Last updated: 25 October 2026
In short
- Our web tools work inside your own browser. The files you open in them are not uploaded to our servers. The one exception is CloudCanvas AI, which sends your text prompt to the Stable Horde network.
- You do not need an account to use the tools.
- We use Google Analytics to count visits. In the European Economic Area, the United Kingdom and Switzerland it starts only if you say yes. We use no advertising cookies.
- You can change your choice at any time: Privacy choices.
1. Who we are
AIToolboxBD (https://aitoolboxbd.com) provides free browser tools and free PC software. The site is run by an individual from Bangladesh and is the controller of the personal data described here. To reach us about your data, use our Contact page.
2. Your files stay on your device
Our converters and utilities use WebAssembly and other browser technologies. They read the files you choose inside your own browser, and your files and results are not uploaded to, stored on or analysed by our servers. Exception: CloudCanvas AI sends the text prompt you type to the Stable Horde network, which is run by volunteers and is not under our control, so never type personal data into it. Our analytics never include file names or file contents. If you post images in public areas of the site (for example in comments), remove embedded location data (EXIF GPS) first, because visitors can download and read it.
3. What we collect, why, and on what basis
| Data | Why | Basis | Who handles it |
|---|---|---|---|
| Server records: network (IP) address, browser type, pages requested, time | Keep the site running, stop abuse and attacks | Legitimate interests | Our hosting company (servers in Singapore) and Cloudflare, under their own retention rules |
| Visit statistics: pages viewed, approximate location (country and city), device, browser, how you arrived, time on page, scrolling, searches on our site | Learn which tools people use so we can improve them | Your consent in the EEA, the UK and Switzerland; legitimate interests elsewhere, with an opt-out | Google Analytics 4 (Google Ireland Limited and Google LLC); kept up to 14 months |
| Page-speed measurements from real visits | Make pages faster | Legitimate interests | Cloudflare Web Analytics (it sets no cookie) |
| Comments: name, email, text, IP address, browser type | Publish your comment, detect spam | Your consent; legitimate interests (spam) | Us; a hashed email may go to Gravatar (Automattic) |
| Messages you send through the contact form: name, email, message | Answer you | Your request; legitimate interests | Us and our email service |
| Google sign-in (optional): name, email address, profile picture | Create and secure your account | Your request (contract) | Us; Google handles the sign-in itself |
| Prompt text typed into CloudCanvas AI | Generate the image you asked for | Your request | Stable Horde network (outside our control) |
We do not sell your personal data, and we do not use it for advertising. Google Analytics is set up with advertising storage and personalisation switched off.
4. Cookies
In the EEA, the UK and Switzerland, analytics cookies are set only after you accept. Elsewhere they are on by default and you can switch them off with Privacy choices. If your browser sends a Global Privacy Control signal, we treat it as a refusal.
| Cookie | Purpose | Lasts |
|---|---|---|
| aitbd_consent | Remembers your analytics choice (necessary) | 12 months |
| aitbd_region | Remembers that you are outside the regions where we ask first (necessary) | 1 day |
| _ga, _ga_V9ESVJ4PRM | Google Analytics: tells visits apart and counts them | Up to 2 years (browsers may shorten it) |
| comment_author_* | Only if you tick the box in the comment form: saves your name and email for next time | 1 year |
| wordpress_*, wp-settings-* | Only when you log in: keep you logged in and remember screen choices (necessary) | 2 days; 2 weeks with “Remember me”; screen choices 1 year |
| Cloudflare security cookie (for example __cf_bm) | May be set to tell real visitors from automated attacks (necessary) | About 30 minutes |
Because we use Google sign-in, Google sets its own cookies when you use it, and visiting our login page sets a temporary cookie to check that your browser accepts cookies.
5. Embedded content and links
Articles in our Learning Zone and our pages may embed or link to other websites (for example YouTube, GitHub, dev.to, Blogger and Telegram). Those sites may collect data about you, set cookies and track what you do there; their own privacy policies apply. Downloads of our PC software are served from GitHub.
6. Where your data goes
Our hosting servers are in Singapore, we are in Bangladesh, and Google and Cloudflare operate worldwide, including in the United States. If you are in the EEA, the UK or Switzerland, this means your data can leave your region. We rely on the standard contractual clauses and, where the provider is certified, the EU-US Data Privacy Framework that our providers offer.
7. How long we keep it
Analytics data: up to 14 months. Comments and their details: until you ask us to delete them, because we use them to recognise follow-up comments. Accounts: until you ask us to delete the account. Contact messages: as long as needed to answer you and keep a record. Server records: for the short period our hosting company and Cloudflare keep them.
8. Your choices and rights
You can accept or decline analytics at any time with Privacy choices, block analytics in your browser, or install Google’s opt-out add-on at tools.google.com/dlpage/gaoptout.
Depending on where you live (for example under the GDPR, the UK GDPR, or the laws of California and other US states) you can ask to see the personal data we hold about you, correct it, delete it, restrict or object to its use, receive a copy you can move elsewhere, and withdraw consent at any time without affecting what was done before. You will not be treated worse for using these rights. Write to us through the Contact page; we answer within one month. If you think we handled your data wrongly, you may complain to your local data protection authority (in the UK, the Information Commissioner’s Office).
9. Children
Our tools are not directed at children under 13 (or under 16 where your country sets that age), and we do not knowingly collect their personal data. If you believe a child has given us personal data, contact us and we will delete it.
10. Security and changes
The site is served over HTTPS and sits behind Cloudflare; access to the administration area is restricted. No system is perfectly secure. We will change this policy when what we do changes, and we will update the date at the top. Questions about it: Contact page.