Effective: August 20, 2026

Privacy Policy

Your privacy matters to us. Here is exactly what we collect, why we collect it, and how we protect it.

← Back to ToolBud

Contents

  1. 1. INTRODUCTION
  2. 2. DATA WE COLLECT
  3. 3. DEVICE PERMISSIONS AND WHAT EACH ONE DOES
  4. 4. SHARING AND SERVICE PROVIDERS
  5. 5. HOW WE USE YOUR DATA
  6. 6. SMS NOTIFICATIONS AND MOBILE INFORMATION
  7. 7. DATA RETENTION
  8. 8. ACCOUNT DELETION
  9. 9. DATA SECURITY
  10. 10. YOUR RIGHTS AND CHOICES
  11. 11. CHILDREN'S PRIVACY
  12. 12. CHANGES TO THIS POLICY
  13. 13. CONTACT INFORMATION
  14. 14. KNOWN GAPS IN THIS DRAFT

TOOLBUD PRIVACY POLICY

1. INTRODUCTION

ToolBud ("we," "our," "us") operates the ToolBud mobile application and the toolbudapp.com website. This Privacy Policy describes how we collect, use, and share your information.

By using ToolBud, you agree to the collection and use of information as described in this policy.

ToolBud is for adults. You must be at least 18 years old to create an account.

This policy is a working draft. Legal counsel has not yet reviewed it, and sections marked as pending attorney review are still being drafted. It describes what ToolBud actually does today rather than what it intends to do later, so where a protection is a matter of stated policy rather than something the app enforces automatically, the policy says so at that point. Areas still being worked on are listed in full at the end of this document.

2. DATA WE COLLECT

2.1 Account and Profile Data

ToolBud asks only for a birth year, never a full date of birth. Birth year is optional, private, and never shown on your profile. When used for product analytics it is converted to a broad generation bucket, never an exact year.

Optional gender information is private, never shown on your public profile, and may be added, changed, or removed at any time. ToolBud does not infer gender from your name, photo, behavior, or third-party data. When used for product analytics, it is converted to a controlled aggregate bucket; self-description text is never included in analytics.

Your home address is used to find communities near you and to confirm community eligibility. It is not shown to other members. You can change it at any time in Profile > Manage Account > Edit Address.

2.2 Community Membership Data

Communities are identified by name and general location. In a very small community, the community name together with your display name may make you identifiable to other members.

2.3 Tool Data

2.4 Session and Transaction Data

2.5 Messaging Data

2.6 Photo and Evidence Data

2.7 Device and Usage Data

ToolBud's product analytics is first-party product analytics, processed through ToolBud's own Firebase infrastructure. Analytics payloads are restricted to governed identifiers, counts, enums, and bounded context; message bodies, profile self-description text, exact addresses, contact information, and unrestricted search text are not analytics payloads.

ToolBud does not currently use a third-party analytics, crash-reporting, or advertising SDK, and does not use advertising identifiers for analytics.

2.8 Mobile and Device Identifiers

ToolBud does not collect advertising identifiers (IDFA/GAID), hardware device IDs, or fingerprinting data, and does not use any advertising or cross-app tracking SDK.

3. DEVICE PERMISSIONS AND WHAT EACH ONE DOES

ToolBud asks for a device permission only at the point you use the feature that needs it. You can decline any of them and continue to use ToolBud, with that feature unavailable. You can change every permission later in your device settings.

3.1 Camera and Photo Library

Used to take or choose tool photos, receipt photos, checkout and return photos, project reference images, and your profile photo. Photos you add are uploaded to ToolBud's storage. Tool and receipt photos are additionally sent to AI providers for tool identification and text extraction, as described in section 4.

3.2 Microphone

Used for two separate features:

These are different data flows. Only the voice-feedback path records and uploads audio.

3.3 Speech Recognition

Used to turn what you say to Bud into text. On iOS this uses Apple's speech recognition, which runs on your device where the device supports it and otherwise sends the audio to Apple for processing. On Android it uses Google's speech recognition service. In both cases the provider processes your speech to return text; ToolBud receives the text only. The resulting text is then handled like any other message you send to Bud, including being sent to our AI provider as described in section 4.

3.4 Contacts

Used to help you find friends who already use ToolBud and to invite people who do not.

When you use this feature, the phone numbers and email addresses in your contacts are sent to ToolBud's servers so they can be matched against ToolBud accounts. The matching is transient: ToolBud compares them against an internal index and returns the matches. Your contact list is not stored, is not added to any profile, and is not shared with anyone. Contacts are never used for marketing, and ToolBud never messages your contacts on its own.

Invitations are sent from your own device using your own messaging app. ToolBud does not send them.

3.5 Face ID and Biometrics

Used only to unlock the ToolBud app on your device, and to confirm it is you when you turn that setting on. Your face or fingerprint data is handled entirely by your device's operating system and is never transmitted to or stored by ToolBud. ToolBud stores only a setting on your device recording whether you enabled the feature. Biometric unlock is a lock over an existing session; it is not a ToolBud sign-in credential.

3.6 Notifications

Used to deliver push notifications you have enabled. See section 2.8.

3.7 Location

ToolBud does not request or collect device location. ToolBud has no location permission, and does not use GPS or background location.

Your home address is text you type. When you enter it, that text is sent to geocoding providers to suggest and validate an address, as described in section 4. ToolBud stores the address you choose to save, along with coordinates derived from that address — not from your device.

4. SHARING AND SERVICE PROVIDERS

Working draft — pending attorney review. This section reflects ToolBud's current practice and applies today, but has not yet been reviewed by legal counsel and may change.

We do not sell your personal data. We share data with the service providers below so that ToolBud can operate.

4.1 Infrastructure and delivery

4.2 Artificial intelligence providers

Content sent to an AI provider is limited to what the feature needs. ToolBud does not add your email address, phone number, home address, or name to what it sends an AI provider. When ToolBud drafts a "looking for a tool" post on your behalf it sends a neutral placeholder where a name goes and fills your display name in afterwards, on our own servers, so the post reads naturally without your name reaching the provider. Content you supply yourself is sent as you provided it — a receipt photo, for example, may itself show an address printed on the receipt, and a voice note contains whatever you said.

Which AI path sends what is recorded in our internal AI provider data-flow inventory, which is generated from the code that builds those requests and is checked automatically whenever that code changes.

Anthropic's processing is governed by Anthropic's Privacy Policy: https://www.anthropic.com/legal/privacy. OpenAI's is governed by OpenAI's Privacy Policy: https://openai.com/privacy

4.3 Address lookup

Address text is transmitted for lookup only. Suggestion results are not stored by ToolBud; only the validated address you choose to save is kept on your profile.

Esri: https://www.esri.com/en-us/privacy/overview · U.S. Census Bureau: https://geocoding.geo.census.gov · Google: https://policies.google.com/privacy

4.4 Product search

4.5 Speech recognition

Speech you dictate to Bud is processed by Apple (iOS) or Google (Android) as described in section 3.3.

4.6 Other disclosures

We may disclose information if required by law, legal process, or government request, or where necessary to protect the rights, property, or safety of ToolBud, our users, or the public.

If ToolBud is involved in a merger, acquisition, or sale of assets, your information may be transferred. We will notify you before your information becomes subject to a different privacy policy.

4.7 Tool scan photo handling

Tool scan photos are sent to an AI provider for identification. Photos are transmitted as image data only — no name, email, address, or phone number is included. Scan photos are deleted from ToolBud systems immediately after processing, and orphaned scan uploads are automatically purged every six hours.

5. HOW WE USE YOUR DATA

We use collected data to:

Product analytics does not determine an individual's ranking, pricing, access, eligibility, visibility, or suppression. Optional gender and generation information is used only for aggregate product, engagement, inclusion, and marketing analysis under minimum-cohort safeguards; it is not used for individual personalization.

We do not sell your personal data, and we do not use your data to train third-party AI models beyond what a provider requires to return a response to a request you made.

6. SMS NOTIFICATIONS AND MOBILE INFORMATION

This section describes ToolBud's SMS Notifications and Mobile Information practices.

If you choose to enable SMS notifications, ToolBud may use your mobile number to send account and service-related text messages, including verification, account, security, borrowing/lending, request, reminder, and support notifications. Message frequency varies based on your account activity. Message and data rates may apply. You may opt out at any time by replying STOP, or get help by replying HELP.

ToolBud does not sell, rent, share, or transfer mobile numbers, SMS opt-in data, or SMS consent information to third parties, affiliates, or lead generators for marketing or promotional purposes. Mobile information and SMS consent data are used only to provide and support ToolBud's messaging program and related services.

SMS notifications are off by default and are not required to create an account or use ToolBud. You can enable or disable SMS notifications at any time in Profile > Notification Settings. When you enable them, ToolBud records the consent — what you agreed to and when — as required by mobile carrier rules.

Phone verification during account setup is separate: that message is required to create an account, and enabling SMS notifications is not.

If you provide your phone number on the ToolBud website — for example to join the waitlist or request an invitation — the same terms apply. ToolBud will use it to contact you about ToolBud only, will not share it for anyone else's marketing, and will honor STOP.

7. DATA RETENTION

We retain data according to its purpose and sensitivity. Member-level product analytics is time-bounded and removed on account deletion. Aggregate counts that contain no member identifiers may be retained to preserve historical business and product trends. Session, evidence, dispute, and commerce records have longer fixed periods to support safety, transaction history, and legal obligations.

7.1 Retention Schedule by Data Category

Data CategoryRetention Period
Account and profile informationDuration of account; deleted on account deletion
Home addressDuration of account; deleted on account deletion
Optional genderDuration of account; removable earlier by the member
Tool listingsDuration of account; deleted on account deletion
Borrow/lend session recordsKept as a shared record for both participants; participant names are replaced on account deletion. No fixed deletion date is enforced today
Evidence photosKept with their session, and kept after account deletion for the same reason the session record is — they are evidence about another member's tool. No fixed deletion date is enforced today
Dispute recordsRetained with the session record; identifiers anonymized on account deletion
Trust and safety reportsRetained after the reported or reporting account is deleted, so repeat-conduct patterns remain visible; free-text is scrubbed and identifiers anonymized
MessagesRetained for the other participant after you delete your account. Otherwise: until you delete the conversation. A deleted conversation stays recoverable in your Deleted tab for 30 days, is retained for up to 60 further days for dispute reference, and is then permanently deleted shortly after the 90th day
Contact matching dataNot retained — matched transiently and discarded
Voice feedback recordingsTranscribed on receipt; the transcript is retained with the feedback
Device tokensRemoved automatically when invalid
Product analytics events and member activity2 years; deleted on account deletion
Client diagnostic breadcrumbs90 days; deleted on account deletion
Signup attributionDuration of account; deleted on account deletion
Aggregate analytics rollups and identity-free lifecycle factsIndefinite; no member identifiers
Commerce, sale, and purchase recordsRetained for 7 years from the date of the sale, to support your transaction history and to resolve disputes or defend legal claims involving tools sold through ToolBud. Deleted sooner if your account — or, for a purchase receipt, the account of the other party to that sale — is deleted
Product feedbackRetained for product improvement after account deletion; identifying profile/contact data is removed from the linked account
Server logsRetained by our infrastructure providers on their standard operational schedules and used for security and reliability
Working draft — pending attorney review. This section reflects ToolBud's current practice and applies today, but has not yet been reviewed by legal counsel and may change.

Upon account deletion, data is handled as described in section 8. Some records may be retained in anonymized or aggregated form for product improvement, or as required by law.

8. ACCOUNT DELETION

You may delete your account in the app, in Profile > Delete Account. You will be asked to type DELETE to confirm.

Deletion runs immediately and cannot be undone. There is no grace period and no restore.

Because a borrow session creates obligations to another member, ToolBud will not delete your account while you have a session in progress — picked up, active, or awaiting return acceptance — whether you are the borrower or the lender. Close those sessions first.

What is deleted: your profile and contact information, home address, private optional gender, profile photo, tool inventory and tool photos, feed posts, friend connections and requests, borrow requests, blocks you created, imports, receipts, uploaded files, project references, workbench plans, invites, signup attribution, member-level analytics rows, your notification settings and push tokens, and your sign-in account itself. Where you signed in with Apple, ToolBud asks Apple to revoke the sign-in token. Deletion is not yet guaranteed to be complete in every case — see section 14.

What is retained: your messages remain visible to the people you exchanged them with — a conversation belongs to both participants, so deleting your account does not erase it from theirs, and your authorship reference stays attached to those messages. Closed borrow and lend sessions, tool transfer records, and trust-and-safety reports are kept, with your name replaced by "Former Neighbor". Text you wrote on those records — for example the details you supplied when reporting a problem with a session — is retained as part of the record, because it is evidence in a matter involving another member. Photographs taken at checkout and return are kept with their session for the same period, for the same reason: they show the condition of another member's tool at the moment it changed hands, and they are the only record either of you has of how it was handed over and how it came back. Those photo files are stored under a path that includes your account identifier, which is what shows who took which photo — the difference between your checkout photo and the other member's return photo is usually the whole point of the record, so that identifier is kept rather than stripped. These records still carry the internal account identifier that links them together, so they are de-identified rather than fully anonymous. These are kept because they are shared records involving another member, or because moderation integrity depends on them. Aggregate analytics rollups, identity-free lifecycle facts, and daily counters remain because they contain no member identifiers. Past product feedback may remain so ToolBud can continue improving the product, with identifying profile data removed.

Your user record is replaced with a minimal tombstone so that historical references resolve without exposing who you were.

Your record of accepting these documents. ToolBud keeps a minimal record that you accepted the agreements it asked you to accept — currently its Terms of Service, Privacy Policy, and Community Guidelines, and, for longer-standing members, any earlier agreement that has since been retired. That record is limited to which document you accepted, the version you accepted, and when you accepted it — nothing else. It carries no name, no contact information, no address, and no profile content, and it is not a usable account: it is evidence that an acceptance happened, kept because ToolBud may need to show which terms applied to you and when. It is not used for any other purpose — not for operating the product, not for marketing, not for personalization, and not for community features — and it is not readable by other members. It is deleted at the end of the retention period described in section 7, unless a legal hold requires it to be kept longer.

Working draft — pending attorney review. This section reflects ToolBud's current practice and applies today, but has not yet been reviewed by legal counsel and may change.

Legal holds. If ToolBud becomes aware of a legal claim, a government or regulatory request, or a serious incident, we may be required to preserve records that would otherwise be deleted on our normal schedule — including records covered by a deletion request you have made. Where that happens we keep only what the matter requires, we record that something was withheld and why, and we delete those records once the matter closes and the obligation ends.

Unlike the other categories described above, we cannot tell you in advance which records this might affect, because it depends on events that have not happened.

Some records may also be retained as required by law or for legitimate business purposes.

9. DATA SECURITY

We implement reasonable security measures to protect your data, including encryption in transit and at rest through our infrastructure providers, app attestation, and server-side access rules that restrict what any account can read or write.

No method of electronic storage or transmission is completely secure. We cannot guarantee absolute security.

10. YOUR RIGHTS AND CHOICES

Working draft — pending attorney review. This section reflects ToolBud's current practice and applies today, but has not yet been reviewed by legal counsel and may change.

These rights are available to every ToolBud member, everywhere, regardless of where you live.

To make a request, email support@toolbudapp.com from the address on your account. We will respond within 45 days. We may need to verify your identity before acting on a request — normally by confirming control of the account email or phone number.

If you disagree with how we handled your request, reply to us and ask for it to be reviewed.

11. CHILDREN'S PRIVACY

ToolBud is intended only for adults aged 18 and over. ToolBud is not directed to children, and we do not knowingly collect personal information from anyone under 18.

Birth year is optional. If you provide one, ToolBud checks it against the minimum age and will not let you continue if it shows you are under 18. ToolBud does not otherwise verify your age — it does not check identity documents, and leaving the birth-year field blank skips the check — so age remains a condition of using ToolBud that you agree to, backed by a check we can only apply to what you tell us. We also act on reports. If we learn that we have collected personal information from someone under 18, we will delete the account and its data. If you believe a minor has created an account, contact support@toolbudapp.com.

12. CHANGES TO THIS POLICY

We may update this Privacy Policy from time to time. Changes will be posted within the application and on toolbudapp.com. When a change is material, ToolBud will ask you to review and accept it in the app before you continue.

13. CONTACT INFORMATION

For privacy-related questions or requests:

support@toolbudapp.com

You can also reach support in the app, in Profile > Help & Support.

ToolBud
Houston, TX

Privacy policy URL: https://toolbudapp.com/privacy

14. KNOWN GAPS IN THIS DRAFT

ToolBud is pre-launch. This section is published rather than kept internal, because a policy that quietly overstates what the software does is worse than one that names its own gaps. Each item below is a place where this policy describes an intention, a stated rule, or current practice that is not yet enforced automatically by the app.

These are tracked and being worked on. This section will shrink as each one is closed; when a gap is fixed, the corresponding wording above is tightened at the same time.