Privacy Policy

1. Who we are

Tineyatom ("TinyAtom", "we", "us") provides the TinyAtom desktop application, the TinyAtom website, and the community marketplace (together, the "Service"). This policy explains how we handle personal information in connection with the Service. For data protection purposes we are the controller of the information described in section 3.

2. What never leaves your computer

TinyAtom is local-first by design. The following are stored on your computer and are never transmitted to us:

• the data your atoms store, such as records, entries, uploads, and databases;
• the files an atom opens or writes on your machine;
• the contents of atoms you build but do not publish;
• anything you type into an atom.

We hold no copy of this material. We cannot read it, recover it, hand it over, or restore it for you if you lose it. Keeping your own backups is your responsibility.

If you choose to publish an atom to the marketplace, that atom's code and metadata are of course sent to us so we can distribute it. That is the one case where something you built leaves your machine, and it only happens when you deliberately publish it.

3. What we collect

3.1 Website analytics

When you visit our website, we and our analytics provider collect standard usage information: pages viewed, time on page, referring URL, campaign parameters, approximate location derived from your IP address (typically city or region, not a precise location), browser type and version, operating system, device type, and screen size. We also record the operating system we detect so we know which platform builds people need.

3.2 Desktop app telemetry

The TinyAtom application sends us:

• Crash and error reports: stack traces, error messages, the application state at the time of the failure, application version, and operating system version. Crash reports can occasionally contain fragments of file paths or other incidental data; we do not seek this out, and we do not use it for any purpose other than diagnosing the failure.
• Usage events: which features are used and how often, such as creating, installing, or opening an atom. These are recorded as events, not as the contents of your work.
• Version and update checks: the application asks our servers whether a newer version exists, which necessarily discloses your current version, your operating system, and your IP address.
• Installation identifier: a random identifier generated on your device so we can tell repeat sessions apart from new ones. It is not linked to your name or email.

3.3 Information you give us

• Waitlist and notifications: if you ask to be told when a build for your platform is ready, we collect your email address and the platform you asked about.
• Marketplace publishing: if you submit an atom for publication, we collect the account and contact information needed to identify you as the publisher, along with your submission. We review every submitted atom before publishing it, which means our reviewers read the code, metadata, and capability declarations you send us. Do not put secrets, credentials, or personal data belonging to other people into an atom you submit.
• Support and correspondence: if you send us a message or report a problem, we keep the message and whatever you chose to put in it.

3.4 What we do not collect

We do not collect your name unless you give it to us, we do not collect payment information (the Service is free), we do not read your files, and we do not sell or rent your personal information to anyone.

4. How we use it

We use the information described above to:

• operate, maintain, and deliver the Service;
• diagnose crashes, fix bugs, and improve reliability and performance;
• understand which features are used, so we can decide what to build and which platforms to support;
• deliver updates and tell you about new versions;
• send you the notification you asked for, if you joined a waitlist;
• detect, investigate, and prevent abuse, malicious atoms, fraud, and security incidents;
• respond to your questions and support requests; and
• comply with law and enforce our Terms of Use.

We do not use your information for automated decision-making that produces legal or similarly significant effects on you. We do not use it to train machine learning models.

5. Legal bases

If you are in the European Economic Area or the United Kingdom, we rely on the following legal bases under the GDPR:

• Legitimate interests: for crash reporting, security, abuse prevention, and understanding product usage in aggregate. Our interest is in providing a working, secure product, balanced against your privacy.
• Consent: for non-essential analytics cookies, and for marketing or waitlist emails. You may withdraw consent at any time.
• Performance of a contract: to provide the Service you asked for, including marketplace publishing.
• Legal obligation: where we must retain or disclose information to comply with law.

6. Cookies and local storage

Our website uses browser local storage to remember your light or dark theme preference. That value stays in your browser and is never sent to us.

Our analytics provider sets cookies or similar identifiers to distinguish visitors and sessions. Where the law requires consent for these, we will ask for it before setting them, and you can decline without losing access to any part of the site. You can also block or delete cookies in your browser settings.

We honour the Global Privacy Control (GPC) signal where applicable law requires us to treat it as an opt-out.

7. Who we share it with

We do not sell your personal information, and we do not share it for cross-context behavioural advertising. We share it only with:

• Service providers who process information on our behalf and under contract: our analytics provider, error and crash reporting provider, hosting and content delivery providers, and email provider. They may use it only to provide services to us.
• Legal and safety recipients: where we believe in good faith that disclosure is required by law, or is reasonably necessary to investigate a malicious atom or security incident, to protect our rights or property, or to protect the safety of any person.
• A successor: if we are involved in a merger, acquisition, financing, or sale of assets, information may transfer as part of that transaction. We will give notice if a different privacy policy would then apply.

8. International transfers

We and our service providers may process information in countries other than yours, including the United States, which may not offer the same level of data protection as your country. Where we transfer personal information out of the European Economic Area or the United Kingdom, we rely on appropriate safeguards, such as the European Commission's Standard Contractual Clauses.

9. How long we keep it

We keep personal information only as long as we need it for the purposes described in this policy, then delete or anonymise it. As a general rule:

• analytics and usage events: up to 14 months;
• crash and error reports: up to 90 days;
• waitlist emails: until you unsubscribe or we notify you that the build is ready, whichever is later;
• marketplace publisher records and published atoms: for as long as the atom is listed, and afterwards as needed for security, dispute resolution, and legal compliance;
• support correspondence: up to 2 years.

We may keep information longer where we must do so by law or to establish, exercise, or defend a legal claim.

10. Security

We use reasonable technical and organisational measures to protect the information we hold, including encryption in transit, access controls, and limiting access to those who need it. No system is perfectly secure, and we cannot guarantee absolute security. You are responsible for the security of your own computer and of the data your atoms store there.

11. Your rights

Depending on where you live, you may have the right to: access the personal information we hold about you; correct it if it is inaccurate; delete it; restrict or object to how we use it; receive it in a portable format; and withdraw consent you previously gave.

We respond to privacy-rights requests within the time the law allows. We may need to verify your identity first, which is difficult where we hold only a random installation identifier and no account. In that case, the information we can provide may be limited.

You can opt out of app telemetry at any time in the application's settings, and you can opt out of website analytics by declining cookies or using a browser or extension that blocks them. Opting out will not reduce your access to the Service.

If you are in the EEA or UK and believe we have mishandled your information, you may complain to your local supervisory authority. We would appreciate the chance to address your concern first.

12. US state privacy rights

If you are a resident of California or another US state with a comprehensive privacy law, you may have the right to know what personal information we collect and how we use it, to request deletion or correction, to obtain a portable copy, and to opt out of the sale or sharing of personal information and of targeted advertising.

We do not sell personal information, we do not share it for cross-context behavioural advertising, and we do not use it for targeted advertising. We will not discriminate against you for exercising any privacy right.

13. Third-party atoms

Atoms built by other people are not our software. An atom you install from the marketplace runs on your computer with the permissions you grant it, and it may collect, store, or transmit information according to its own author's practices, not ours. This policy does not cover them.

We review atoms for security problems before they are published, and we reject those we find to be collecting or transmitting data deceptively. That review is a best effort and cannot catch everything, so it is not a guarantee about any atom's data practices, and it does not make us responsible for them. Before installing any atom, review the files, data, and capabilities it asks for.

We investigate reports that an atom is collecting data deceptively or maliciously.

14. Children

The Service is not directed to children, and we do not knowingly collect personal information from anyone under 16. If we learn that we have collected personal information from a child, we will delete it.

15. Changes to this policy

We may update this policy from time to time. If we make a material change, for example if we begin collecting a new category of information, we will update the "last updated" date above and, where reasonable, give notice through the Service or the website before the change takes effect.