Privacy Policy

Last updated: April 2026

1. Data Controller

TinyX ("we", "us", "our") is the data controller responsible for your personal data. If you have questions about how we handle your data, contact us at privacy@tinyx.co.

2. What We Collect

Account information: email address, username, and hashed password.

Link analytics: when someone clicks a shortened link, we collect the visitor's IP address, country, city, device type, operating system, browser, user agent string, and referrer URL.

File metadata: file names, sizes, and upload timestamps. We do not access the contents of your files. End-to-end encrypted files are encrypted in your browser before upload — we store only ciphertext.

Payment information: billing is handled by Stripe. We do not store credit card numbers. We retain your Stripe customer ID and subscription details.

3. Purpose of Processing

• Service delivery: operating the link shortening, file sharing, questionnaire, and analytics features
• Analytics: providing you with click and visitor statistics for your links
• Billing: processing payments and managing subscriptions
• Communication: transactional emails (password resets, payment receipts, service notifications)

4. Legal Basis

We process your data on the following legal bases:

• Contract performance: processing necessary to deliver the Service you signed up for
• Legitimate interest: analytics, security monitoring, and service improvement
• Consent: where required, such as optional marketing communications

5. Third-Party Processors

• Cloudflare — infrastructure (Workers, D1 database, R2 storage, global CDN)
• Stripe — payment processing
• Resend — transactional email delivery

6. Data Storage

Your data is stored on Cloudflare's global network infrastructure. Files are stored in Cloudflare R2. End-to-end encrypted files are encrypted in your browser before upload and are never accessed or decrypted by us.

7. Retention

Link analytics logs are retained based on your subscription tier:

• Free tier: 7 days
• Pro tier: 90 days
• Max tier: 365 days

Account data is retained until you delete your account. After account deletion, your data is purged within 30 days.

8. Your Rights

You have the right to:

• Access your personal data
• Rectify inaccurate data
• Delete your account and data
• Export your data in a portable format
• Restrict processing in certain circumstances
• Object to processing based on legitimate interest
• Data portability — receive your data in a structured, machine-readable format

To exercise any of these rights, contact privacy@tinyx.co.

9. Cookies

We use only essential cookies for session authentication. We do not use tracking cookies or third-party cookies. For more details, see our Cookie Policy.

10. Children

TinyX is not intended for use by anyone under the age of 16. We do not knowingly collect data from children. If you believe a child has provided us with personal data, please contact us and we will delete it.

11. Changes

We may update this Privacy Policy from time to time. Material changes will be communicated via the email address associated with your account.

Contact

For privacy-related questions, contact us at privacy@tinyx.co.

Back to home