Cookie Policy

Cookies are small text files — typically only a few kilobytes — that a website stores on your device (computer, tablet, phone, or any other internet-connected device) when you visit it. They allow a website to recognise your browser, remember your preferences, and understand how you interact with the Service. This Cookie Policy ("Policy") explains how Pack My Tools ("we", "us", "our") uses cookies and similar tracking technologies across packmytools.com, our web application, APIs, and associated subdomains (collectively, the "Platform"). Beyond classic cookies, we also use: • Local Storage & Session Storage — browser storage used to keep you signed in and to remember interface state. • Pixels & Web Beacons — tiny transparent images used to measure whether a page or email was opened. • Software Development Kits (SDKs) — code embedded in our apps that behaves like a cookie. • Limited device signals — browser and device attributes used strictly for fraud prevention and security. Where this Policy refers to "cookies", it includes all of the above unless stated otherwise. This Policy should be read together with our Privacy Policy and Terms of Service, which describe our broader data practices.

We group cookies by the purpose they serve. Only the "Strictly Necessary" category is essential to operate the Platform — everything else is optional and controlled by your consent choices. Strictly Necessary These cookies are required for the Platform to function and cannot be switched off in our systems. They handle authentication, session continuity, security, load balancing, and token accounting integrity. Without them, features such as signing in, running an AI generation, or completing checkout would not work. Functional These remember choices you make to give you a better, more personalised experience — for example your theme (light/dark), language, sidebar state, preferred default model, and your most recently used tool. Analytics & Performance These help us understand how the Platform is used — which tools are popular, where users get stuck, how long generations take, and which pages convert. Data is aggregated and, where possible, pseudonymised so we can improve the product. Marketing & Advertising Where permitted and with your consent, these cookies measure the effectiveness of our campaigns and limit how often you see the same advertisement. We do not use your private prompts or AI generations for advertising purposes. Preference & Consent A consent cookie records which categories you accepted or rejected so that we do not ask you again on every page load.

Cookies differ by lifespan and by who sets them. Session Cookies Temporary cookies deleted automatically when you close your browser. Used for sign-in sessions, CSRF protection, and multi-step flows such as checkout. Persistent Cookies Remain on your device for a defined period (from a few days to 24 months) or until you delete them manually. Used for remembering preferences, keeping you signed in, and analytics. First-Party Cookies Set directly by Pack My Tools. We control these, and they generally support core functionality and preferences. Third-Party Cookies Set by external domains whose services we use (payments, analytics, error monitoring, support chat). Those providers determine their own retention and processing — see Section 4. Examples of cookies we may set: • pmt_session — authenticates your session (Essential, session) • pmt_csrf — protects against cross-site request forgery (Essential, session) • pmt_consent — stores your cookie choices (Essential, 12 months) • pmt_theme — remembers light/dark mode (Functional, 12 months) • pmt_workspace — remembers your last used tool and layout (Functional, 6 months) • pmt_analytics_id — pseudonymous analytics identifier (Analytics, 13 months) • __stripe_mid / __stripe_sid — fraud prevention during payments (Essential, 1 year / 30 minutes) • _ga / _ga_* — Google Analytics measurement (Analytics, up to 24 months) Cookie names and lifespans may change as we update our technology stack. The categories described above remain the authoritative description of what we use.

Some Platform features rely on trusted third parties who may set their own cookies on your device. We do not control these cookies; their use is governed by the provider's own privacy and cookie policies. Typical categories of providers we work with: • Payment processing — e.g. Stripe, for secure checkout, subscription billing, and fraud detection. • Analytics — e.g. Google Analytics or PostHog, for aggregated usage measurement. • Infrastructure & security — e.g. Cloudflare or Vercel, for CDN delivery, DDoS protection, and bot mitigation. • Error monitoring — e.g. Sentry, to detect and diagnose crashes. • Customer support — e.g. Intercom or Crisp, when you open a chat widget. • Identity & authentication — e.g. Google or GitHub OAuth, when you choose social sign-in. Each provider is contractually required to process data only for the purposes we specify, to apply appropriate security measures, and to comply with applicable data protection law. Where required, we maintain Data Processing Agreements (DPAs) with these providers. Links to third-party policies: • Stripe — https://stripe.com/cookies-policy/legal • Google — https://policies.google.com/technologies/cookies • Cloudflare — https://www.cloudflare.com/cookie-policy/ We never sell your personal information to third parties.

You are in control of cookies. There are several ways to manage or withdraw your consent. In-App Cookie Preferences Click "Cookie Preferences" in the footer (or the cookie icon on any page) to open the consent panel. You can enable or disable the Functional, Analytics, and Marketing categories at any time. Strictly Necessary cookies cannot be disabled, because the Platform cannot function without them. Your choice takes effect immediately and is remembered for 12 months. Browser Controls All major browsers let you view, block, and delete cookies: • Chrome: Settings → Privacy and security → Third-party cookies • Safari: Settings → Privacy → Manage Website Data • Firefox: Settings → Privacy & Security → Cookies and Site Data • Edge: Settings → Cookies and site permissions You can also browse in Incognito/Private mode, which deletes cookies when the window closes. Opt-Out Tools • Google Analytics Opt-out Browser Add-on — https://tools.google.com/dlpage/gaoptout • Digital Advertising Alliance — https://optout.aboutads.info • Network Advertising Initiative — https://optout.networkadvertising.org Consequences of Disabling If you block or delete cookies, you may be signed out unexpectedly, lose saved preferences, and find that some features — including checkout, generation history, and workspace settings — do not work correctly. Blocking analytics cookies does not affect your ability to use the Platform.

Some browsers offer a "Do Not Track" (DNT) signal. Because there is still no common industry standard for how DNT should be interpreted, we do not currently respond to DNT signals. We do honour the Global Privacy Control (GPC) signal where it is legally required — for example, under the California Consumer Privacy Act as amended by the CPRA, and under Colorado's and Connecticut's privacy statutes. When we detect a valid GPC signal, we treat it as an opt-out of the sale or sharing of personal information and of targeted advertising. We do not knowingly use targeted advertising cookies for users we know to be under 18, and we do not engage in cross-context behavioural advertising directed at minors. You can enable GPC in browsers and extensions that support it — for example Firefox, Brave, DuckDuckGo, and the Privacy Badger extension.

Retention Cookie lifespans vary by purpose. Session cookies are deleted when you close your browser. Persistent cookies typically expire between 30 minutes and 24 months, as summarised in Section 3. Consent records are kept for 12 months, after which we ask you again. You can delete any cookie at any time from your browser settings. Your consent choices apply until you change them or until they expire, whichever comes first. Updates to This Policy We may update this Cookie Policy as our technology, providers, or legal obligations change. When we make material changes we will: • Update the "Last Updated" date and version number at the top of this page. • Show an in-app notice or banner for at least 14 days. • Where required by law, ask you to re-consent to non-essential cookies. Where the law requires prior consent, we will not deploy new non-essential cookies before you have had the opportunity to accept or reject them. Version history and previous versions are available on request from privacy@packmytools.com.

If you have questions about this Cookie Policy, want to withdraw consent, or wish to exercise your data protection rights, please contact us. Privacy & Data Protection Team Email: privacy@packmytools.com Data Protection Officer: dpo@packmytools.com Mailing address: Pack My Tools, Attn: Privacy Team, 1201 N Orange St, Wilmington, DE 19801, United States Depending on where you live, you may have the right to access, correct, delete, or port your personal data; to object to or restrict certain processing; to withdraw consent at any time; and to lodge a complaint with your local supervisory authority. Exercising these rights is free of charge, and we will not discriminate against you for doing so. EU/EEA, UK and Swiss users: our legal bases for cookie processing are consent (non-essential cookies), legitimate interests (security, fraud prevention, and aggregate analytics), and legal obligation (record-keeping). Where we rely on consent, you may withdraw it at any time without affecting the lawfulness of processing carried out before withdrawal. California users: you may opt out of the "sale" or "sharing" of personal information via the GPC signal or by emailing privacy@packmytools.com. We do not sell personal information for monetary consideration. We aim to respond to all verified requests within 30 days.