Privacy Policy
This policy explains what My Apps (the "service", at myapps.tooly.fyi) collects, why, how long it's kept, and the choices you have. The service is operated by itpro360 LLC ("we", "us"). We've kept it short because the service collects very little.
What we collect
When you sign in with Tooly SSO
You sign in to My Apps with your Tooly account. Tooly SSO (sso.tooly.fyi, also operated by itpro360 LLC) checks your password and authenticator code; My Apps never sees them. When you sign in, Tooly tells My Apps:
- Your Tooly user ID (a permanent identifier that links your My Apps data to your Tooly account).
- Your name, email address and profile photo, used to show who you are, who shared an app, and so others can share apps with you by email.
- Your roles (for example "family" or "netadmins"), which decide whether you can use My Apps and its admin console.
We keep these from your latest sign-in, plus when you agreed to these terms. How Tooly handles your account is described in Tooly SSO's Privacy Policy.
Older My Apps accounts
If you created a My Apps account before Tooly sign-in existed, we also still hold your password (only as a one-way hash we can't read), your authenticator key and your recovery codes (as one-way hashes) until old passwords are switched off, after which they're no longer used.
When you use the service
- The apps you add: each app's name, web address, category and position on your page.
- Sharing: which apps you share and the email addresses you share them with.
- Sign-in history: the time, IP address, browser/device description and sign-in method (Tooly or old password) of your last 30 sign-ins to My Apps, shown to you on your Account page.
- Activity log: sign-ins, sign-outs, sign-ups, failed attempts, lockouts, password and authenticator changes, account deletions and admin actions, with the time, account email (if any), IP address and browser/device description. This helps us spot and stop attacks on accounts and answer questions about account activity.
- Record of account deletion: when an account is deleted, we keep a short record of the name and email, when the account was created, last used and deleted, who deleted it, how many apps it had, and the IP address and device the deletion came from.
- Visit counts: daily totals of page views and visitors. Visitors are counted using a scrambled code made from the IP address that changes every day, so we can count unique visitors without keeping the IP address for this purpose.
We don't collect payment details, contacts, location, or anything from your device beyond what your browser sends with every web request. We don't store the passwords for the apps you add, and we don't visit or scan those apps.
Cookies and browser storage
We use one cookie, myapps_tooly, which keeps you signed in for up to 30 days. It's strictly necessary for the service to work. We don't use advertising, analytics or tracking cookies, and we don't use third-party trackers of any kind.
The app also keeps two small settings in your browser's local storage: whether to show icons for apps on your home network, and a list of app websites whose icons didn't load, so it doesn't keep retrying them (entries expire after 3 days). These stay on your device, are never sent to us, and are cleared when you clear your browser's site data.
How we use your information
- To provide the service: show your apps, keep you signed in, and deliver apps others share with you.
- To keep accounts secure: verify sign-ins, limit repeated failed attempts, and investigate suspicious activity.
- To understand overall usage through the daily visit totals described above.
We don't sell or rent your information, use it for advertising, or use it to train AI models.
Who can see your information
- You. Your apps are private unless you share them.
- People you share with. When you share an app, the people you name (or every account holder, if you leave the list empty) see that app's name and address, plus your name, or your email if you didn't give a name. People you share with don't see who else you shared it with.
- Site administrators, who can see account details (name, email, sign-up date, last sign-in, number of apps), the activity log, deletion records and visit totals, so they can run and protect the service.
- Service providers. Traffic to the service passes through Cloudflare, which protects and delivers the site and processes technical data such as IP addresses under its own privacy policy.
- Authorities, only if we're required to by law.
App icons
To show an icon for each app on your page, your browser loads that icon directly from the app's own website. Those websites can therefore see your IP address and browser when you view your page, as they would if you visited them. We don't control those sites.
How long we keep it
- Account and apps: until you delete your account, or an administrator removes it.
- Sign-in history: your last 30 sign-ins.
- Activity log and deletion records: 12 months, then deleted automatically.
- Visit totals: about 120 days.
- Backups: daily backup copies of the service's data are kept for 14 days, so deleted information may remain in a backup until it ages out.
Your choices and rights
- See and download your apps at any time with Export.
- Correct your apps whenever you like, and change your password or recovery codes on the Account page.
- Delete your data in My Apps yourself on the Account page. This removes your apps and everything you've shared in My Apps right away; your Tooly account is deleted separately at Tooly SSO. The activity log and the short deletion record described above are kept for 12 months for security, then deleted.
- Ask us for a copy of the information we hold about you, or to correct or delete it, using the contact details below. Depending on where you live, you may have further rights under local privacy law, and we'll honor requests as that law requires.
Security
Every account is protected by a password and a second step with an authenticator app. Passwords and recovery codes are stored as one-way hashes, connections are encrypted with HTTPS, and repeated failed sign-ins are blocked. No system is perfectly secure, so please use a strong, unique password and keep your recovery codes safe.
Where your data is stored
The service runs on a server operated by itpro360 LLC in the United States. If you use it from elsewhere, your information is transferred to and processed in the United States.
Children
The service isn't intended for children under 16, and we don't knowingly collect information from them. If you believe a child has created an account, contact us and we'll remove it.
Changes to this policy
If we change this policy, we'll update the effective date above. If a change significantly affects how we use your information, we'll make it clear on the site before it takes effect.
Contact
Questions or requests about this page or your information: contact itpro360 LLC through the site administrator.