Privacy Policy

Last updated: 2026-10-14

This policy explains how WalkFrame LLC ("we") handles information when you use ToolPocket (https://toolpocket.net). In short: tool data stays in your browser unless you share or sync it, and shared and synced data is encrypted in your browser before it is sent.

1. Data in your browser

Tools save your settings and data in your browser (IndexedDB and localStorage). It is not sent to us. Files you open in tools such as the PDF, image and data viewers are processed in your browser and are not uploaded, unless the tool says otherwise. You can delete this data at any time by deleting the tools or clearing your browser's site data.

2. Tools that use the network

Some tools need an outside service to work. For example, the Ping / Traceroute tool sends the host you enter to Globalping, and some tools download libraries or sample files from CDNs. These requests reveal your IP address to that service.

3. Share links

When you create a share link, the data is encrypted in your browser. The key is only in the part of the link after #, which browsers do not send to servers. We store the encrypted data, but cannot read it.
Free links and their data are deleted automatically after 24 hours.
Paid links are deleted when they expire or when you stop them. Shared tools stay in your synced data, and are protected the same way as the rest of it (section 4). A link's password is never sent to us; we only keep a value that lets us count wrong attempts.
The share page does not load ads or analytics.

4. The paid plan (sync)

What we store

Account: a random account ID and the user ID that Firebase Authentication gives your Google or GitHub sign-in. We do not store your name or profile picture.
Email address: only if you choose to receive important notices. We use it for deletion notices, security incidents and important changes to the service, never for marketing. You can turn it off in Settings, and we delete it.
Subscription: the Stripe customer and subscription IDs, the subscription status and the renewal date. We do not receive your card number.
Synced data: your pockets and tools, encrypted in your browser before they are sent.

Who can read synced data

Standard mode: your data is encrypted with a key that we hold, so that signing in is enough to restore it on a new device. We could technically decrypt it. We do not look at it, except when you ask us to for support or when the law requires it.
Passphrase mode: your data is encrypted with a key that only your passphrase opens. We cannot read it.

How long we keep it

While you are subscribed.
When the subscription ends, synced data is deleted 7 days later, together with the encryption key we hold.
Deleted data can remain in our hosting provider's backups for up to 30 days.
We keep the account and subscription records as long as needed for accounting and tax law.

5. Payment

Payment is handled by Stripe (shown as Link). Stripe collects your payment details, billing address and email address and handles them under its own privacy policy. We use the billing country to check that the paid plan is sold there.

6. Ads and analytics

On the free plan, pages show ads from Google AdSense. Google and its partners may use cookies to show ads based on your visits to this and other sites. You can turn off personalized ads at Google Ads Settings.
We use Google Analytics (through Google Tag Manager) to understand how the site is used. It uses cookies and collects information such as pages viewed, device and approximate location. See how Google uses information from sites that use its services.
Ads and analytics are not loaded inside tools or on share pages, and cannot read your tool data.

7. Service providers and transfers outside Japan

We use these providers. Some of them process data outside Japan, mainly in the United States.

Cloudflare, Inc. (United States): hosting, storage of share links and synced data, email delivery.
Google LLC (United States): sign-in (Firebase Authentication), ads (AdSense), analytics.
GitHub, Inc. (United States): sign-in with GitHub.
Stripe (United States, Ireland and others): payment.
Globalping (by jsDelivr) and public CDNs: some tools, as described in section 2.

We choose providers that protect personal data to a standard comparable to Japan's Act on the Protection of Personal Information. Information about the data protection systems of these countries is published by the Personal Information Protection Commission of Japan.

8. Security

Tools run in a sandbox that cannot reach the data of other tools. Shared and synced data is encrypted in your browser. Access to our servers is limited to the people who run the service. If a breach affects you, we will tell you and the authorities as the law requires.

9. Your rights

You can ask us to disclose, correct, stop using or delete the personal data we hold about you. If you are in the EU, the UK or another region with similar laws, you also have the rights given by those laws, including the right to complain to your data protection authority. Email info@walkframe.com with your Account ID (Settings, SYNC). We may ask you to sign in to confirm it is you.

10. Children

The paid plan is not intended for children under 16.

11. Changes

We will post changes on this page with the date. For important changes, we will also tell subscribers in advance.

12. Contact

WalkFrame LLC, N&E BLD. 6F, 1-12-4 Ginza, Chuo-ku, Tokyo 104-0061, Japan. Email: info@walkframe.com