Privacy Policy

This policy explains what personal data Unfaded collects, why, and the choices and rights you have. Unfaded (“we”, “us”) is operated by Tiny Agency ApS (CVR 44 55 56 89), Denmark. We are the data controller for the personal data described here. Questions: peter@tinyagency.io.

What we collect

• Account data: your email address, and (if you sign in with Google) the basic profile your Google account returns to sign-in.
• Content you save: the links, notes, text, images, uploaded files, filenames, titles, tags, and related metadata you add to your library.
• Technical data: limited request logs and IP address, used to keep the service running securely and to rate-limit abuse.
• Cookies and browser storage: session cookies keep you signed in. The optional browser extension stores its API key and service URL in Chrome sync storage, which can synchronize them through your browser account. Clear the key in the extension options and revoke it in Settings when you no longer want extension access. The app does not load advertising or analytics tools. Bot protection, when enabled, is used for sign-in security. These functions are necessary to provide the service you request.

Why we use it, and our legal basis

• To provide the service (store and show your library, authenticate you) - performance of our contract with you.
• Security and abuse prevention (rate limiting, logs) - our legitimate interest in keeping the service safe.
• Essential emails (sign-in links, account notices) - performance of our contract with you.
• Product-update emails - only if you opt in; based on your consent, which you can withdraw at any time.
• Rights requests and recovery erasure evidence - compliance with our obligations under data protection law.

Where your data is stored

Your account and content are stored in the European Union (our database, file storage, and authentication run on Supabase in the eu-west-1 region, Ireland). Some service providers below may process limited data outside the EU through delivery, support, or infrastructure operations. EU storage does not exclude such transfers. Contact us for the providers, destinations, and safeguards applicable to your data, and a copy of any relevant contractual safeguards.

Recipients and service providers

We share data only with providers that help us run Unfaded:

• Supabase - database, file storage, and authentication (EU region).
• Vercel - application hosting, content delivery, and the separate encrypted erasure journal.
• Resend - sending sign-in and (if opted in) product emails.
• Google - when you choose Google sign-in, it handles authentication under its own privacy terms. The server may also request a site icon from Google using the saved site's hostname.
• Cloudflare - bot/abuse protection on the sign-in form, when configured. It receives technical browser and request information.

When you save or refresh a link, our server requests that page and its preview images or icons from the site and relevant metadata services. They receive the requested URL and our server's IP address, rather than your browser's IP address for the icon. Do not save private URLs whose access tokens you do not want sent to the destination. API keys and MCP give tools you connect access to your library; revoke a key in Settings to end that access. Those tools process data under their own terms. We do not sell your personal data.

How long we keep it

We keep your account and saved content while your account exists. Moving an item to Recently deleted keeps it available for restoration; it is not permanently erased and there is no automatic trash expiry. Use Delete permanently or Empty trash in Settings to remove its database record and stored files. Standalone tags remain until you remove them or delete your account. Account deletion removes stored files first, then account data, items, tags, preferences, and API keys. If file removal fails, we show an error and keep the account available for a retry; some files may already have been removed. An item or account whose permanent deletion has started is locked against new content, file uploads, and restoration until you retry and complete deletion.

Rate-limit counters are removed after their one-hour window by a sweep every 15 minutes. Supabase daily database backups on our Pro plan have a seven-day recovery window; they do not include the stored file contents. Deletion from the live service does not itself erase existing backup copies or provider security and delivery logs. Vercel's standard runtime-log history on our Pro plan is one day. Supabase's standard API and database log history on Pro is seven days. Resend publishes a 30-day standard email-history retention. These are provider history windows, not a guarantee about every internal security or billing record. Contact us for an applicable exception or a request involving provider records.

To prevent erased content returning after recovery, we record minimal account and item identifiers, request times and completion times in a separate encrypted erasure journal on Vercel. It contains no saved content or email addresses. Completed entries are retained for eight days and removed by a daily sweep; unfinished erasures remain recorded until resolved. If the journal is unavailable, permanent deletion stops before removing files. A restored backup remains isolated until the applicable erasures have been replayed and checked. Backups from before complete journal coverage cannot be reopened using this procedure.

Your rights

Under the GDPR you can access, correct, export, delete, restrict, or object to the processing of your data, and withdraw consent at any time. You can export your data and delete your account yourself in Settings, or email peter@tinyagency.io. Export includes all item statuses, tags, account profile, preferences, your retained erasure-request history, API key metadata (not secrets), and download links for stored files valid for seven days. Download those files before the links expire. We normally respond to rights requests within one month. You can withdraw product-email consent in Settings or through an unsubscribe link; this does not affect processing before withdrawal. You also have the right to complain to Datatilsynetor your local data protection authority. Providing an email address is necessary to create an account; saving content is optional.

Security

Data is encrypted in transit. Each account's data is isolated at the database level using access controls. API keys are stored only as hashes.

Children

Unfaded is not intended for children under 16.

Changes

If we change this policy we will update this page and the date above. For anything else, contact peter@tinyagency.io.