read the pools you belong to, and invite people by email into any pool where you are an admin. An invitation sent that way reaches its recipient as an email from us, sent on your behalf. The email cannot be pulled back from the recipient's inbox. A pending invitation can be cancelled, which stops the link from working. It gets less than you do: it cannot read your chats, write a review, reveal your identity to anyone, change a pool's settings or remove its members, or reach your billing. It can read the reviews and rankings you can already see, a listing's star count, and a short-lived link to each finished photo. What it does read goes to whoever runs it and is covered by their privacy policy, not this one. That includes what other members of your pools have posted there, so a pool's contents can reach a service one of its members chose and the others did not. We do not choose these services and we cannot see or control what one does with what it reads. What we hold about which service it was is the name you gave the token, or, for a program you allowed on the connection page, the name and address it registered with us, which we do not verify. Revoke the token, or disconnect the app, in your account settings to end its access at any time.
• For Legal Reasons: We may disclose your information if required by law or in response to a valid legal request.
• Business Transfers: In the event of a merger, acquisition, or sale of assets, your information may be transferred to the new entity.

7. Our Service Providers

We rely on third-party services to run ToolPool.Garden. These providers have their own privacy policies and terms, and we encourage you to review them.

• Fly.io provides our application hosting and database hosting (Fly Managed Postgres). We have a signed data-processing agreement with them.
• Tigris privately stores the images you upload (tool, skill, and request photos, your profile avatar, and a pool's logo) and the shared basemap file. It also stores the zip we build when you ask for a copy of your data, which holds that data and those images together for the day the download link lasts. The files are not publicly listable and are shown only through short-lived, signed links. Your browser loads that basemap file from Tigris with one of those links. A newly uploaded photo is held there briefly in its original form while we strip its embedded metadata; that original is then deleted and is never shown to anyone through the app; only the stripped version is ever displayed. Their data-processing addendum applies to us by reference.
• Cloudflare provides content delivery, networking, and DDoS protection, and supplies the Turnstile bot-protection challenge on our log in, sign up, and password reset forms, on the form to request to join a pool, and on the community submission form on the Garden map and list. To tell people from bots, Turnstile processes technical signals from your browser, such as your IP address and browser characteristics, on Cloudflare's servers. Their data-processing addendum applies to us by reference.
• Google provides the optional 'Continue with Google' button on our log in page. If you use it, Google tells us the email address on your Google account and a permanent identifier for that account, which we use only to find your existing ToolPool.Garden account and to sign you in; we store that identifier so we recognize you next time. Using the button also tells Google that you are signing in to ToolPool.Garden. We do not ask Google for your contacts, calendar, or any other data, and we never post anything to your Google account. You never have to use it, and you can always log in with your email and password instead. Their data-processing terms apply to us by reference.
• Google Workspace provides our company email and document storage. Support correspondence is held there. Business outreach sent from Olivia's account is held there too, including the recipient's email address, location, message, and any name that was entered. Google's Cloud Data Processing Addendum applies to us by reference.
• Recipient email systems receive the sender and recipient addresses during the direct SMTP check that asks whether they will accept an outreach address for delivery. The app requires verified STARTTLS before disclosing either address, and the check stops before sending message content. These systems are operated by the recipient's organization or its email provider, rather than by a service provider we chose.
• Stripe is one of our payment providers and can act as our merchant of record; it processes payments and refunds and hosts the billing portal when it is the active provider. Their data-processing addendum applies to us by reference.
• Dodo Payments is one of our payment providers and can act as our merchant of record; it processes payments and refunds and hosts the billing portal when it is the active provider. Their data-processing addendum applies to us by reference.
• Sentry captures application errors so we can find and fix failures. An error report can include technical details of the request that failed, such as browser information and the page you were on, the account identifier and email address of a signed-in user, and a short list of what you did in the page just before it failed, without passwords or codes. We also send timing measurements for a sample of the requests our servers handle, covering which page was requested and how long the server and its database queries took. A live click or page change that takes 1 second or longer is sent every time. That timing includes the callback, the template render, and the database queries. Every time a live page is still connecting after 10 seconds, or you leave after 4 seconds while it is still connecting, we also send a report. An embedded pool, the page that confirms a request to join, the page that confirms a community submission, and the unsubscribe page do not run browser error monitoring. The report says how long the browser waited, whether it was using a WebSocket or long polling, how many times the connection failed, how many times it closed, the code from the last close, whether the browser was online, whether the tab was visible, how long our server took to send the first byte, and how long the page took to arrive from our server. If the page connects after the first report, we send those same details once more. When a click or a page change on a live page is already waiting, we send one timing if the wait finishes after 1 second or longer, or if the connection times out or drops. A timeout or a drop is included when the wait is shorter than 1 second, and after the page has already connected. The timing says how long the browser waited, whether it used a WebSocket or long polling, and whether the wait finished, timed out, or the connection dropped. We do not send a timing for a dropped connection while nothing is waiting. This timing sets no cookies and does not include the reason the connection closed. It does not include your IP address unless you have accepted the cookie consent banner. On every report the browser sends, we remove the query string, the fragment, and any password-reset, confirmation, account-deletion, unsubscribe, invite, join, or data-export code from the page address before sending the report. If you accept our cookie consent banner, we also send Sentry your IP address with error reports, sampled page-load and navigation performance data measured in your browser, and occasional session replays (a masked reconstruction of how you interacted with a page). We have a signed data-processing agreement with them.
• Mailjet sends our transactional emails (e.g., account notifications, password resets). Promotional emails go only to people who subscribe to our updates list, which is stored and managed in Mailjet; every promotional email includes an unsubscribe link. Their data-processing addendum applies to us by reference.
• Browser push services deliver browser notifications, if you turn them on. These are run by the maker of the browser you use (Google, Mozilla, Apple, or Microsoft), and your browser, not us, chooses which one. We hand that service the notification, encrypted with keys only your browser holds, and the address it gave us for your browser; it passes the notification on and cannot read it. Nothing is sent to them unless you turn browser notifications on, and turning them off deletes the address.
• TypeSafe suggests a unit from a supply's name. We send TypeSafe the name you type, and the saved name when you edit a supply or its stock. Your account and the rest of the listing stay here. You can skip the suggestion and type your own unit. We keep that name in memory for 6 hours so we do not send it again, and we do not store it in the database for this. Their data-processing addendum applies to us by reference.
• Canny manages our public roadmap. When you interact with the roadmap, you are using their service. We have a signed data-processing agreement with them.
• Slack and Discord carry our chat bots, if you choose to connect one. They receive nothing from us unless you run a command: your reply travels back through them, so a list of tools you searched for passes through the platform you ran it in and is handled under that platform's privacy policy rather than ours. A reply is sent so that only you can see it, and neither platform is a service provider working on our behalf. What we receive from them is described under 'Chat App Connections' above.
• Reddit and Google Ads show our ads and measure which of them lead anywhere. These are the companies on this list that use what we send for their own advertising business, so we treat them as advertising partners rather than vendors working only on our behalf. Nothing reaches either unless you accept advertising, and what we send is described under 'Advertising Measurement' above. This entry is the advertising one. Google Workspace, which handles our email and documents, is a service provider and has its own entry above.

The map library and the fonts are served from our servers. When the shared basemap file is not available, the country outlines are served from our servers too. When that file is available, your browser loads it from Tigris with a short-lived signed link, and Tigris receives the IP address of those requests. Tigris stores the file for us. Your position stays in your browser unless you press the "Sort by distance" button on the pool list, as described under Device Location above.

8. Data Security

We protect your information with technical and organizational measures, which include:

• Encryption: Data is encrypted in transit using Transport Layer Security (TLS) and encrypted at rest.
• Access Control: We enforce strict access controls keyed on pool membership, so that pool-scoped data such as chats and reports is only accessible to the people it belongs to. Every request is authorized against your memberships before any data is returned.
• Password Security: User passwords are not stored in plaintext and are securely hashed using modern, strong hashing algorithms.

However, no method of transmission over the internet or method of electronic storage is fully secure. While we work to use commercially acceptable means to protect your data, we cannot guarantee its absolute security.

9. Your Data Rights and Choices

Depending on where you live and the laws that apply to you, you may have certain rights regarding your personal data. These rights include:

• The Right to Access: You can request a copy of the personal data we hold about you. You can also export your data yourself at any time from your account settings.
• The Right to Rectification: You can request that we correct any inaccurate or incomplete data. Most profile information can be edited directly in your account settings.
• The Right to Erasure ('Right to be Forgotten'): You can delete your account yourself at any time from your account settings, or request that we delete your personal data, under certain conditions.
• The Right to Restrict Processing: You can request that we restrict the processing of your data, under certain conditions.
• The Right to Turn Off Ad Measurement: If you have an account, your account settings hold an 'Ad measurement' switch, which does more than the cookie banner can. Turning it off stops us reporting anything further about you to either advertising partner, erases both ad identifiers and the record of your consent from your account straight away, and cancels anything we had queued but not yet sent. Turning it back on counts as agreeing again, and we record that; it does not bring back the ad identifiers, so we can match you to an ad again only from the next one you click. Where a partner gives us a way to reach back and delete what it already holds about you, we use it without being asked: Reddit provides one, so we submit that request automatically and it is normally completed within thirty days. Google provides no way to delete an advertising event once it has been sent, so there is no request we can submit to Google automatically; if you want us to take it up with them directly, write to us and we will. What gets erased is the advertising data the partner can match to you, not your own Reddit or Google account, which is nothing to do with us. Deleting your ToolPool.Garden account works the same way.
• The Right to Data Portability: You can request that we transfer the data we have collected to another organization, or directly to you, under certain conditions. The self-service data export gives you a zip holding your data as a machine-readable JSON file and a copy of every photo it refers to.
• The Right to Object: You have the right to object to our processing of your personal data, under certain conditions.
• The Right to Lodge a Complaint: You have the right to lodge a complaint with the data protection or consumer-protection authority that regulates your area if you believe our processing of your personal data violates applicable law.

To exercise these rights, use the self-service tools in your account settings or contact us at the email address provided in the 'Contact Us' section. We will respond to your request within the timeframes required by law. We may need to verify your identity before acting on a request, and we will limit what we ask for to the information necessary to do so; you will not be charged a fee for making a request or for the verification of your identity. Where applicable law allows it, you may designate an authorized agent to submit a request on your behalf. Before acting on an agent's request, we may require proof that you authorized them to act for you and may ask you to verify your identity with us directly.

10. Your Rights Under U.S. Privacy Laws

If you are a resident of certain U.S. states, such as California, you may have additional rights regarding your personal information. These rights may include:

• The Right to Know: The right to know what personal information we have collected about you, including the categories of information, the sources from which it is collected, the business purpose for collecting it, and the categories of third parties with whom we share it.
• The Right to Correct: The right to request the correction of inaccurate personal information we hold about you.
• The Right to Delete: The right to request the deletion of your personal information, subject to certain exceptions. Self-service account deletion is available in your account settings.
• The Right to Opt-Out of Sale/Sharing: You may have the right to opt out of the 'sale' of your personal information or its 'sharing' for cross-context behavioral advertising. We do not and have not 'sold' personal information as that term is defined under applicable law. We do report the lifecycle events described under 'Advertising Measurement' to Reddit and to Google for advertising measurement, which those laws may treat as 'sharing', but only for people who have accepted advertising in our cookie consent banner. It is off until you turn it on. We offer two ways to turn it back off, and either one is a valid opt-out request: the 'Your Privacy Choices' link in our footer, which stops it in the browser you are using, and, if you have an account, the 'Ad measurement' switch in your account settings, which stops it for your account everywhere. We also honor the Global Privacy Control browser signal as an opt-out, as described below. Opting out stops future sharing. It also asks the partner to erase what was already shared, where the partner offers a way to ask: Reddit does, and we submit that automatically. Google does not, so write to us if you want us to take it up with them. Nobody under 18 may hold an account, so we do not knowingly sell or share the personal information of consumers under 16 years of age.
• The Right to Non-Discrimination: The right not to be discriminated against for exercising any of your privacy rights.

We offer two ways to submit a request. First, you can use the self-service tools in your account settings to export a copy of your data or to delete your account, which erases your personal information except the records described under Data Retention. Second, for any privacy request you can email us at the address in the 'Contact Us' section, and we will verify and respond within the timeframes required by law. We will not discriminate against you for exercising these rights. If we deny your request in whole or in part, you may appeal our decision by replying to our response, or by emailing us at the same address with the subject line 'Appeal'. We will respond to your appeal within the timeframe required by law, and if we deny the appeal, we will explain how you can contact your state attorney general or other supervisory authority to submit a complaint.

Categories of Personal Information We Collect

In the preceding 12 months, we have collected the following categories of personal information, as those categories are defined under the CCPA, and disclosed each of them to the service providers described in the 'Our Service Providers' section (categories marked * are sensitive personal information):

• Identifiers, such as your name, display name, email address, IP address, the identifier Google uses for your Google account if you log in with Google, the identifiers Slack or Discord use for you and for the workspace or server you connected from if you connect a chat app, and the click identifier attached to an ad you arrived through if you accept advertising. Text you type into the QR code generator can also be an identifier, such as a name or an email address inside a link. An image you add to the middle of the code can show a person or a logo. The text and the image are held while the page is open, as described under QR Code Generator.
• Commercial information, such as records of pool subscriptions and the charges made for them.
• Internet or other electronic network activity information, such as the pages you visit and how you interact with the services, collected through our own first-party analytics and error diagnostics.
• Audio, electronic, visual, or similar information, such as the photos you upload for tool, skill, and request listings, your profile avatar, a logo you upload for a pool you administer, artwork you submit to the anonymous 3D sign generator, and an image you add to the middle of a QR code.
• Account access credentials*, meaning your email address and password (stored only as a secure hash) and, if you enable it, your two-factor authentication secrets.
• Contents of communications not directed to us*, meaning the messages you exchange with other users in chats and direct messages.

The sources of this information, the purposes we collect it for, and the parties we disclose it to are described in the sections above. We do not collect geolocation data, biometric information, health information, or inferences drawn to build a profile about you. Two of these categories also go to our advertising partners for measurement, and only for people who accepted advertising. Those are identifiers, meaning the click identifier and a hashed email address and account identifier, and commercial information, meaning that you signed up, confirmed your email, joined your first pool, started a subscription, or were charged for one.

Sensitive Personal Information

Three categories of information we process are "sensitive personal information" as defined under the California Consumer Privacy Act (as amended by the CPRA) and similar U.S. state privacy laws: your account log-in credentials, the contents of the messages you exchange with other users, which are communications where we are not the intended recipient, and (only if you ask for it) your precise device location. We use this information only to provide the services you request (signing you in, delivering your messages, and ordering the pool list by how far away each pool is) and for the security, integrity, content-moderation, and legal-compliance purposes those laws permit, and we do not use or disclose it to infer characteristics about you. Your precise location reaches us only when you press the pool list's "Sort by distance" button; it is used only to order that list, held in memory for as long as that page is open, and never stored, sold, or shared. The map's "Center on my location" button and the pool location picker use your browser's geolocation without sending it to us at all, and a pool's map location is an approximate point its admin chooses and can place anywhere they like. We do not collect any other category of sensitive personal information: for example, government identifiers, financial account credentials, health information, or data revealing race, religion, or sexual orientation. Because we use sensitive personal information only for these permitted purposes, the right to limit its use and disclosure does not apply.

Response to "Do Not Track" and Global Privacy Control Signals

Some web browsers have a "Do Not Track" feature. This feature lets you tell websites you visit that you do not want to have your online activity tracked. These features are not yet uniform, and we do not currently respond to "Do Not Track" signals. We do honor Global Privacy Control. If your browser or an extension sends that signal, we treat it as an opt-out of advertising measurement: we never ask you the Advertising question, and "Accept all" cannot turn advertising on. If you had already accepted advertising before the signal appeared, that permission is withdrawn and its cookies are deleted.

11. International Data Transfers

ToolPool.Garden is based in the United States, and we store and process your information in the United States. Our services are operated from the United States and directed to users in the United States. If you access the services from outside the United States, you understand that your information will be transferred to, stored, and processed in the United States, where privacy laws may differ from, and may provide less protection than, those in your jurisdiction. Some of our service providers may process data in other countries to provide their services. Where a provider processes data across borders, we rely on the safeguards included in that provider's standard data-processing terms.

12. Data Retention

We retain personal data only for as long as necessary to fulfill the purposes for which it was collected, to provide our services, to comply with legal obligations, and to resolve disputes. Our retention periods vary depending on the type of data:

• Business Outreach: Garden keeps sent outreach messages and imported replies, with recipient details and thread ratings, in its application database. The form clears after Google Workspace accepts the message for sending and when a connection failure makes the handoff uncertain, to prevent a blind retry from sending a duplicate. We review Olivia's mailbox and Garden's stored outreach conversations every quarter and delete conversations once they are two years old, unless an ongoing conversation or business relationship still needs them. Deleting a conversation in Garden removes its messages and ratings from the statistics. We retain numbered templates without recipient personalization so staff can compare the wording used. You can request access or deletion through [email protected]. Garden's audit log retains the location and a versioned, keyed fingerprint of the normalized recipient address as a record of the check and send. If the recipient opts out, we keep that fingerprint on the do-not-email list described below. The fingerprint remains pseudonymous personal data: someone with the dedicated application secret and a guessed address could test whether it matches. Database backups may retain a deleted record for the limited backup period described below.
• Pending join requests are deleted when an admin accepts or declines them, when the pool is deleted, or when an account with that current email address is deleted. A daily cleanup deletes requests older than 90 days and unverified requests more than 24 hours after the last confirmation email. To remove a guest request or one under a previous address sooner, contact [email protected] from that address. A confirmed account's data export includes requests under its current email address.
• A community submission stays until an account with that current email address is deleted, or until you ask us to remove it through [email protected]. The confirmation link expires in 24 hours. The submission stays when the link expires. A confirmed account's data export includes submissions under its current email address and leaves out the confirmation secret.
• Account Data: We retain your account, profile, pool, tool, skill, chat, and review data for as long as your account is active. When you delete your account, your personally identifiable information is erased, and people you had previously revealed yourself to see you as "Deleted user". That includes the invitations you sent to other people, the pending ones sent to your current address, and the one your account was created from. An invitation sent to an address your account no longer holds is the exception, because nothing links it to you any more; write to us and we will remove it. Some records may be retained where required for legal or accounting purposes. If your address is on our do-not-email list, its fingerprint stays on the list after you delete your account.
• Do-not-email list: When an address goes on our do-not-email list, we keep a keyed fingerprint of it with no expiry, and we keep it after any account with that address is deleted. We keep it because we have a legitimate interest in honoring the opt-out, and without it we could email the address again. The fingerprint is pseudonymous personal data, since someone with our dedicated application secret and a guessed address could test whether it matches. If you have a confirmed account with that address, you can take it off the list in your notification settings. You can also ask us through [email protected].
• Payment and Legal Records: Payment ledger entries and signed Terms of Service and Liability Waiver records are retained as long as needed to satisfy accounting, audit, and legal requirements. When you delete your account, payment ledger entries are not deleted (accounting and tax law require us to keep them), but the reference linking each entry to your account is removed, and the raw event data we received from the payment provider for those entries is deleted with your account.
• Service Usage Data: Usage logs are kept on our own servers and used for security, abuse investigation, and understanding how the service is used. A usage log records a single visit to a page, including your IP address, and we delete these logs 90 days after they are recorded. Our traffic dashboard reads these logs directly, so once they are deleted that period is gone from it as well. We do not keep a separate long-term copy of the visit counts. Separately, we keep anonymized statistics on how many accounts and pools remain active over time. Those are counted from account and pool records rather than from usage logs, hold no IP addresses or browsing history, are not linked to you, and may be retained indefinitely for service improvement and statistical purposes.
• 3D Sign Generator Files: We keep your source image while the job is queued or running, then clear it when the database records success or failure. The 1-hour download period starts when a successful result is saved. You can download the zip repeatedly from the browser that created it during that hour, or use Delete now to remove the completed job and its files sooner. Successful and failed jobs expire 1 hour after their outcome is saved. We schedule cleanup for that expiry, and a recovery task runs every 15 minutes to remove expired rows missed by scheduled cleanup. An outage can delay deletion after access ends. If a worker is cancelled or exhausts its retries, cleanup marks the generation failed once no attempt remains queued or running. A job that remains marked as running after an interruption can retain its source image indefinitely until it is recovered. The background worker's ordinary execution record contains only the generation ID, worker name, queue, timestamps, and sanitized error state, but no image, settings, or generated files. Completed execution records are deleted after 7 days; cancelled, discarded, or orphaned executing records may remain indefinitely. Minute and daily IP rate limits stop applying at the end of their windows, although their in-memory counters can remain for up to 10 minutes. Database backups may retain deleted sign-generation data for the limited period described under Database Backups below.
• QR Code Generator: The text you type into the QR code generator, and an image you add to the middle of the code, are held in memory while that page is open. We reduce the image to a small PNG while it is in memory. We do not write them to the database. If the page crashes, an error report can include that text. The image is not in that report. If you are signed in, that report includes your account id and email. The report is kept with our other error reports.
• Signed-In Sessions: A session record, which holds when you signed in, which browser you signed in from, and when that device was last used, lasts as long as that session does. Logging that device out from the Signed-in devices list in your account settings deletes it straight away, and a daily job deletes the rest within a day of the session expiring, sixty days after you signed in. Changing your password ends every session on the account and deletes their records with them.
• Connected Apps: A record that you allowed an app is kept while it is connected, and is deleted a month after the connection ends. A connection ends when you disconnect it in your account settings, and also on its own once the app has stopped using it. The credentials it holds are short-lived and renewed as it works: ending the connection deletes them at once, and a daily job deletes any that have expired. A program that registered itself with us but that nobody ever allowed is deleted a week after it registered.
• Chat App Connections: A connected Slack or Discord account is kept until you disconnect it, from your account settings or from the chat app, and is deleted straight away when you do. Deleting your account deletes it with the rest of your data. The half-finished link that connects one, which we hold only as a hash, lasts fifteen minutes and can be used once; a daily job deletes the ones nobody finished. If a Slack workspace installs our app, we keep a record of that workspace's identifier and name, which is separate from any account and is not deleted when you delete yours.
• Advertising Click Identifiers: The click identifier saved on your account when you arrive from one of our ads is erased once it passes the window that partner will attribute a conversion over: 28 days for Reddit, 90 days for Google. A daily job clears each one from every account past that age, whether or not advertising is still switched on, and deleting your account erases them along with the rest of your data. Turning off the 'Ad measurement' switch in your account settings erases them immediately, together with the record of your consent. Each partner's own retention governs the events we already reported to it. Opting out, withdrawing consent in the cookie banner, and deleting your account all ask Reddit to erase those as well, which we submit automatically. Google offers no way to delete an advertising event once it has been sent, so there is no equivalent request for us to make; write to us if you want us to take it up with them.

Deidentified and Aggregated Data

Where we deidentify or aggregate data so that it can no longer reasonably be linked to you, we maintain and use that data only in its deidentified form and do not attempt to re-identify it, except where permitted by law solely to test whether our deidentification process satisfies legal requirements.

Database Backups

Our production database is hosted on Fly.io's managed Postgres platform, which uses modern, continuous backup strategies to protect against data loss and support point-in-time recovery. Data deleted from our live systems may persist in these backups until they expire under Fly.io's rolling retention schedule.

13. Links to Other Websites

Our services may contain links to other websites or services that are not operated by us, including our social media pages and our public roadmap. If you click on a third-party link, you will be directed to that third party's site. We strongly advise you to review the Privacy Policy of every site you visit, as we have no control over and assume no responsibility for the content, privacy policies, or practices of any third-party sites or services.

14. Children's Privacy

Our services are not directed to individuals under the age of 18. Registration asks for a birth date solely to verify that you are at least 18; the check runs before any account data is stored, and we keep only a record that the check passed, never the birth date itself. We do not knowingly collect personal information from children. If we become aware that we have unknowingly collected personal information from anyone under 18, in particular from any child under 13, we will take steps to delete that information, in accordance with applicable law. If you are a parent or guardian and believe that we may have collected personal information from your child, please contact us at the email address in the 'Contact Us' section.

15. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of any significant changes by posting the new policy on this page and, where appropriate, notifying you by email. We encourage you to review this policy periodically.

16. Contact Us

For any questions, concerns, or requests regarding your data privacy, please contact us at:
[email protected]

The mailing address for IllumAlign LLC is:
141 Traction Street #2238, Greenville SC 29611-4725