Privacy Policy

TLBX Tools (“TLBX”, “we”, “us”) is a personal, non-commercial project operated in Canada. It runs a small set of utilities at tlbx.win and its subdomains.

Privacy questions and requests: privacy@tlbx.win. General support: support@tlbx.win.

Every page on tlbx.win, yt.tlbx.win, convert.tlbx.win, transcribe.tlbx.win, and the share links served from tlbx.win. It explains what each tool actually does with data, including the parts that run on a private computer rather than in a data centre.

Only the QR generator requires an account. Downloads, conversion, PDF work, temporary shares and transcription stay available without one.

When you create an account we store:

• your email address, a hashed password (we never see the password itself), and whether the address has been confirmed;
• your chosen username (3–30 letters, numbers, underscores or hyphens) and an optional display name;
• the sign-in providers attached to the account (email/password, Google, or both) and account timestamps;
• the QR codes you create and their settings.

Sign-in sessions are issued by Supabase Auth. The session (access and refresh tokens, plus your user id) is kept in your browser’s local storage under the key tlbx-auth, not in a cookie, and is sent only to Supabase when the session needs refreshing.

If you choose “Continue with Google”, Google authenticates you and Supabase receives a basic identity: your Google account identifier, email address, whether the email is verified, and the name and profile-picture URL Google shares. We request only the basic openid, email and profile scopes. TLBX never asks for Gmail, Drive, Calendar or any other Google API.

A Google identity is attached to a TLBX account only when you sign in with it or explicitly connect it from your account page. We do not merge accounts by matching email addresses alone.

A QR code stores a permanent TLBX short link plus the destination you enter, a name, design settings, an optional expiry, and — if you set one — a bcrypt hash of the visitor password. The password itself is never stored or shown again.

When someone scans a code, the request is resolved by our Cloudflare Worker against Supabase. The visitor does not need a TLBX account and is not asked for one. To limit password guessing, a failed attempt is recorded against a one-way key derived from the visitor’s IP address, browser identification and the code; the raw address is not written to the database. Three wrong attempts lock that visitor out of that code for 15 minutes. The code stays available to everyone else.

As with any web request, Cloudflare processes the visitor’s IP address, browser information and the URL to deliver the page and protect the service.

A QR code can also count its own scans. Counting happens on the way through the short link, before the redirect, and each kind of detail is a separate switch the owner controls. Nothing extra is recorded while they are off:

• a running total of scans, and the time of the last one, kept for as long as the code exists;
• when scans happen, as a timestamp per scan;
• unique visitors, counted once per day using the same one-way key described above (sha256(address + browser information + code)) — the key cannot be turned back into an address, and a device is counted once a day whatever it does;
• where scans come from: the country, region and city Cloudflare resolves from the connection. Never coordinates and never an address.

Scan detail is deleted automatically after 90 days; the running total stays with the code until the code itself is gone. Because a scan is counted before the redirect, a reload or a link preview counts too — the numbers are opens rather than people, and the unique figure is the closest thing to reach.

A logo you upload for a QR design is stored in a private Supabase Storage bucket that only your signed-in account can read. It is used to draw your QR code and, if you export one, is embedded in that image or SVG. It is deleted when you remove it or delete the account.

Files dropped into a share are stored on the private processing computer under Temp Media Storage/Share, not in a public cloud bucket. Container metadata (name, file list, sizes, expiry, a password hash and a digest of the owner key) is kept in Supabase. A share link is public to anyone who has it; an optional password adds a second check.

When a container expires, its files are deleted immediately and the metadata is kept briefly so the link can explain that it is gone. Nothing in a share is permanent.

• YouTube Downloader — the link you paste is sent to the processing computer, which asks the source site for available formats and writes the file locally. Finished files are removed after about an hour; only aggregate counters (number of downloads, bytes) are kept.
• Media Converter — images, audio and video you upload are written to the processing computer, converted with ffmpeg, and deleted after about an hour. Unfinished uploads expire after four hours. Still images handled entirely in the browser never leave your device. Only aggregate counters are kept.
• Transcription — the recording is sent to a private GPU computer on the same private network running VoiceStudio, processed there, and deleted about an hour later, along with the transcript. No third-party speech API receives it.
• PDF Toolkit — PDFs and images are read, edited and written inside your browser tab. They are never uploaded to TLBX.

TLBX sets no advertising or analytics cookies. The site uses local storage for your theme choice and, when you are signed in, the Supabase session described above. Cloudflare may set a short-lived bot-management cookie on requests to protect the service.

Counting a QR scan needs no cookie and no script in the visitor’s browser: it happens in the Worker. Our Cloudflare Worker and the processing computer keep ordinary technical logs (time, path, status, error text, and — for the backend — job ids). Access to the processing API is limited to the Worker using a private token. Logs are used for security and debugging and are not used to build profiles.

• Supabase — accounts, PostgreSQL database, and QR logo storage. The TLBX project is hosted in the us-east-2 region of the United States.
• Cloudflare — DNS, the site and Worker, the tunnel to the processing computer, and Turnstile if a challenge is enabled.
• Resend — delivery of account emails from no-reply@auth.tlbx.win.
• Google — only when you choose Google sign-in, for authentication.

These providers process data on our behalf under their own terms and privacy policies. Because they operate globally, your information may be processed outside Canada, including in the United States.

• Account and profile — until you delete the account.
• QR codes — until deleted or expired. An expired code can be recovered for 30 days; after that it is retired permanently. A retired code keeps only its identifier, the retirement date and a reason, so the short link can never point somewhere else.
• Visitor password attempts — the failure counter and lock expiry are cleared when the password is entered correctly, and old counters are removed automatically.
• QR scan detail — 90 days, then removed automatically. The all-time scan total stays with the code until the code is deleted.
• Uploads, downloads and recordings — about an hour after the job; unfinished uploads after four hours.
• Shares — at the expiry you chose, with metadata kept briefly afterwards.
• Technical logs — short-lived operational logs, retained only as long as needed to run and protect the service.

You can delete your account from the Account page by typing DELETE. This removes your profile, username, email-based sign-in record and every QR code you own. Printed codes stop working immediately. The retired identifiers are kept so they are never reused, but their destinations are erased.

Aggregate counters (for example, total files converted) do not identify anyone and are not reduced when an account is deleted. Security logs may be retained for a limited period where needed to investigate abuse.

You can view and change your username, email address, password and linked sign-in methods from the Account page, and delete the account entirely. You may also ask us to:

• confirm what personal information we hold about you;
• correct information that is wrong;
• delete information we are not required to keep;
• explain how your information has been used.

Write to privacy@tlbx.win. We aim to answer within 30 days. If you are not satisfied, you can contact the Office of the Privacy Commissioner of Canada or the privacy regulator in your province or territory.

Canada’s Personal Information Protection and Electronic Documents Act (PIPEDA) and applicable provincial privacy laws set the standards we follow: collect only what is needed, say why, limit use and retention, and protect it.

TLBX is not directed at children under 13, and accounts are not intended for them. If you believe a child has created an account, write to privacy@tlbx.win and it will be removed.

If what TLBX collects or how it is handled changes, this page is updated and the date at the top changes with it. Material changes that affect existing accounts will be noted on the account page.

Privacy: privacy@tlbx.win
Everything else: support@tlbx.win