Privacy Policy

• Your account: your email address and either a hashed password (we never store the password itself) or, if you sign in with GitHub or Google, that account’s identifier and email.
• Database logins you save (for example an OMIM key): stored encrypted, decrypted only on our server to run a tool that needs that login, and never shown back in full, shared with other users or sent to anyone except the database it belongs to.
• Connected AI apps: the name you or the app gave each connection, when it was created and last used. The credential your app holds is stored only as a one-way hash.
• What you share or publish: names of computers you connect, the list of tools each one offers, share codes and the colleagues who joined, tools you publish (name, description, inputs, who may use them) and their usage counts.
• Usage records: for each tool run, which tool ran, whether it succeeded, how long it took and when. We do not store your questions, the inputs you give tools or their results, except that results of long-running jobs are kept up to 24 hours so your AI app can collect them.
• Messages you send us: feedback, and questions and answers exchanged through tools that a person answers.

Your conversations with Claude, Claude Code or Codex stay between you and that provider. We only receive the specific tool requests your AI app sends to ToolUniverse. When a tool runs, its request goes to the database that answers it (for example PubMed or UniProt), under that database’s own terms. When you use a colleague’s shared computer, your request runs on their computer.

• To run the service: sign you in, run tools with your logins, connect shared computers, and show what you can use.
• To keep it working and safe: limit abuse, investigate failures, and rank tools by reliability using anonymous totals (no names or contents).
• To send account emails (confirming your address, resetting your password). We do not send marketing email.

• Render hosts our server (Singapore).
• Supabase hosts our database (Singapore).
• Vercel hosts the website.
• Resend sends account emails.
• GitHub or Google, only if you choose to continue with them.

We use one cookie that keeps you signed in. We do not use advertising or tracking cookies, and the site has no third-party analytics.

We keep your data while your account exists. Delete a saved login, a connection or a shared computer at any time on its page. Delete your account in Settings: this removes your logins, connections, usage records, messages and computers, and anonymizes your account. Tools you published are unpublished and their details erased; questions other people sent to them are kept for those people, without your details. Copies in our database provider’s backups expire within 30 days.

You can ask us for a copy of your data, to correct it or to delete it, at shgao@live.com. Depending on where you live (for example under the EU GDPR or California law), you may also have the right to object to how we use your data and to complain to your data protection authority. We answer requests within 30 days. The service is meant for researchers and is not for children under 16.

If we change this policy in a way that matters, we will say so on the site before it takes effect.