Privacy Policy

Updated 25 October 2026

Scope and project name

IT Engineer’s Toolbox is the public project name for this UK-operated website at itengineerstoolbox.com. The project name is not a confirmation of the legal data controller's identity, which remains unconfirmed. The Website information page provides the dedicated privacy request form when enabled. The Cookie and Storage Policy lists browser storage names and controls.

Calculator input and privacy requests

Calculations, searches, lessons, quizzes and recommendations run locally in your browser. The calculator application does not upload tool inputs or results to an application server, analytics service, advertiser or AI provider, and does not put them in page URLs. Submitting the dedicated privacy form is different: it sends only the reply email address, request type and message you enter for that request. Advertising scripts are excluded from the dedicated form screen.

Optional browser storage

Appearance is the only preference saved by default. Remembered lesson progress is optional and stores lesson identifiers, completion, first-attempt outcomes, attempt counts and timestamps. It does not store selected answers. The optional temporary workspace saves allowlisted numeric values and list choices in the current tab. It excludes free text, passwords, tokens, certificates, URLs, payloads and results.

Linked tools, copying and downloads

Choosing a linked calculator can place selected non-sensitive settings in tab storage for a one-time hand-off, usable for five minutes. Copying a result sends it to your device clipboard. Explicit export actions create files on your device; importing reads a file you select. The publisher does not receive those files through the application.

Privacy form and spam protection

The privacy request form collects your reply email, request type and message so the operator can respond to data protection requests and questions. Cloudflare D1 stores the request privately; there is no public request list or public database endpoint. Cloudflare Turnstile processes device and network signals to check for automated submissions. The server validates its token, hostname and action before saving. Short-lived rate-limit counters use a hashed network address; the application does not store IP addresses, user agents or Turnstile tokens in the request database. The form does not send notifications by email, so the operator must review the private inbox regularly.

Website hosting

Cloudflare provides this website's hosting, content delivery and security. To deliver pages and protect the service, Cloudflare processes network request information such as IP address, requested page, request time, browser details and traffic/security signals. Cloudflare operates a global network, so processing may take place outside your country. Its privacy policy explains its processing and international transfer arrangements. No Cloudflare Web Analytics, Zaraz or Google Analytics is enabled. Turnstile is used only by the dedicated privacy request form when that service is enabled.

Retention and your controls

Local appearance data remains until changed or cleared. Remembered progress remains until removed through lesson controls or browser settings. Temporary settings remain for the tab session unless cleared; browsers may restore sessions. Files and clipboard copies remain under your device controls. When enabled, privacy requests are held in private Cloudflare D1 storage and removed from the active database after 90 days by a daily cleanup and submission-time cleanup. D1 recovery history may retain deleted records for a further 7 days on the Free plan or up to 30 days on Paid plans. The operator must apply the same deletion policy to any replies, manual copies and restored backups. Infrastructure and advertising providers have separate retention practices described in the linked policies; account-specific log retention has not yet been confirmed.

Advertising and tracking

The application includes no analytics integration, advertising scripts, tracking pixels or marketing signup. Advertising is currently disabled. External reference links open other websites with their own privacy practices. If the site later adds tracking or advertising, the relevant disclosures and choices must be updated before activation.

Personalised advertising and your choices

When Google advertising is enabled, third-party vendors, including Google, may use advertising cookies to serve and personalise ads based on your previous visits to this website and other websites. Google and its partners may use those cookies across participating sites. The consent message lets you accept, decline or manage the displayed purposes and partners; its partner list provides vendor information and links. Use the website advertising privacy choices control to change or withdraw consent after activation. You can also manage Google personalised advertising through Google Ads Settings and use the linked industry opt-out service for participating third-party providers. Withdrawing consent does not make earlier processing unlawful and may result in non-personalised or limited ads, or no ad, depending on eligibility and regional settings.

Your controls and rights

Under UK data protection law, depending on the processing and applicable exceptions, you may request access, correction, deletion, restriction, portability or object to processing. You can withdraw consent for consent-based processing without affecting earlier lawful processing. Browser preferences can be cleared on your device. Use the dedicated privacy request form from the Website information page when it is available; it accepts requests without publishing an operator email address. The operator normally responds within one month and will explain if an extension or identification information is needed. You may complain to the UK Information Commissioner's Office (ICO). The form remains unavailable until its private storage and spam protection have been configured.

Notice status

Cloudflare hosting and the absence of additional analytics have been confirmed. Google advertising is planned but remains inactive until the consent message and reviewed disclosures are ready. The operator identity, request service activation, applicable lawful-basis assessment and provider/account retention settings still require completion before this notice is treated as complete. No home address or personal email has been added.