This Privacy Policy describes how Tool Cognition Inc. (“Toolcog,” “we,” “us,” or “our”) collects, uses, and shares information when you use our website, APIs, and related services (collectively, the “Service”).
Account Information — When you create an account, we collect your name, email address, and authentication credentials. If you sign up through a social login provider (GitHub, Google), we receive basic profile information from that provider.
Organization Information — If you create or join an organization, we collect the organization name, member list, and role assignments.
API Specifications — If you upload API specifications, we store and index them to provide discovery and execution services.
Payment Information — If you subscribe to a paid plan, our payment processor (Stripe) collects payment details. We receive only non-sensitive transaction information such as the last four digits of your card and billing address.
Usage Data — We log interactions with the Service, including API operations discovered, executed, and their outcomes. These logs support debugging, security monitoring, and usage analytics.
Device and Browser Information — We collect IP address, browser type, operating system, and device identifiers to provide and secure the Service.
Cookies and Similar Technologies — We use cookies for session management and authentication. We do not use third-party advertising or tracking cookies.
Credentials You Store
The Service allows you to store credentials for third-party APIs (API keys, OAuth tokens, passwords). These credentials receive special treatment:
- Envelope encryption — Credentials are encrypted using keys derived from your authentication session. The encryption keys are never stored in plaintext.
- Zero-knowledge architecture — We cannot decrypt your credentials without your active session. Even with full database access, your credentials remain encrypted.
- Session-scoped access — Credentials are decrypted only for the duration of an API operation, then immediately discarded from memory.
- Audit logging — We log which operations used which credentials, but never log the credential values themselves.
We use the information we collect to:
- Provide the Service — Authenticate you, execute API operations, store your configurations
- Improve the Service — Analyze usage patterns, identify bugs, develop new features
- Communicate with you — Send service announcements, security alerts, and support responses
- Ensure security — Detect fraud, prevent abuse, protect against unauthorized access
- Comply with law — Respond to legal requests, enforce our terms, protect our rights
We do not sell your personal information. We do not use your data to train machine learning models except to improve our own API discovery and recommendation systems.
We share information only in the following circumstances:
Service Providers — We use third-party services to help operate the Service:
| Provider | Purpose | Data Shared |
|---|
| Cloudflare | Infrastructure, edge computing | Request logs, IP addresses |
| Stripe | Payment processing | Billing information |
| GitHub, Google | Social authentication | OAuth tokens (for login only) |
These providers are contractually obligated to protect your information and use it only for the services they provide to us.
Third-Party APIs — When you instruct the Service to execute API operations, we transmit your requests to those third-party services. Your use of third-party APIs is governed by their privacy policies, not ours. We facilitate the connection but do not control how those services handle your data.
Legal Requirements — We may disclose information if required by law, subpoena, or court order, or if we believe disclosure is necessary to protect our rights, your safety, or the safety of others.
Business Transfers — If Tool Cognition Inc. is acquired or merged, your information may be transferred as part of that transaction. We will notify you of any such change.
With Your Consent — We may share information with your explicit consent for purposes not described here.
Data Retention
We retain your information for as long as your account is active or as needed to provide the Service. Specifically:
- Account data — Retained until you delete your account
- Usage logs — Retained for 90 days for operational purposes
- Audit logs — Retained for 1 year for security and compliance
- Encrypted credentials — Deleted immediately upon account deletion or credential revocation
- Backups — May contain your data for up to 30 days after deletion
After account deletion, we may retain anonymized or aggregated data that cannot identify you.
Your Rights and Choices
Access and Portability
You can access your account information, API specifications, and usage history through the Service. You may export your data at any time.
Correction
You can update your account information through the Service settings.
Deletion
You can delete your account at any time. This will permanently delete your encrypted credentials and remove your personal information from our active systems. Some information may persist in backups for a limited time.
Credential Revocation
You can revoke stored credentials at any time through the Service. Revoked credentials are immediately deleted and can no longer be used for API operations.
Communication Preferences
You can opt out of non-essential communications through your account settings. You cannot opt out of service announcements or security alerts.
Do Not Track
We do not track users across third-party websites. We do not respond to Do Not Track browser signals because we do not engage in the tracking that such signals are designed to prevent.
Regional Privacy Rights
European Economic Area (GDPR)
If you are in the EEA, you have additional rights under the General Data Protection Regulation:
- Legal basis — We process your data based on contractual necessity (to provide the Service), legitimate interests (to improve and secure the Service), and consent (where required).
- Data transfers — Your data may be transferred to and processed in the United States. We use Cloudflare’s infrastructure, which maintains appropriate safeguards for international transfers.
- Right to object — You may object to processing based on legitimate interests.
- Right to lodge a complaint — You may file a complaint with your local data protection authority.
California (CCPA)
If you are a California resident, you have rights under the California Consumer Privacy Act:
- Right to know — You can request information about the categories and specific pieces of personal information we collect.
- Right to delete — You can request deletion of your personal information.
- Right to opt out — We do not sell personal information, so there is no sale to opt out of.
- Non-discrimination — We will not discriminate against you for exercising your privacy rights.
To exercise these rights, contact us at privacy@toolcog.com.
Security
We implement technical and organizational measures to protect your information:
- Encryption in transit — All connections use TLS 1.3
- Encryption at rest — All stored data is encrypted
- Zero-knowledge credentials — Your API credentials are encrypted with keys only you possess
- Access controls — Employee access to systems is limited and logged
- Security monitoring — We monitor for unauthorized access and anomalous activity
No system is perfectly secure. If you believe your account has been compromised, contact us immediately at security@toolcog.com.
Children’s Privacy
The Service is not intended for children under 16. We do not knowingly collect personal information from children. If you believe a child has provided us with personal information, contact us and we will delete it.
Changes to This Policy
We may update this Privacy Policy from time to time. We will notify you of material changes by posting the updated policy and changing the “Last Updated” date. Your continued use of the Service after changes become effective constitutes acceptance of the updated policy.
If you have questions about this Privacy Policy or our privacy practices:
Email: privacy@toolcog.com
Mail:
Tool Cognition Inc.
[Address]
For security concerns, contact security@toolcog.com.
