Your submissions
We store your product details, contact email, plan, submission status, badge checks and booked dates to operate the directory. Your contact email is private. Approved product details become public; drafts remain private. After you verify your email, we link existing unclaimed submissions with that contact address to your account and retire their old management keys. We do not link submissions belonging to another verified account.
What this browser remembers
Local storage keeps saved tools and unfinished form details. Older browsers may retain legacy management keys for unclaimed submissions. Session storage can remember the email and non-secret challenge reference for an unfinished sign-in for up to ten minutes; it never stores your code. Avoid shared browsers for private submissions.
Your customer account
Sign-in uses a six-digit email code valid for ten minutes, with up to five verification attempts. We store a keyed hash rather than the code, and remove code request records after two days. A new request replaces your earlier code. Successful verification creates an essential HttpOnly session cookie lasting up to thirty days. We store only a hash of its token and allow up to ten active sessions per account. Signing out ends that browser session. Your account email is used for submission ownership and service updates. It cannot be changed through the product profile editor. Customer and administrator sessions are separate.
Website imports and badge checks
At your request we visit the public HTTPS website address you provide to import details or check a badge. These requests have network and content limits. A website operator may see our request in access logs.
Administrator access
Site administration uses an essential, HttpOnly session cookie lasting up to eight hours. We store the administrator account email, a salted password hash, hashed session and one-time reset references, and sign-in and moderation audit records. Password reset links expire after 30 minutes; initial activation expires after one hour. Plain-text passwords and session tokens are not stored in the database. These cookies are used only for administration.
Payments
PayPal processes payment credentials on its own website under its privacy notice. We send the amount, currency, product description and submission/payment references needed to complete checkout. We store PayPal order, capture and refund references, amounts, currency, payment states and timestamps for verification, support and accounting. We do not store card numbers or your PayPal password. We do not store full PayPal webhook bodies or payer profiles. Payment, refund and accounting records may need to be retained where required for applicable obligations and disputes.
Activity statistics
We record product profile views and outbound click events with the product identifier and time. These are event counts, not verified unique people. Campaign reports include activity from all sources within booked dates. Request limits use a hashed network identifier and time bucket to reduce abuse. The application does not set advertising cookies or sell personal information.
Optional website analytics
If you allow analytics on ToolPicnic.com, Google Analytics measures visits and activity in the public directory using browser cookies. You can change your choice using Analytics settings in the footer. Read how Google uses this information on its partner sites privacy page.
Email and service providers
Resend processes outgoing messages, including your recipient address, content and delivery information. We send sign-in codes and service emails about saved submissions, badge verification, review decisions, bookings, launch dates, payments and refunds. A private delivery queue stores a recipient/product snapshot and rendered message to retry these messages consistently. Linking older submissions does not send historical notifications. Cloudflare Email Routing forwards incoming correspondence to the support inbox. Hosting and network providers process technical information needed to serve and protect the website. Product links lead to independent services with their own privacy practices.
Your information
Contact [email protected] to request access, correction or deletion of your information. We verify ownership before changing private records. We retain information needed for the active service, support, payment records and applicable obligations; we review deletion requests against those needs. Do not send passwords, card data or management keys in email.