Privacy

What is stored

• Your account: your email address and your password. The password is stored scrambled; nobody can read it, including us. The same goes for your recovery code: only a scrambled mark of it is kept, to check the code against.
• Invites: your own invite code, and whose invite you joined with.
• Your profile: your name, your handle, and the short line and picture you may add.
• What you post: the words, photos and clips, the title, filter, sound and place you put on a post, and the comments you write.
• Messages you send to another person here, and how far each of you has read. They are kept on toolate's server so both of you can read them. They are not end-to-end encrypted.
• What the AI read: for each photo and clip, a written description of what is in it (what is shown, what is said or written). This is what later answers are made from.
• What you do: the posts you like and save, who you follow, who you blocked, and when you last looked at your notices.
• Reports and feedback you send from inside toolate, with your account as the sender.
• Your conversations with the AI: the questions you ask it and the answers it gives, about a post or in a chat of your own. They are kept in your account so the same list is there on every device you sign in on, and so the AI can follow what was said earlier. They stay until you delete them. Each conversation keeps its latest 40 questions, and your account its latest 200 conversations; older ones are removed as new ones come.
• A daily count of how many times you used the AI, to keep within the daily limit.
• Messages you send us through the contact form, with the contact detail you chose to add.
• Marks against abuse: to limit messages, sign-ups and wrong guesses of a recovery code, a scrambled mark of where a request came from (or of the email being tried) is kept for about a week. The address and the email themselves are not written down for this.

What is not collected

• No advertising, and no advertising cookies.
• No analytics or tracking scripts, ours or anyone else's.
• No contact lists, no data bought from others.
• No location from your device. When you take a photo, toolate looks up the city your internet connection comes from, only to offer it to you as a button. It is not written down anywhere unless you tap that button, and then it is on the post for everyone who can see the post.
• Nothing is sold or given to anyone for marketing.

On your device

toolate keeps a few things in your browser so it works: that you are signed in, the shape of the feed you last used, the AI model you picked, whether clips start with sound, whether you chose to put your city on your posts, and, until you join, the invite code from the link you opened. No cookies are used for this.

Who can see what

• Your profile, posts and comments can be seen by everyone who is signed in to toolate, except people you blocked or who blocked you.
• Messages can be opened in toolate only by you and the person you wrote to.
• Your conversations with the AI can be opened in toolate only by you. Nobody else on toolate sees what you asked, not even the person whose post you asked about.
• A single post can also be seen by anyone who has its link, even without an account. Links are only made when someone presses Share, and cannot be guessed. Search engines are asked not to list these pages.
• Photos and clips are stored at addresses that are long and random but not locked. Anyone who has the exact address of a file can open it.
• Your likes and follows show as counts, and the person concerned is told.
• Your saved posts, your email address and the list of people you blocked are seen only by you.
• Reports and feedback are read only by the person who runs toolate. Someone you report is not told who reported them.
• Invites: the person whose invite you used sees how many people joined with their link, not who.

Who else handles it

toolate runs on services from other companies. They process what is needed to do their part.

• Supabase keeps the database, the accounts and the photo and clip files, in the United States.
• Vercel runs the website. Like any web host, it keeps short-lived technical logs that include the internet address requests come from.
• AI models, reached through Vercel's AI Gateway. When a photo or clip is added it is sent to a model to be read (Google's Gemini unless you pick another). A photo taken with toolate's camera is sent to Gemini the moment you take it, so the post can be written while it uploads; what the camera shows before you press the button stays on your device. When you ask a question or write a post with the AI, the question and the text it needs (the post, what was read in it, recent comments, your draft, and the last few questions and answers of that conversation) are sent to the model you picked. In a chat of your own, what you write and the last part of that chat are sent. Models come from different companies (among them Google, OpenAI, Anthropic, Meta, Mistral, xAI, DeepSeek, Xiaomi and Z.ai); Settings shows who makes each one, and each company handles what it receives under its own terms. Your email address and password are never sent to a model.

Deleting

• A post: open its menu and choose Delete. Its photo or clip is removed with it.
• A comment: delete it where it shows.
• A message: tap one you sent and choose Delete. It is removed for both of you.
• A conversation with the AI: open it and choose Delete conversation in its menu. Settings, Your AI deletes all of them at once. A conversation about a post is also removed when that post is deleted.
• Everything: Settings, Account, Delete account. Your account, profile, posts, photos, clips, comments, messages (sent and received), conversations with the AI, likes, follows and saved posts are removed at once. This cannot be undone.

Copies may remain for a short time in the backups our providers keep, and in previews that other apps made when a link was shared.

Your rights

You can ask what is stored about you, ask for a copy, have something corrected, or have it deleted. Write to us from the About page and say where to answer you.

Age

toolate is for people aged 13 and over. If you believe a younger child has an account, tell us and it will be removed.

Changes

If what is stored or who handles it changes, this page changes with it, and the date at the top is updated. toolate is an independent project and this page was written to be accurate and plain; it is not a document prepared by lawyers.