Privacy policy

Who we are

tinyping is a web push alerts service for builders. You send events from your apps through an HTTP API and receive them as push notifications in an installable web app, with a searchable inbox.

The controller of your personal data is [Legal entity name], [Registered address]. You can reach us at hello@tinyping.app.

What we collect

We collect only what we need to run the service.

• Account data: your name, email address, and a password hash if you sign up with email and password. If you sign in with Google, we receive your name, email address and profile picture from Google.
• Event content: the titles, messages, links, metadata and other data you or your apps send to the tinyping API, and the inbox history built from them.
• Push subscription data: the push endpoint URL and encryption keys your browser or device gives us when you turn on notifications.
• Device and browser information: browser type, operating system, device type and IP address, used to deliver notifications, keep sessions secure and prevent abuse.
• Logs: request logs and error logs with timestamps, IP addresses and request details, used for security and debugging.
• Billing identifiers: a customer and subscription identifier from Dodo Payments, your plan, and the status of your subscription. We never see or store your card details.
• Messages you send us: if you email us, we keep the message and your address so we can reply.

Why we use it, and our legal bases

Where the law asks us to name a legal basis, these are the ones we rely on, in plain terms.

• To provide the service (performance of our contract with you): creating your account, receiving your events, storing your inbox and delivering push notifications.
• To keep the service safe and working (our legitimate interests): security, fraud and spam prevention, bot checks, debugging, and improving reliability.
• To bill you (contract and legal obligations): managing your plan and keeping the records tax and accounting rules require, through our payment provider.
• To send service emails (contract and legitimate interests): verification codes, password resets and important notices about your account. We do not send marketing email unless you ask for it.
• With your consent: when you enable push notifications in your browser, and when you choose to sign in with Google. You can withdraw consent at any time in your browser or account settings.

Who processes your data

We share personal data only with providers that help us run tinyping, and only as needed for that purpose.

• Amazon Web Services (AWS): hosts our Postgres database in the us-east-1 region (United States) and sends our transactional email through Amazon SES.
• Dodo Payments: acts as Merchant of Record. It handles checkout, payment details, taxes and invoices, and is responsible for your payment data under its own privacy policy.
• Google: if you choose Sign in with Google, Google authenticates you and shares basic profile data with us.
• Cloudflare Turnstile: checks that sign-up and sign-in requests come from people, not bots. It processes limited browser and network signals.
• Browser push services: notifications are delivered through the push service run by your browser vendor (Apple, Google, Mozilla or Microsoft). They receive the encrypted notification payload and your push endpoint so they can route it to your device.

International transfers

Our database is hosted in the United States, and some providers above operate globally. If you are outside the United States, your data will be transferred to and processed there. Where required, we rely on appropriate safeguards for those transfers.

How long we keep data

We keep data only as long as we need it.

• Event history: kept for 7 days on the Free plan and 1 year on the Pro plan, then deleted automatically. If you downgrade, history older than the Free limit is deleted.
• Account data: kept while your account is open.
• Push subscriptions: kept until you turn notifications off, the browser reports the subscription as expired, or you delete your account.
• Account deletion: when you delete your account, we delete your account data, events and push subscriptions. Backups roll off on their normal schedule.
• Logs: kept for a limited period for security and debugging, then deleted.
• Billing records: Dodo Payments keeps transaction records for as long as tax and accounting law requires.

Security

We use encryption in transit (HTTPS) and managed, access-controlled infrastructure. Passwords are stored as hashes, never in plain text. Push payloads are encrypted for delivery to your device.

No system is perfectly secure, and we cannot guarantee absolute security. If we learn of a breach that affects your data, we will notify you as the law requires.

Your rights

Depending on where you live, you may have rights over your personal data. We aim to honor these requests for everyone.

• Access: ask for a copy of the personal data we hold about you.
• Export: ask for your data in a portable format.
• Correction: ask us to fix data that is wrong.
• Deletion: delete your account in the app, or ask us to delete your data.
• Objection and restriction: ask us to stop or limit certain uses.
• Complaint: contact your local data protection authority if you are unhappy with how we handled a request.
• To make a request, email hello@tinyping.app from the address on your account. We will reply within a reasonable time, and within any period the law sets.

Cookies and local storage

We use cookies and browser storage that are strictly needed for sign-in sessions, security and your preferences (such as theme), and for the installable app and its offline support. We do not use advertising cookies.

Children

tinyping is not meant for children under 16, and we do not knowingly collect their data. If you believe a child has given us personal data, contact us at hello@tinyping.app and we will delete it.

Changes to this policy

We may update this policy. When we make material changes, we will update the date at the top and, where appropriate, notify you by email or in the app.

Contact

Questions or requests about this policy: hello@tinyping.app.

[Legal entity name], [Registered address].