Privacy Policy

This Privacy Policy explains how Tinycode, Inc. ("Tinycode," "we," "our," or "us") collects, uses, shares, and protects information in connection with our website (Tinycode.io), Platform, and related services (collectively, the "Services"). By accessing or using the Services, you acknowledge the practices described here. If you do not agree with this policy, please discontinue use of the Services.

(1) Information you provide directly, such as your name, email address, and other contact details when you create an account, contact support, or sign up for updates.

(2) Information collected automatically, including device and browser data, IP address, approximate location, and usage patterns (such as which pages or features you interact with). We gather this through cookies, SDKs, and similar tracking technologies.

(3) Account and content data. If you create an account, we store your registration details and any content you submit, upload, or generate through the Services (for example, code snippets, prompts, or project files) so we can operate and improve the product.

(4) Payment information. If you purchase a paid plan or service, payment card details are collected and processed directly by our payment processor; we do not store full card numbers.

We use session and persistent cookies for three main purposes: keeping the Services functioning properly (strictly necessary), remembering your settings and preferences (functional), and understanding how the Services are used so we can improve them (analytics). You can manage or disable cookies through your browser settings, though some features may not work correctly if you do. We do not currently respond to browser "Do Not Track" signals.

We use collected information to operate, maintain, and improve the Services; personalize your experience; provide customer support; communicate product updates or marketing (where permitted); enforce our terms of use; and meet legal obligations, including responding to lawful requests from courts or regulators.

We do not sell your personal information. We may share it in the following circumstances:

• With service providers who help us run the Services, such as hosting, analytics, or customer-support vendors. Each is bound to use the information only as we direct.
• With affiliates, for purposes consistent with this policy.
• In connection with a merger, acquisition, or similar business transaction.
• When required by law.

Our cloud-hosted Services incorporate AI/ML models provided by third-party foundation model providers. Data processed through these features may be transmitted to these providers solely to generate responses. We do not permit providers to use customer data to train their models.

For our cloud-hosted Services, Tinycode's infrastructure is hosted by third-party cloud service providers. Customer data is processed and stored in data centers in the United States (US East) and Germany (Frankfurt). Customers who use an on-premises deployment of Tinycode's products host their data in their own environment, and that data remains under the customer's control and is not transmitted to third-party foundation model providers. For our cloud-hosted Services, data processed through AI-assisted features may be transmitted to third-party foundation model providers whose infrastructure may be in the United States or other jurisdictions. By using the cloud-hosted Services, you acknowledge that your data may be transferred to and processed in jurisdictions outside your own, which may have different data protection laws.

Where you submit or contribute content through the Services, you grant Tinycode a license to host, reproduce, and process that content as necessary to operate, support, and improve the Services. We do not claim ownership of your content, and this license is limited to what's needed to provide the Services to you.

We use administrative, technical, and physical safeguards designed to protect your information. These include encrypting data at rest using AES-256 and encrypting data in transit using TLS 1.2 or higher. No method of transmission or storage is completely secure, so we cannot guarantee absolute security.

We keep personal information and customer data only as long as necessary for the purposes for which it was collected, unless a longer period is required by law or by our legal or contractual obligations. For example, financial records are retained for a minimum of seven years in accordance with applicable regulatory requirements. We review our retention practices at least annually.

We perform regular backups of the Services to protect against data loss. Backups are retained for 30 days, so data that has been deleted from our active systems may remain in encrypted backups for up to 30 days before it is permanently removed.

When data is no longer needed or has reached the end of its retention period, we securely dispose of it. Data on active systems is permanently removed using secure deletion methods, and storage media that is no longer in use is physically destroyed.

In the event of a data breach affecting your personal information, we will notify affected parties in accordance with applicable law and our contractual obligations.

The Services are not directed to children under 13, and we do not knowingly collect personal information from them. If you believe a child has provided us with personal information, please contact us so we can disable the account and delete the data.

Depending on where you live, you may have rights to access, correct, or delete your personal information, or to object to certain uses. California residents may also have rights under the California Shine the Light law regarding disclosures for direct marketing. To exercise any of these rights, contact us using the details in Section XIII.

The Services may link to third-party websites or tools we don't control. We aren't responsible for their privacy practices, and we encourage you to review their policies separately.

Qualified Tinycode customers may request enablement of a Zero Data Retention ("ZDR") mode for supported AI-assisted coding features. This section applies only to customers with ZDR specifically enabled by Tinycode.

When ZDR is enabled: prompts and model-generated responses processed sessions are handled in real time and are not stored by Tinycode after the response is delivered, except where retention is required by law or to investigate suspected misuse of the Services. ZDR is enabled per-account and must be separately activated by Tinycode; it is not a default or self-service setting and does not automatically extend to new organizations created under the same account. Certain administrative data, such as account emails, seat assignments, and aggregate usage or productivity metrics, continues to be retained under our standard retention practices even when ZDR is active, since this data is necessary for billing and account administration. Features that inherently require server-side storage of conversation content, such as shared session history, cross-device sync, or in-product feedback submission, may be unavailable or limited for accounts using ZDR, since enabling those features would require retaining prompt or response data. Some underlying AI models may require standard data retention to function and may therefore be unavailable to ZDR-enabled organizations. If a session is flagged for a suspected violation of our usage policies, Tinycode may retain the associated prompts and responses for a limited period (up to 2 years) to investigate and address the violation, consistent with our standard enforcement practices. Customers who wish to enable ZDR should contact their Tinycode account representative to confirm eligibility and complete enablement.

We may update this policy from time to time to reflect changes in our practices or legal requirements. We'll post any changes here and update the "Last Updated" date above.

If you have any questions about this privacy policy, the data we hold on you, or you would like to exercise one of your data protection rights, please contact us at support@tinycode.io.