Privacy Policy

Effective: October 27, 2026
Last updated: November 2, 2026

Toy Box (the “Service”) is a set of tools provided through a website (toy-box.dev), a REST API (api.toy-box.dev) and an MCP server (mcp.toy-box.dev), operated by Yuhei FUJITA as an individual (the “Operator”). This Privacy Policy explains how the Service handles information about its users.

1. Our approach

The Service has no accounts or sign-in. We use what you enter into a tool (“Input”) only to run the tool, and we have no mechanism for storing it.

2. How Input is handled

1. Tools marked “Processed in your browser” on the website process Input on your device and do not send it to the Operator’s servers.
2. Tools marked “Processed on the server”, the REST API and the MCP server send Input to the Operator’s servers (Cloudflare Workers) for processing. We do not store Input or the result after the response is returned. However, if part of Input appears in the information described in Section 3(1) (including the requested URL and error details), that part is kept temporarily as logs.
3. When you use the MCP server through an AI assistant (such as Claude or ChatGPT), Input passes through that assistant’s provider, whose own privacy policy applies to it.
4. If you open a URL that contains Input (such as a link that sets initial values), that URL is handled as the information described in Section 3(1) and 3(3).
5. The IP Address Checker uses the IP address, estimated location, network provider and connection details from the information in Section 3(1) only to show them to you. We do not store what it shows. The estimated location may differ from where you actually are.
6. The DNS Checker sends the domain name or IP address you look up to 1.1.1.1, the public DNS resolver run by Cloudflare, Inc. On the website your device sends it directly; through the REST API and the MCP server our servers send it. Cloudflare’s 1.1.1.1 public DNS resolver privacy commitments apply to it there.
7. When you search for a tool with AI on the website’s home page (by pressing Enter or the “Ask AI” button), the search text is sent through the Operator’s servers and Cloudflare, Inc.'s AI Gateway to TypeSafe AI, whose AI model picks the tools that match it. Only the search text and the tool descriptions are sent, not your IP address or similar information. We do not store the search text or record it in logs. We use TypeSafe AI with the setting that keeps it from using what we send to train AI. TypeSafe AI’s own privacy policy applies to the information it handles. Input whose format can be recognised, such as a URL or a date, is recognised on your device and not sent.

3. Information we collect

1. Request information: IP address, the approximate location (country, region, city and similar) and network provider estimated from it, time of access, requested URL, browser or client information such as the User-Agent, referrer, and error details. This is processed by our infrastructure provider, Cloudflare, and the Operator reads it as logs, for example to fix failures.
2. API and MCP usage: tool ID, operation, channel (REST or MCP), response status, processing time and similar data. It does not contain Input. When you search for a tool with AI on the website, we also record the kind of result (such as whether a tool was found), the response status and the processing time, without the search text.
3. Website usage: Google Analytics 4 (through Cloudflare Zaraz) and Cloudflare Web Analytics collect the pages you view, referrer, device and browser type, approximate region and similar information.
4. Inquiries: what you send through our contact channel, which may include an email address for replies.

4. Purposes

• To provide and maintain the Service and fix failures
• To protect the Service from abuse and excessive load
• To understand usage statistically and improve the Service
• To answer inquiries

5. Cookies and data sent to third parties

To analyze usage and to provide tool features, the website causes your device to send information to the following companies. This section also serves as the disclosure required by Article 27-12 of the Telecommunications Business Act of Japan.

See How Google uses information from sites or apps that use its services, the Google Privacy Policy and the Cloudflare Privacy Policy. You can turn off Google Analytics with the Google Analytics Opt-out Browser Add-on or your browser’s cookie settings.

For visitors from the European Economic Area, the United Kingdom and Switzerland, Google Analytics cookies are used only with your consent.

6. Disclosure and service providers

1. We do not share collected information with third parties except as required by law, as described in Section 5, and with the service providers below. We do not sell collected information or use it to serve advertising.
2. We use the following service providers to run the Service. They may process information in the United States and other countries.
   • Cloudflare, Inc. (United States): hosting, logs, usage measurement and relaying requests to AI services (AI Gateway)
   • Google LLC (United States): website analytics and contact form
   • TypeSafe AI (United States): processing AI tool search
3. Transfers of information from the European Economic Area, the United Kingdom and Switzerland to the United States rely on adequacy decisions such as the EU-U.S. Data Privacy Framework, or on safeguards such as standard contractual clauses adopted by each provider.

7. Retention

We keep collected information only as long as needed for its purposes, then delete it or make it impossible to identify individuals. The criteria for each kind of information are:

• Request logs: as long as needed to fix failures and keep the Service secure
• API and MCP usage, website usage: as long as needed to analyze usage, within the settings and specifications of each measurement service
• Inquiries: after they are handled, as long as needed to keep a record of our response and to deal with disputes

8. Security

We take necessary and appropriate measures to prevent leaks and loss of information, including:

• Encrypting traffic with HTTPS.
• Limiting access to collected information to the Operator.
• Choosing service providers after checking how they handle information and how they secure it.
• Understanding the external environment: information is stored in the United States and elsewhere by the providers in Section 6. The Operator takes security measures with an understanding of the personal information protection system of the United States.

9. Your rights

You may ask us to notify you of the purposes of use of, disclose, correct, add to, delete, stop using, erase or stop sharing personal information about you that we hold. Send requests through our contact channel; after verifying your identity, we will respond without delay as required by law. We may decline a request if we cannot verify your identity, if it is manifestly unfounded or excessively repetitive, or if the law does not otherwise require us to comply. We charge no fee for requests. The Operator’s address will be provided without delay upon request.

If you are in the European Economic Area, the United Kingdom or Switzerland, you have rights under the GDPR and similar laws to access, rectify and erase your data, to restrict or object to processing, to data portability, and to lodge a complaint with a supervisory authority. We rely on legitimate interests to provide and protect the Service, and on your consent for Google Analytics. You can withdraw consent at any time.

10. Children

The Service is not primarily directed at people under 16. If we receive an inquiry containing personal information of a person under 16, we will not use that information beyond what is needed to respond.

11. Changes

We may update this Privacy Policy. The updated policy applies from the time it is posted on this page. We will announce material changes on this page or elsewhere, and where the law requires your consent to a change, we will obtain it.

12. Contact

Operator: Yuhei FUJITA
Contact: https://toy-box.dev/support

See the Terms of Service for the conditions of use. This English version is a translation; if it differs from the Japanese version, the Japanese version prevails.