Privacy Policy

1. Account and sign-in data

We process your account identifier, email and verification status, display name, selected language and time zone, and avatar if provided. Password sign-in stores a cryptographic password hash. Social sign-in stores the provider identifier and information needed to authenticate or connect it. An available Google or Telegram profile photo may be imported if you do not already have an avatar.

We use these records to provide the account and requested features and protect access. Contractual necessity supports providing the account; proportionate security and abuse prevention are also our legitimate interests where applicable law recognizes that basis.

2. Devices and connected apps

Security records can include device type, OS and browser names, approximate country, sign-in date and your chosen device label. Country is a network-based estimate and can be wrong, including with a VPN. Session display records do not store a full IP or raw browser user agent; infrastructure providers may separately process technical requests and security logs.

An app receives the identity attributes and permissions needed for its connection, such as account identifier, verified email and supported profile preferences. Its business content remains separately scoped. Access grants help you recognize and end related access. Session details are removed with the session record.

3. Balance and purchase records

Balance entries, usage quantities, app and operation references, and relevant payment, refund and support references are used to supply usage, explain balances, prevent duplicate fulfilment and handle disputes. The bases are performance of the requested service, applicable legal recordkeeping duties and proportionate fraud prevention.

For a purchase through Paddle, Paddle processes payment as Merchant of Record under its own privacy notice. Lava processes RUB payments under its own privacy notice. The selected payment service receives the buyer email and payment details required for checkout. We receive the transaction and fulfilment information needed for credits and support. We do not need or request full payment-card details.

4. Email, support and marketing

Amazon Web Services Simple Email Service (Amazon SES) delivers enabled account emails, including verification, recovery and security notices. These messages provide and protect the account; unsubscribing from marketing does not stop them.

Resend processes support mail. Messages and attachments are relayed to a private Telegram group for authorized support staff; a restricted archive supports follow-up. We process correspondence to answer your request and, where appropriate, for legitimate interests in resolving service or security issues. Do not send passwords, verification codes, full card details or unnecessary sensitive app content to support.

News, offers and new-app announcements require a separate optional marketing choice. Registration or social sign-in does not subscribe you. We record the choice, language, notice version, time, source, verification and preference history. Change your preference in your account or unsubscribe through an email link without signing in. Withdrawal does not affect earlier lawful processing.

5. Providers and international processing

Vercel provides hosting and Neon provides the account database. AWS provides enabled transactional-email infrastructure. Resend and Telegram support the email-support workflow. Google and Telegram process chosen sign-in under their own policies. Pwned Passwords receives only the first five characters of a SHA-1 password hash for compromised-password checking, not the password or email.

Providers may process information outside your country. A service region does not locate every provider or support operation there. Applicable data-protection and transfer requirements still apply. Contact us for information about relevant recipients and transfer arrangements. We do not sell account data or use app content to build advertising profiles.

6. Data controller and contact

The controller for the Tiny Crew account and website processing described here is Individual Entrepreneur Daniel Tcytkin (ID 343575410), registered in Georgia. Contact support@tinycrew.app for privacy enquiries and data requests.

For independently stored app content, identify the application so your request can be handled under its notice and appropriate access checks. Sharing an email address does not authorize disclosure of another person's records.

7. App content and AI

This account website does not itself collect therapy recordings, health notes or other business content from connected apps. A shared balance does not grant account administrators unrestricted access to those records. Each application explains its content processing, AI providers, permissions and retention.

Review the app's processing notice and choices before sending content to AI. Recording permissions, sensitive-data consent and other feature requirements are separate from registration. This notice does not promise that every AI provider retains no data or that every app uses identical settings.

8. Cookies and analytics

Necessary cookies support sign-in and security. Cookies and local storage also remember language, the last successful sign-in method and your dated analytics choice. That choice is remembered for 180 days. Clearing storage may require signing in again. Cookie settings do not control email marketing.

With your consent, Google Analytics 4 measures public-page visits and limited events such as app interest and registration starts. Advertising personalization and Google Signals are disabled in our settings. We do not send emails, form contents, conversations, URL queries or fragments. Account, recovery, verification and administration pages are excluded. Google may process technical browser/device data and use analytics cookies lasting up to 180 days. Reject analytics or withdraw consent through footer Cookie settings: collection stops and accessible analytics cookies are removed. Withdrawal does not automatically erase previously collected data.

9. Retention and deletion

Account records are kept while needed for the account. Temporary proofs and links have limited validity. Eligible deletion includes a 30-day cancellation period and a stated scheduled date. Normal access is restricted while pending. Physical cleanup follows the scheduled process and may need legal, financial or other dependencies resolved rather than occurring instantly at the deadline.

Purchase, audit and security records may be retained for legal obligations, fraud prevention or establishing and defending claims. Support correspondence is kept as needed for the enquiry and related issues. Restricted backup copies can remain until replaced under retention schedules. App content follows the relevant app policy.

Earlier launch-notification requests are separate from registration. Those emails are used only for the requested notification, based on consent, until withdrawal or delivery and no longer than 12 months after signup.

10. Choices and privacy rights

You can edit supported profile settings, review sign-in methods and sessions, change marketing preferences and request deletion through account controls. Contact support@tinycrew.app for access, correction, deletion or other requests. We may proportionately verify identity to protect the account.

Depending on applicable law, you may also have portability, restriction, objection, consent-withdrawal and complaint rights with a competent data-protection authority. We respond without undue delay and within the applicable legal period. For requests under EU or UK GDPR, the usual period is one month; we explain any lawful extension and its reason within that first month. We explain any lawful exception that limits a request. Account support does not require waiving mandatory rights.

11. Security, age and changes

The service is for adults aged 18 or over. Contact us if you believe a child supplied account data. We use access restrictions and technical and organizational safeguards; no system guarantees absolute security. Report suspected misuse promptly.

We publish changes with an updated date and give additional notice where required. Changing this notice does not authorize a new optional purpose without its required choice or legal basis.