toolbox Privacy Policy

Last updated: October 23, 2026

toolbox is an app for cataloging your tools and home items, and, if you choose, lending them to neighbours nearby. This page explains what information toolbox collects, why, and how it is handled. We have tried to write it in plain language rather than legal boilerplate.

The short version: we collect what is needed to run your catalog and make local lending work, we never share your exact location with other users, we do not sell your data, and you can delete your account and everything tied to it at any time from inside the app.

Who operates toolbox

toolbox is built and operated by Enigma Studio Inc., an Ontario, Canada software studio.

Information we collect

Account information

When you sign in with Apple or Google (via Supabase Auth, our backend provider), we receive and store your email address and create an account ID for you. We do not see or store your password. Authentication is handled by Apple, Google, and Supabase.

Profile information

You can set a display name, an optional @handle, and an optional profile photo (avatar). You control a visibility toggle that determines whether your profile is discoverable to others.

Catalog content and photos

The tools and items you catalog, including names, notes, tags, free-text location descriptions (for example "garage shelf"), and any photos you attach, are stored in our backend (Supabase database and file storage) so your catalog syncs across your devices. This content is yours; we store it to provide the app's core function.

Location

If you grant location permission, toolbox uses your device's precise location ("when in use" only, never in the background) for two purposes:

• To compute an approximate distance band (for example "under 1 km") between you and lendable tools near you, so you can discover what is nearby.
• To let you set a home base, a location (which you can enter as a typed address or use your current position) that determines where your own lendable tools appear to others.

See the dedicated Location privacy section below for important detail on what is and is not shared.

Push notification tokens

If you grant notification permission, we store an Expo push token tied to your account so we can notify you about borrow requests and related lending activity (for example, a return deadline approaching). The token identifies your device for delivery purposes; it does not contain personal content.

Analytics and usage data

We use PostHog (a US-based analytics provider) to understand how the app is used. This includes product-usage events, such as screens viewed and actions like "tool added," "borrow requested," or "household joined," along with standard device and app metadata (for example OS version, app version). Analytics events do not include coordinates, street addresses, or the free-text content you enter (tool names, notes, locations, and so on). Events are tied to your account ID so we can understand usage patterns, and that link is cleared when you sign out.

How we use this information

We use the information above to:

• Create and maintain your account and catalog, synced across your devices.
• Power the lending feature: showing nearby lendable tools by distance band, handling borrow requests, and sending reminders.
• Let you share a household catalog or connect with friends, if you choose to use those features.
• Send push notifications about lending activity you are involved in.
• Understand how the app is used and fix problems, via aggregated analytics.
• Maintain the security and integrity of the service (for example, enforcing access rules at the database level).

We do not use your information for advertising, and we do not build advertising profiles.

Location privacy

Location is central to how lending works, so we want to be explicit about it:

• Your exact coordinates are never shared with other users. When someone else sees your lendable tools, they see only a coarse distance band (for example "under 1 km away"), never a pin, address, or precise distance.
• Precise location is used only to compute that distance band and to let you set your home base; it is enforced server-side, so the app's backend, not just the screen you see, withholds exact coordinates from other users' queries.
• Exact location is only ever revealed once you explicitly agree to a specific lend and choose a pickup spot for that transaction. That pickup location is shared solely with the other party to that specific borrow, and only after you have agreed to it.
• If you add your home address as free text when setting a home base, it is geocoded (converted to coordinates) to compute distance bands; the text you typed is not shown to other users.
• Location permission is "when in use." toolbox does not track your location in the background or when the app is closed.
• You can deny or revoke location permission at any time (see Your choices and rights below). Without it, you can still use the catalog features; you just will not see or be discoverable in nearby lending.

How information is shared

• We do not sell your personal information, and we never will.
• We do not share your data with third parties for their own marketing or advertising purposes.
• Other toolbox users can see what you choose to make visible: your profile (per your visibility setting), your lendable tools' distance band (never exact location), and anything you share directly through a household, friend connection, or an agreed borrow.
• We share information with the service providers listed below, solely so they can provide the service to us, not for their own independent use.
• We may disclose information if required by law, to protect the rights and safety of toolbox or its users, or in connection with a legitimate legal request.

Third-party processors

toolbox relies on the following providers to operate. Each processes data on our behalf, under its own privacy and security practices:

Data retention

We retain your account and catalog data for as long as your account is active, so the app can function and sync across your devices. If you delete your account (see below), your data is permanently erased rather than retained. Aggregated or anonymized analytics that can no longer be tied to you may be retained for product-improvement purposes.

Your choices and rights

• Delete your account. In the app, go to Profile → Delete account. This permanently erases your account and everything tied to it: your tools, photos, lending history, friend connections, household membership, and profile. This action cannot be undone.
• Control your profile visibility. Use the visibility toggle in your profile settings to control whether you are discoverable to others.
• Revoke permissions. You can turn off Location or Notifications at any time in iOS Settings → toolbox. Revoking location permission stops distance-band lending features from working for you but does not affect your private catalog. Revoking notifications stops push alerts about borrow activity.
• Access or correct your data. Most profile and catalog information can be viewed and edited directly in the app. For anything else, contact us using the details below.

Children

toolbox is not directed at, and is not intended for use by, children under 13. We do not knowingly collect personal information from children under 13. If you believe a child has provided us with personal information, please contact us so we can delete it.

International users and data storage

toolbox is operated from Canada, and the services we rely on (Supabase, PostHog) store and process data on infrastructure located in the United States. By using toolbox, you understand that your information will be transferred to and processed in the United States, which may have different data protection laws than your country of residence.

Changes to this policy

We may update this policy as the app changes. If we make material changes, we will update the "Last updated" date above and, where appropriate, notify you in the app. Continued use of toolbox after a change means you accept the updated policy.

Contact

Questions about this policy or your data? Contact david@enigmastudio.app.

← Enigma Studio  ·  toolbox support

© 2026 Enigma Studio Inc.