Last updated: September 12, 2026
Tooloholic is a creator-led software discovery platform dedicated to helping you discover tools worth knowing. This document explains precisely what data we process, how it is secured, and the principles guiding our infrastructure.
We believe in software discovery without invasive surveillance. Tooloholic does not sell your personal data, does not deploy cross-site tracking pixels, and does not partner with advertising broker networks. We only collect and process the minimal information necessary to deliver software discovery, authenticated bookmarks, community submissions, and platform security.
When you create an account or sign in, authentication is securely managed by Supabase Auth. We store your account ID, email address, display name, and avatar URL. Password hashing and credential verification are handled by Supabase; raw passwords are never accessible to or stored on our servers.
When you bookmark tools, the relationship between your account ID and the tool ID is stored in our database protected by PostgreSQL Row Level Security (RLS). Only your authenticated session can read, add, or delete your bookmarks.
When creators or community members submit software for inclusion via our intake form, we record the tool name, product URL, descriptions, category, pricing model, founder/submitter contact email, and optional commentary. Any logos or screenshots uploaded are validated for authentic file signatures (magic bytes), checked for size limits, and passed through strict SVG sanitizers to remove malicious scripts before storage in our public media bucket.
When users report issues on a tool page (such as broken links, inaccurate pricing, or outdated data), we record the tool ID, the selected issue reason, optional elaboration, and an optional reporter email. Reports are subject to IP-based rate limiting and honeypot anti-spam verification to prevent spam floods.
When clicking outbound links to external software through our redirect handler (/r/[slug]), we record aggregate visit counts for discovery popularity metrics. To prevent automated click bots from inflating metrics and deduplicate rapid repeated clicks, client IP addresses are passed through a cryptographic HMAC-SHA256 hash using a private server salt. Raw IP addresses are never written to or stored in our database.
Tooloholic uses essential HTTP cookies strictly to maintain authenticated user sessions and CSRF protection. We do not store third-party advertising cookies, retargeting beacons, or marketing trackers on your device.
Our application is deployed and operated using reputable cloud infrastructure providers:
You have full control over your information:
We implement industry-standard safeguards including end-to-end TLS encryption for all data in transit, strict PostgreSQL Row Level Security policies, bounded file uploads, SVG sanitizer routines, and cryptographic hashing for transient analytics.
If you have questions regarding this Privacy Policy or wish to request data deletion, please contact Priy directly:
