Security.
What is in place, and where to write if you find something wrong.
Most tools never send anything
343 of the 360 tools run entirely in your browser and send nothing to us or to anyone else. The exceptions are named, one by one, on Where your data goes, and each of those pages says so before you type anything. A test in the codebase reads every tool page and fails the build when a page makes a network call without being listed there.
Transport
Every page is served over HTTPS with HTTP Strict Transport Security (two years, subdomains included, preload). Responses carry a Content Security Policy, X-Content-Type-Options, X-Frame-Options, a Referrer Policy and a Permissions Policy. Signed-in pages get a stricter policy with a per-request nonce, and are never stored in the shared CDN cache.
Accounts and API keys
Sign-in runs through Supabase Auth, by email link, password or an OAuth provider; a password is stored only as a bcrypt hash, by Supabase, and is never visible to us. API keys are stored as a hash, shown to you once, and revoked instantly from your account page. Card details go to Stripe and never reach our servers. You can delete your account yourself, and the deletion runs at once rather than entering a queue.
Server-side processing
The 12 tools that do use our servers process your input and discard it; what remains is the record that a call was made. The render API stores its output in a private bucket behind a signed link that expires after 24 hours, and a daily job deletes the files. Server-side fetchers only reach public internet addresses, never private networks or cloud metadata endpoints. Free daily allowances are enforced per network address using a one-way hash kept for two days.
Reporting a vulnerability
Write to contact@toolforte.com with what you found and how to reproduce it. The same address is published in /.well-known/security.txt. We answer within five working days, fix confirmed issues before talking about them publicly, and credit you if you want to be credited. There is no paid bounty programme; Toine.com B.V. is a small company and says so rather than promising one.
See also the privacy policy and the terms of service.