Privacy policy
Last updated: 2026-11-11
This policy explains how Neeraj ("Tinyping", "we", "us") handles personal data when you use the Tinyping website, web app and API. We have tried to keep it short and plain.
Who we are
Tinyping is a web push notification service for builders. You send events from your apps through an HTTP API and receive them as alerts in an installable web app, with a searchable inbox.
The controller of your personal data is Neeraj, Noida, Uttar Pradesh, India. You can reach us at hello@tinyping.app.
Google user data
If you choose Sign in with Google, we use Google Sign-In (OAuth 2.0) with only the openid, email and profile scopes. We do not request access to your Gmail, Drive, Calendar, Contacts or any other Google service.
Data we receive from Google: your name, your email address, your profile picture and your Google account identifier, which links your Google account to your Tinyping account.
How we use it: only to create your Tinyping account, to sign you in, and to show your name and profile picture inside the app. We do not use Google user data for advertising, we do not sell it, and we do not use it to develop, improve or train artificial intelligence or machine learning models. No human reads it except as needed for security, to comply with the law, or with your consent.
We do not share Google user data with anyone except the service providers listed in this policy that we need to run Tinyping, such as our hosting and database provider. Sign-in tokens issued by Google are stored encrypted and are used only to complete sign-in. We keep Google user data until you delete your account, and you can revoke Tinyping's access at any time in your Google Account settings.
Tinyping's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
What we collect
We collect only what we need to run the service.
- Account data: your name, email address, profile picture if you have one, whether your email is verified, and a password hash if you sign up with email and password. We never store your password in plain text.
- Sign-in and security data: for each session, the IP address, browser and device details (user agent), when it was created and when it expires. We also store one-time email codes (hashed), two-factor authentication secrets and backup codes, and a record of your last sign-in method.
- Event content: the titles, messages, links, tags and other data you or your apps send to the Tinyping API, and the inbox history built from them. We also keep hashed API tokens for your projects.
- Projects and teams: the names of your projects, organizations and teams, your role and membership, invitations you send or receive (including the invited email address), and an audit log of changes such as member invites and removals.
- Push subscription data: the push endpoint URL and encryption keys your browser or device gives us when you turn on notifications.
- Billing data: a customer, subscription and product identifier from Dodo Payments, your plan and the status of your subscription. Dodo Payments acts as Merchant of Record, so it collects your payment details and billing address. We never see or store your card number.
- Logs: request logs and error logs with timestamps, IP addresses and request details, used for security and debugging.
- Support messages: if you email us, we keep the message and your address so we can reply.
How we use your data and our legal bases
We use your data to run Tinyping: to create and secure your account, receive your events, show your inbox, deliver push notifications, bill you, send service emails and prevent abuse. We do not sell personal data and we do not use it for advertising. Where the law asks us to name a legal basis (for example under the GDPR), these are the ones we rely on.
- To provide the service (performance of our contract with you): creating your account, receiving your events, storing your inbox and delivering push notifications.
- To keep the service safe and working (our legitimate interests): security, fraud and spam prevention, bot checks, checking passwords against known breaches, debugging, and improving reliability.
- To bill you (contract and legal obligations): managing your plan and keeping the records tax and accounting rules require, through our payment provider.
- To send service emails (contract and legitimate interests): verification codes, password resets, invitations and important notices about your account. We do not send marketing email unless you ask for it.
- With your consent: when you enable push notifications in your browser, and when you choose to sign in with Google. You can withdraw consent at any time in your browser, your Google Account or your account settings.
Who we share data with
We share personal data only with providers that help us run Tinyping, and only as needed for that purpose. We do not sell your data.
- Amazon Web Services (AWS): hosts our application and our Postgres database in the us-east-1 region (United States) and sends our transactional email through Amazon SES.
- Dodo Payments: acts as Merchant of Record. It handles checkout, payment details, taxes and invoices, and is responsible for your payment data under its own privacy policy. We share your email and name with it to create your customer record.
- Google: if you choose Sign in with Google, Google authenticates you and shares the basic profile data described above with us.
- Cloudflare Turnstile: checks that sign-up and sign-in requests come from people, not bots. It processes limited browser and network signals.
- Have I Been Pwned: when you set a password, a partial hash of it (never the password itself) is checked against a database of known breached passwords.
- Browser push services: notifications are delivered through the push service run by your browser vendor (Apple, Google, Mozilla or Microsoft). They receive the encrypted notification payload and your push endpoint so they can route it to your device.
- Authorities and advisers: we may disclose data when the law requires it or to protect our rights, users or the service.
- Google LLC (Google Analytics), for website usage statistics.
International transfers
Our database is hosted in the United States, and some providers above operate globally. If you are outside the United States, your data will be transferred to and processed there. Where required, we rely on safeguards such as standard contractual clauses, our providers' data processing terms and their security commitments for those transfers.
How long we keep data
We keep data only as long as we need it.
- Event history is shown for 7 days on the Free plan and 1 year on the Pro plan. After that, events are removed from your account and permanently deleted within 6 months.
- Account data: kept while your account is open.
- Push subscriptions: kept until you turn notifications off, the browser reports the subscription as expired, or you delete your account.
- Account deletion: when you delete your account, we delete your account data, events and push subscriptions. Backups roll off on their normal schedule.
- Logs: kept for a limited period for security and debugging, then deleted.
- Billing records: Dodo Payments keeps transaction records for as long as tax and accounting law requires.
Security
We use encryption in transit (HTTPS) and managed, access-controlled infrastructure. Passwords are stored as hashes, API tokens are stored hashed, one-time codes are stored hashed, and Google sign-in tokens are stored encrypted. Push payloads are encrypted for delivery to your device. Access to production data is limited to what is needed to run the service.
No system is perfectly secure, and we cannot guarantee absolute security. If we learn of a breach that affects your data, we will notify you and the authorities as the law requires.
Your rights
Depending on where you live, you may have rights over your personal data, including under the GDPR and similar laws. We aim to honor these requests for everyone.
- Access: ask for a copy of the personal data we hold about you.
- Correction: ask us to fix data that is wrong. You can edit your name and email in your account settings.
- Deletion: delete your account in the app, or ask us to delete your data.
- Export: ask for your data in a portable format.
- Objection and restriction: ask us to stop or limit certain uses.
- Withdraw consent: turn off notifications in your browser, revoke Tinyping in your Google Account, or delete your account, at any time.
- Complaint: contact your local data protection supervisory authority if you are unhappy with how we handled a request.
- To make a request, email hello@tinyping.app from the address on your account. We will reply within a reasonable time, and within any period the law sets.
India: Digital Personal Data Protection Act, 2023
If you are in India, you have the rights described above under the Digital Personal Data Protection Act, 2023, including the right to access, correct and erase your personal data, the right to grievance redressal, and the right to nominate another person to exercise your rights in the event of your death or incapacity.
Grievance officer: Neeraj, hello@tinyping.app. We will acknowledge your grievance and respond within 30 days. If you are not satisfied, you may complain to the Data Protection Board of India.
Children
Tinyping is not meant for children under 16, and we do not knowingly collect their data. If you believe a child has given us personal data, contact us at hello@tinyping.app and we will delete it.
Changes to this policy
We may update this policy. When we make material changes, we will update the date at the top and, where appropriate, notify you by email or in the app.
Contact
Questions or requests about this policy: hello@tinyping.app.
Neeraj, Noida, Uttar Pradesh, India.