Privacy policy

Effective date: November 11, 2026

The short version

What you write is saved on your device first. The app works without an account, and then nothing you write leaves your device.
With an account, your data is also stored with our database provider (Supabase) so it can sync between your devices. Only your account can read it.
No ads. We do not sell your data or share it for advertising. No tracking cookies and no outside analytics.
Moods, feelings and patterns in your journal can be health data. We use them only to run the app for you. See our Consumer Health Data Privacy Policy.
You can download everything, and delete your account and its cloud data, from Settings at any time.

Who we are

Tiny Engine is run by Cam Mitchels, an individual doing business as Tiny Engine ("we", "us"). We are the "controller" of the personal data described here. Contact for anything in this policy, including privacy requests: [email protected].

This policy covers the Tiny Engine app and website. Our Terms also apply.

What we collect, and why

1. On your device only (with or without an account)

Your journal pages, check-ins, moods and feelings, goals, systems (habits) and their runs, notes, maps, seeds (including photos, voice memos, sketches and files you add), to-dos and settings are stored in your browser's storage on that device. An optional Journal passcode is stored only as a salted, slow hash. If you turn on Face ID or fingerprint for the Journal lock, your device makes a passkey that never leaves it; we never receive your face, fingerprint or passcode.

If you never create an account, we do not receive any of this.

2. With an account

Account details: your email address and password. Supabase handles sign-in and stores the password only in hashed form. We also keep the date you agreed to our health data terms. Why: to create your account, sign you in and send sign-in and password emails.
Your content: everything listed in section 1 (except the Journal passcode and passkey), including media files. Why: to store it safely and sync it between your devices.
Reminder settings, only if you turn reminders on for a device: that device's push address (given by your browser), your time zone, the times you chose, how many of today's steps are left and their names, whether you checked in today, and a one-sentence finding from your Insights for the weekly reminder. Why: to send the reminders you asked for, with the right words, at the right time.
The Brain (optional): if you open the Brain while signed in, the titles and text of your notes and maps (up to about 1,000 characters each) are turned into number patterns ("embeddings") by a model that runs inside our own Supabase project. No outside AI company receives your text. The embeddings are stored with your account. Why: to place related ideas near each other and suggest links.
Link previews (optional): when you save a web link as a seed, the link may be sent to our server so it can fetch that page's title and picture. Why: so the seed is easy to recognise.
App error log: up to 20 short technical error messages (for example "could not read property x in file y"), when they happened, and the app version. They are designed not to contain what you wrote. Why: to find and fix bugs.
Five dates: the day you signed up, finished setup, made your first system, came back the next day, and came back in your first week. Dates only, never content. Why: to learn, in total across all accounts, whether the app helps people keep going.
Payments (when the Plus plan is available): Stripe collects your card or other payment details directly. We receive only your subscription status, plan, renewal date and the country used for tax, and may see the card brand and last four digits. We never see or store full card numbers. Why: to provide the plan you paid for and keep required tax and accounting records.
Messages you send us: your email address and what you write to support. Why: to answer you.

3. Collected automatically by our hosting providers

Like any website, Cloudflare (which serves the app's files) and Supabase receive technical data with each request: IP address, browser type, the address requested and the time. They use it to deliver the service and protect it from abuse, and keep it briefly in their logs. We do not use it to profile you.

What we do not collect

We do not track your location (the app blocks it), use advertising identifiers, use tracking cookies or pixels, or run third-party analytics. Insights and "Ask me a question" are worked out on your device from your own data.

How we use it

Only to provide and improve the app for you: saving, syncing, reminders, the features you turn on, billing, support, keeping the service secure, and meeting legal obligations. We do not use your content to train AI models, and we do not look at your content, except when you ask us to help with a problem, to investigate abuse or a security issue, or where the law requires it.

Legal bases (EU, UK and similar laws)

Contract: storing, syncing and showing your data, reminders, billing and support are needed to provide the service you signed up for.
Consent: health-related information you choose to record (such as moods and feelings), reminders, and the optional Brain and link preview features. You can withdraw consent at any time by turning the feature off, deleting the data or deleting your account.
Legitimate interests: keeping the service secure, fixing errors (error log) and understanding in total whether the app helps (five dates). These are minimal and never include your content.
Legal obligation: tax and accounting records for payments, and answering lawful requests.

Who receives data (our service providers)

We use these providers ("processors") to run the app. Each may only use the data to provide its service to us, under a data processing agreement.

Supabase (database, sign-in, file storage, server functions; servers in the United States): your account details, synced content and files, reminder settings, embeddings, error log and the five dates.
Cloudflare (hosting the app's files and website): technical request data such as IP address and browser type. It does not receive your synced content.
Resend (sending email from [email protected]): your email address and the email we send you (sign-in links, password resets, account and billing notices).
Stripe (payments, when Plus is available): your payment details, email, billing country and subscription details. Stripe is also an independent controller for some data it must keep to prevent fraud and meet financial laws; see Stripe's own privacy policy.
Your browser's push service (for example Apple, Google, Microsoft or Mozilla), if you turn reminders on: it carries the text of each reminder to your device. This is part of how your browser works; we do not choose it.

We may also disclose data if required by law or valid legal process, to protect someone's safety, or as part of a transfer of the app to a successor (for example a company formed to run it), in which case this policy continues to protect your data. We do not sell personal data, and we do not "share" it for cross-context behavioral advertising.

How long we keep it

Your content: for as long as you keep your account, or until you delete it. Deleted items stay in Trash for 30 days, then are removed.
Delete account (Settings › Sync across devices) deletes your account, synced content, files, reminder subscriptions and embeddings from our database straight away. Copies in our providers' routine backups expire on their schedule (for Supabase, typically within 7 to 30 days depending on our plan) and are not restored except to recover from a disaster.
Payment records: kept as long as tax and accounting laws require (usually up to 7 years), even after you delete your account.
Support emails: up to 2 years after the conversation ends.
Hosting logs: kept by Cloudflare and Supabase for short periods under their own policies.
On your device: until you delete it, clear the app's data, or choose "Also erase everything on this device" when deleting your account.

How we protect it

All traffic is encrypted (HTTPS/TLS). Data is encrypted at rest by our database provider.
The database itself enforces that each account can only read and change its own rows and files (row-level security).
Strict browser security rules (a Content Security Policy) stop the app from loading code from anywhere else.
Passwords are hashed by Supabase; the Journal passcode is hashed on your device.
Administrator accounts for our providers use strong passwords and two-factor authentication, and access is limited to the operator.

Your content is not end-to-end encrypted: the operator has administrator access to the database, though we do not look at your content except as described above. The Journal lock is a privacy screen on your device, not encryption. No system is perfectly secure; please use a strong, unique password.

Your rights and choices

Everyone can, at any time and for free:

Access and export: Settings › Backup downloads everything (including files) in an open format.
Correct: edit anything in the app, including your email address.
Delete: delete single items, or your whole account in Settings.
Withdraw consent: turn off reminders, the Brain or other features; delete the data.

Depending on where you live (for example the EU, UK, California, Washington, Colorado, Virginia and other US states), you may also have the right to know what we hold and how we use it, to restrict or object to processing, to data portability, to appeal a decision we make about your request, and not to be treated differently for using your rights. Email [email protected] from the address on your account. We will confirm your identity (usually by replying to that address), and answer within 30 days (45 days where US state law allows, extendable once where the law permits). You may use an authorized agent where the law allows. If we refuse a request, you can appeal by replying to our answer with "Appeal"; if you are still unhappy, you may contact your state attorney general or your local data protection authority.

California (CCPA/CPRA): in the last 12 months we collected the categories of identifiers (email), customer records, commercial information (subscription), internet activity (technical request data), sensitive personal information (account login, and health-related information you choose to record), and inferences you see in Insights (made on your device), for the business purposes described above. We do not sell or share personal information, and we use sensitive personal information only to provide the service you asked for, so no "Do Not Sell or Share" or "Limit" link is needed.

Children

Tiny Engine is not meant for anyone under 18, and we do not knowingly collect personal data from children under 13 (or under 16 in the EU and UK). If you believe a child has given us data, email us and we will delete it.

International transfers

We are based in the United States and our providers store data mainly in the United States. If you use Tiny Engine from elsewhere, your data is transferred to the US. Where the law requires, these transfers are protected by our providers' Standard Contractual Clauses (and the UK addendum) or the EU-US Data Privacy Framework, where a provider is certified.

Cookies and local storage

We do not use advertising or analytics cookies. The app uses your browser's local storage, IndexedDB and a service worker only for things it needs to work: your data, your settings, keeping you signed in, and working offline. Because these are strictly necessary, there is no cookie banner. Clearing your browser's data for the app removes them (and any data not yet synced).

Do Not Track and Global Privacy Control

We do not track you across websites, so there is nothing for a Do Not Track signal to turn off. We honour Global Privacy Control (GPC) signals as a request to opt out of sale and sharing, which we never do anyway.

If something goes wrong

If we learn of a security breach that affects your personal data, we will tell you by email without undue delay, and notify regulators where the law requires (for example within 72 hours under the GDPR, and within the time limits of Washington and other US state laws), with what happened, what data was involved and what you can do.

Not a health service

Tiny Engine is a self-reflection tool, not therapy or medical care. If you are in crisis or thinking about harming yourself, call your local emergency number. In the US, call or text 988 (Suicide & Crisis Lifeline) or call 911.

Changes to this policy

If we change this policy, we will update the effective date above. If a change is significant (for example a new kind of data or a new provider that receives your content), we will tell you in the app or by email before it takes effect, and ask for your consent where the law requires.

Contact

Cam Mitchels, doing business as Tiny Engine. Email: [email protected] (privacy requests, legal notices and everything else).