Privacy at ToolScout.

What we record

The recommendation engine can record anonymous or pseudonymous events such as searches, recommendation clicks, the selected intent or profile, acquisition source information and a session identifier. These events are used to improve matching, measure demand and understand which tools are useful.

Session identifier

The site may store a browser session identifier in local storage or a cookie so multiple actions from the same browser can be grouped for analytics. It is not intended to identify you by name.

Analytics

ToolScout uses Google Analytics 4 to understand site usage, landing page performance, recommendation funnels, acquisition quality and technical issues. It is intended to run only after analytics consent has been granted. When analytics consent is declined, ToolScout does not intentionally load Google Analytics for that browser.

ToolScout stopped using PostHog on 22 October 2026 and no longer loads it on any page.

AI assistants and ToolScout plugins

When ToolScout is used through an AI assistant or plugin, the assistant may send the task-specific search terms, software names, comparison choices or constraints needed to answer the request. ToolScout does not require an AI user account, name or email address for these public read-only tools. The ToolScout MCP implementation does not intentionally persist MCP request bodies, prompt text or AI account identifiers in the ToolScout application database.

AI providers process the conversation under their own privacy terms. ToolScout receives only the tool request sent to its public endpoint and returns software catalog or recommendation data needed for that request.

Outbound links

When you follow a tracked tool link, ToolScout records the outbound click before redirecting you to the provider. The provider then handles your visit under its own privacy policy.

Retention and removal

ToolScout's own Cloudflare D1 database uses a daily, bounded retention cleanup. Task-operation metadata for the A2A protocol is scheduled for deletion after 30 days. Pseudonymous first-party website search, session, funnel and visitor/traffic-quality event records are scheduled for deletion after 13 months. First-party outbound click-event rows, used for affiliate attribution and reconciliation, are scheduled for deletion after 24 months. These periods do not replace separate legally required retention for verified commercial records or the records held by external analytics providers. Daily cleanup may take additional cycles to remove an exceptional backlog.

The public read-only MCP endpoint does not intentionally save prompt text or tool-call request bodies to ToolScout D1. Analytics consent selection is stored in a browser cookie for up to 12 months; individual site sessions normally expire after 30 minutes of inactivity. Google Analytics 4 retains analytics information in its own provider systems under its separate settings. We do not assume a Google Analytics property setting without checking it. Information PostHog collected before 22 October 2026 remains under PostHog's own retention settings. For questions, access or deletion requests, contact pedro@trytoolscout.org. Deletion may be subject to applicable legal obligations.

Data minimisation

The public recommendation flow does not require your name, email address or account. ToolScout aims to collect only information needed to operate the recommendation, analytics and affiliate measurement systems.

Third party providers

External tools linked from ToolScout may use their own cookies, analytics, advertising or account systems. Review the provider's privacy documentation before creating an account or submitting personal information.

Analytics choice

You can change your analytics choice at any time by clearing the ToolScout site data in your browser and revisiting the site. ToolScout will then ask for your analytics preference again.

Questions

For privacy questions or requests, contact ToolScout at pedro@trytoolscout.org.