Legal
Privacy notice
Last updated 8 October 2026 (billing receipts and scheduled reports).
ToolCargo is a service run by its founder, Mustafa Halawa. Contact: mustafa.halawa9@gmail.com. There is no registered company behind it yet; this notice will be updated when there is.
What we collect
| Data | Why | Kept |
|---|---|---|
| Launch notification email and selected plan | Sending the plan launch notification you requested | Stored for the requested launch notification. Contact support for privacy requests. |
| Email, optional name, password hash (scrypt) | Your account and sign-in | Until you delete the account |
| Session records (hashed token, browser user agent) | Keeping you signed in | 30 days, or until you sign out |
| API keys and OAuth tokens — stored only as SHA-256 hashes — with name, scopes and last-used time | Authenticating your AI clients | Until the account is deleted; access tokens expire after an hour |
| OAuth app details (name, redirect URLs) for apps you approve | Showing and revoking connected apps | Until the account is deleted |
| Usage records: tool name, result, duration, time, which key was used | Quotas, your usage history, abuse prevention | Until the account is deleted |
| Plan status, PayPal subscription/order/capture references, payment amounts and receipt records | Knowing which plan you are on and recording your payments | As long as needed for accounting |
| PayPal notifications, with subscriber name, email and address removed before storage | Processing billing changes exactly once | As long as needed for accounting |
| Connector requests you submit, and your email if you give it | Deciding what to build and asking follow-ups | Until you ask us to delete them |
| Saved audits (signed-in users): the audited URL, the check results and short evidence such as the page title or canonical | Your audit history, re-runs, comparisons and client reports — visible only to your account | 180 days, or until you delete them; you can switch history off |
| Google Search Console (if you connect Google): an encrypted Google refresh token for read-only Search Console access, the permissions Google granted, and when the connection was made and last used. Search Console data (queries, clicks, pages) is fetched from Google when you ask and is not stored | Answering your questions about your own Search Console properties | Until you disconnect (we also ask Google to revoke access) or delete the account |
| Page Watch (signed-in users): watched URLs, a small snapshot of the last check (status, canonical, noindex, robots.txt result, failing high-impact check titles) and the change history | Re-checking pages you chose and telling you when they change — visible only to your account | Watches until you stop them; change history 180 days; deleted with the account |
| Client workspace labels, report schedules, and uploaded report logos | Organising your projects and delivering scheduled reports to your verified account email; branding your PDF exports | Until you delete the records or your account |
| Email confirmation: when you confirmed your address, and one-time confirmation links stored only as hashes | Sending alert emails only to addresses their owner confirmed | Links until used or expired (24 hours); deleted with the account |
| Public visitor statistics: daily public-page keys, broad entry sources and event counts; no account link | Understanding public discovery and setup interest | About 90 days; separate hashed abuse-counter windows about one day |
| Product events: sign-up, first successful tool call, days with activity, report exports, pricing and checkout events, demo audit outcomes — no URLs or page content | Understanding whether the product is useful | About 13 months; deleted with the account |
| Recovery codes and password-reset links — stored only as hashes | Letting you back into your account | Until used, replaced or expired; deleted with the account |
| Support messages you send (your email, topic and message) | Answering you | Until resolved, then up to 12 months; ask us to delete sooner |
| Pilot access records (dates, call limit, reason) and a log of staff actions on accounts | Running the pilot fairly and keeping an audit trail | Pilot records are deleted with the account; the staff action log keeps only a hash of your email |
| Daily counts of anonymous demo runs (no URLs, no IPs) | Capacity and abuse monitoring | About 13 months |
| Hashed IP address or email in rate-limit counters | Stopping abuse of sign-in, sign-up and the demo | About one day |
| Error events (no request bodies, tokens or page contents) | Keeping the service working | 90 days |
Google user data
If you connect Google Search Console, ToolCargo requests read-only access to your Search Console data (scope webmasters.readonly). We use it only to answer the requests you make through Google Search Console, for your own account. We do not use it for advertising, do not sell it, do not transfer it to others except as needed to provide the feature, and no person reads it unless you ask us to for support or the law requires it. ToolCargo's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. You can disconnect at any time on the Search Console page or at myaccount.google.com/permissions.
What we do not collect
- The pages themselves. We never store the HTML of pages you audit. Homepage demo audits are not saved at all (we count only their outcome).
- Your conversations. Your AI client decides what to send to a tool; we receive only the tool's arguments (such as a URL), not the chat around it.
- Payment details. You pay on PayPal's site. We never see card or bank details.
- Advertising trackers or analytics cookies. No advertising trackers, and no analytics cookies. Visitor statistics (below) use no browser storage or visitor identifier.
Visitor statistics
Our own public-page counter stores daily totals for a fixed public page key, a broad entry-source category (such as Google search, AI referral or direct/unknown), and pageviews or setup-link clicks. It does not store full page addresses, query strings, referrer addresses, account identifiers, browser details, IP addresses or a per-visit record in these aggregate tables. It does not use cookies or browser storage, and requests omit account cookies.
Private pages, unknown public paths, verification visits, non-campaign query strings and browsers requesting Do Not Track are excluded. An excluded visit stays excluded during navigation within that document. Referrer categories are approximate; counts are not unique people or successful tool use. Separate abuse controls store hashed network-derived keys in fixed hourly rate-limit windows, with old windows removed by the hourly cleanup after about one day. Hosting request logs are separate from these aggregates. Daily aggregate counts are removed by the hourly cleanup after about 90 days. No external visitor-statistics script is loaded.
Cookies
tp_session (HTTP-only, 30 days) keeps you signed in. tp_signed_in (30 days, value “1”) only lets pages show “Dashboard” instead of “Sign in”. Both are strictly necessary.
Who processes data for us
- Vercel — hosting and request logs (United States and global edge network).
- Neon — the Postgres database, hosted in AWS us-east-1 (United States), with point-in-time restore history kept by Neon.
- GitHub — runs a scheduled availability check; it receives no personal data.
- PayPal — payments, under PayPal's own privacy statement, when you subscribe or pay once.
- Resend — sends account emails (password resets, email confirmation, Page Watch alerts, billing receipts and scheduled audit reports) to your address.
- ClinicalTrials.gov study research — the public registry receives the research topic, status filter and paging choices, or the exact NCT identifier you request. Choose a public topic you intend to share; do not enter personal health details. ToolCargo sends no account identifiers or credentials. Each operation reads fresh source processing metadata and selected study fields; results are not cached. Participant data, contacts, eligibility text, outcomes, protocol narratives and linked files are not requested.
- NASA image library research — NASA receives your search phrase, center/year filters and paging choices, or the exact image identifier you request. ToolCargo sends no account identifiers or credentials. Bounded projected public metadata may be cached within a server instance for at most five minutes, subject to source freshness rules. Image files, manifests and linked pages are not fetched.
- CISA vulnerability catalogue research — ToolCargo fetches CISA’s complete public KEV JSON feed and caches bounded validated public metadata. Your CVE lookup and filters are applied inside ToolCargo; they are not sent to CISA. No account identifiers or credentials are forwarded. Linked advisory pages are not fetched.
- Wikimedia Commons image research — The Wikimedia Foundation receives your search phrase, requested language and paging choices, or the exact File: title you request. ToolCargo sends no account identifiers or credentials. Bounded projected metadata may be cached within a server instance for five minutes. Original images and linked pages are not fetched.
- NWS weather data — NOAA’s National Weather Service receives coordinates rounded to four decimal places for point lookups, or the forecast office, grid coordinates and unit choice for forecast requests. Coordinates can reveal a location; use a public location or only coordinates you intend to share. ToolCargo account identifiers and credentials are not forwarded.
- PubChem compound metadata — NCBI receives a complete public chemical name or exact CID. ToolCargo checks bounded identity and selected properties, discards contributed descriptions and forwards no account identifiers or credentials. Source responses are not stored in a shared result cache.
- UniProt protein metadata — UniProt receives the literal gene symbol, exact organism taxonomy ID, reviewed choice and explicit cursor, or a canonical accession. Selected source metadata exclude sequence residues and narratives. No account identifiers or credentials are forwarded and no result cache is used.
- NOAA coastal tides — NOAA receives the station ID, explicit prediction dates and selected height units. ToolCargo forwards no account identifiers or credentials. Bounded station metadata and predictions are fetched without result caching; no personal coordinates are requested.
- Treasury debt research — Treasury receives explicit publication-date filters through its public Fiscal Data API. No account identifiers or ToolCargo credentials are forwarded. Bounded debt metadata is fetched without result caching; selections and comparisons retain source amounts and retrieval times.
- Eurostat statistics — Eurostat receives selected EU country codes, indicator preset and requested years. ToolCargo forwards no account identifiers or credentials, fetches bounded statistics without a result cache and returns selected observations with source flags.
- ECB exchange rates — ToolCargo fetches the ECB’s fixed public daily feed. Your currency selections and conversion amounts are processed inside ToolCargo and are not sent to the ECB. No account identifiers or credentials are forwarded, and no result cache is used.
- Public metadata sources — npm, PyPI, crates.io, Wikipedia, Hacker News, Crossref, DataCite, ROR, Europe PMC, OSV, USGS, GBIF, Hugging Face, Open Library and Wikidata receive the search terms, Wikidata entity/property IDs and language choices, book/work/edition IDs, titles and author filters, package names, exact versions and search-page parameters, article titles, DOIs, dataset topics and publication years, publication source IDs and pagination cursors, organization names, ROR IDs and country/type filters, public model/dataset search terms, repository IDs and requested revisions, scientific-name queries, taxonomy keys, country and occurrence-year filters, earthquake date ranges, event IDs or geographic filters needed for the tool you request. These connectors send no ToolCargo passwords, keys, OAuth tokens or account identifiers to those sources. Their published metadata and excerpts are returned to your client.
- Google — only if you connect Search Console: we request your Search Console data from Google's API when you ask for it.
Your data may therefore be processed outside your country. We do not sell personal data or share it for advertising.
Your choices and rights
- Delete your account from the dashboard at any time. This deletes your keys, connected apps, sessions, recovery codes, pilot access and usage history immediately. Cancel a paid subscription first so PayPal stops billing you. Database backups roll off within about 14 days.
- Revoke any key or connected app instantly from the dashboard.
- For a copy of your data, a correction, or deletion of a connector request, email us. Depending on where you live you may have further rights, including complaining to a data protection authority.
Changes
If we change what we collect, we will update this page and the date above. Material changes will be announced to account holders before they apply.