Privacy Policy

Tivero is currently a beta service. It is provided for testing purposes, and behaviour, data structures, and policies (including this one) may change without notice. Please do not store sensitive or critical information in Tivero while it is in beta.

Tivero ("we", "our", "the service") is an independent, individually operated note-taking application accessible at tivero.co. For privacy questions, contact us at [email protected].

We collect the minimum information needed to operate the service:

• Account data — your email address, display name, and (when you sign in with Google) your Google profile name and email.
• Authentication tokens — short-lived session cookies issued by our authentication provider (Supabase Auth) so you stay signed in between visits.
• Content you create — notes (title, tags, body), folders, notebooks, and files you upload. We treat this as private to your account.
• Subscription metadata — if you upgrade to a paid plan, our payment processor (Stripe) holds your billing details; we only store the identifier and current plan/status returned by Stripe.
• Operational logs — request URLs, IP addresses, and error traces kept short-term for debugging and abuse prevention.

We do not use third-party analytics, advertising trackers, or cross-site tracking pixels. We do not sell, rent, or share your personal data with marketers.

• To provide and maintain the service (sign-in, storage, sync).
• To process payments and manage subscriptions (via Stripe).
• To send essential service emails (sign-up confirmation, password reset).
• To debug issues and protect against abuse (rate limiting, fraud).
• To comply with legal obligations when required by law.

Your content and account records are stored on Supabase infrastructure in the European Union (Ireland). Files you upload (up to 25 MB each) are stored in the same region. The application itself runs on Railway. Payment processing is handled by Stripe. Crash diagnostics are processed by Sentry GmbH in the European Union (Frankfurt) — see section 5a for details.

We rely on these providers' security practices in addition to our own. All of them are bound by industry-standard data-processing agreements.

To detect and fix bugs we use Sentry (Sentry GmbH, Germany) as a sub-processor. Data is stored exclusively in Sentry's EU region.

What Sentry receives:

• Crash metadata only — error type, stack trace, browser / OS version, and the URL path where the error happened.
• Session replays of error moments — recorded for the seconds around a crash so we can reproduce it. All text and inputs are masked client-side before anything leaves your browser, all media is blocked, and the user is shown as anonymous. Your note content is never transmitted.

We do not enable Sentry's default PII collection (IP addresses, cookies, request headers are stripped). Sensitive strings such as email addresses and tokens are additionally scrubbed before sending.

Tivero uses cookies strictly for authentication and remembering your UI preferences (theme, sidebar width). We do not use cookies for advertising, cross-site tracking, or analytics.

Notes are private by default. If you generate a share link for a note, anyone with that link can view the note (read-only). You can disable the link at any time. Optional password protection and expiry are available.

You can at any time:

• Edit your profile or delete individual notes/files.
• Request a copy of your data (export Markdown / PDF per note or ZIP per notebook).
• Request full account deletion by emailing [email protected]. We will delete your data within 30 days.

If you are an EU/UK resident you have additional rights under GDPR (access, rectification, erasure, restriction, portability, objection). Contact us at the email above to exercise them.

Notes you delete go to Trash and remain there for 30 days, after which they are permanently removed. Version snapshots are retained up to the most recent 30 per note. Account data is kept while your account is active and deleted within 30 days of an account-deletion request.

Tivero is not directed at children under 16. If you believe a child has provided us with personal information, please contact us so we can remove it.

As Tivero is in beta, this policy may change. The "Last updated" date at the top will always reflect the current version. Material changes will be communicated through the app or by email when reasonable.

For any privacy question, write to [email protected].