Privacy policy

Data controller

Paul Equinet, individual, non-professional publisher. Contact: contact@tinyapp.app, paul.equinet@outlook.fr.

Data processed

• Account: email address, technical identifier, creation and last sign-in dates, optional display name. If you choose "Sign in with Google": the basic information of your Google profile (name, email address, profile picture and account identifier).
• Access to apps: the publisher's apps you have joined and your role in each of them.
• Content: what you create or import in each app, stored separately for each of them.
• Technical data: IP address, browser type, connection and error logs, technical signals of the anti-bot check (Cloudflare Turnstile), chosen language.

Your account is shared by the apps the publisher runs on the subdomains of tinyapp.app: the same email address signs you in to each of them. Each app only accesses its own content: the data you create in one app is not visible from the others.

Purposes and legal bases

• Creating and managing your account, signing you in (sending codes by email, Google sign-in), providing the features of the apps: performance of the terms of use (GDPR art. 6(1)(b)).
• Securing the service and preventing abuse (anti-bot check, limits on attempts, logs): legitimate interest of the publisher (art. 6(1)(f)).
• Measuring audience in aggregate, without cookies or persistent identifiers: legitimate interest (art. 6(1)(f)).
• Backing up the data to restore it after an incident: legitimate interest (art. 6(1)(f)).

No data is sold, nor used for advertising or profiling. No automated decision with legal effects is made. The data received from Google is only used to create your account and sign you in.

Retention

• Account and content: as long as your account exists. When it is deleted, they are erased from the database.
• Encrypted daily backups: 12 weeks at most. Deleted data therefore disappears from the backups within 12 weeks at most.
• Technical logs: a few days, 30 days at most.
• Language cookie: one year.

Recipients, processors and transfers

Your data is only accessible to the publisher and to the following technical providers, who act on the publisher's instructions:

• Supabase Pte. Ltd. (65 Chulia Street #38-02/03, OCBC Centre, Singapore 049513): database, authentication (account, sign-in codes) and file storage. Data hosted in London (United Kingdom), a country recognised as adequate by the European Commission (decision renewed on 19 December 2025). Any access by support staff from other countries is covered by the European Commission's standard contractual clauses.
• Cloudflare, Inc. (101 Townsend St., San Francisco, CA 94107, USA): hosting and running the apps, anti-bot protection (Turnstile), cookieless audience measurement, storage of the encrypted backups. Global network, company established in the United States: transfers covered by the EU–US Data Privacy Framework, under which Cloudflare is certified.
• Resend (Plus Five Five, Inc.) (2261 Market Street #5039, San Francisco, CA 94114, USA): sending the emails that contain sign-in codes. United States: transfers covered by the EU–US Data Privacy Framework and the standard contractual clauses.
• GitHub, Inc. (88 Colin P. Kelly Jr. Street, San Francisco, CA 94107, USA): automated execution of the backups (data passes through it during a backup and is encrypted before being stored). United States: transfers covered by the EU–US Data Privacy Framework, under which GitHub is certified.

If you use "Sign in with Google", Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland) authenticates you as a separate data controller, under its own privacy policy.

Cookies

Only strictly necessary cookies are used, valid on the subdomains of tinyapp.app:

• the session cookie, which keeps you signed in (only if you sign in);
• the "tinyapp_lang" cookie, which remembers the language you chose (English or French) for one year;
• where applicable, technical security cookies of Cloudflare.

No advertising or tracking cookie is used, and audience measurement, when active, uses no cookie. These cookies are exempt from consent (article 82 of the French Data Protection Act): no banner is shown.

Security

Encrypted connections (HTTPS), data access separated by app and by user, passwordless sign-in, encrypted backups whose key is kept offline.

Your rights

You have the rights of access, rectification, erasure, restriction, portability and objection, and the right to set instructions for what happens to your data after your death. To exercise them: contact@tinyapp.app (you get an answer within one month). When the app offers it, you can also export your data and delete your account directly from it.

You can lodge a complaint with the French data protection authority (CNIL, Commission nationale de l'informatique et des libertés), 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, France (https://www.cnil.fr).