TidalUI privacy notice

Information we process

Website visits

Cloudflare hosts and protects TidalUI. It processes ordinary connection and request information, such as IP address, request details, device and browser information, and security signals. We use Cloudflare Web Analytics to understand page views and website performance. Its performance beacon processes page and referring-page URLs and loading information without using browser cookies or local storage for that beacon.

The storefront keeps theme, search, preview, and any source-access key you enter in page memory. It does not place a source-access key in the page URL or browser local storage. With your optional consent, we use the X advertising pixel on public marketing pages to measure visits and purchases. It receives page and permitted campaign information and, after a verified live purchase, the plan price, currency, and an opaque conversion identifier. X may also process connection, browser, device, and cookie information. We do not send X your email, phone number, passwords, card details, account identifiers, or agent keys. We exclude account, authentication, password-reset, and protected-source pages from the advertising script.

Accounts and support

Supabase provides account authentication. We process your normalized email address, password or one-time authentication proof, Supabase account identifier, authentication status, and session information to create and protect your account. Passwords pass securely to Supabase for authentication; TidalUI does not store readable passwords or include them in application logs. If you choose Google sign-in, Google and Supabase process your basic profile and verified email to authenticate you. This does not authorize access to Gmail or Google Drive. Resend delivers authentication email for Supabase. TidalUI connects your verified Supabase account to purchases and source access using internal ownership records; our application database does not keep a separate copy of the Supabase email directory.

Google Workspace processes messages you send to support@tidalui.com, including your email address, message, attachments, and delivery information. We use those messages to provide support and handle privacy requests.

Purchases and access

Stripe hosts Checkout and related payment services. For transactions using Stripe Managed Payments, Sold through Link, LLC is the merchant of record and TidalUI remains the seller of the digital product. Stripe and Sold through Link process payment, billing, tax, refund, dispute, fraud, order, fulfillment-status, and transaction-support information. They surface Checkout, receipts, statements, and post-purchase management through Link. Customers may use an existing Link account, create one during Checkout, or check out as a guest. Guests may later be prompted to create a Link account to use order-management tools. Their customer-facing processing is also governed by Stripe's privacy notice.

Stripe and Sold through Link send TidalUI the customer and Checkout identifiers and the subscription, payment, refund, dispute, tax, plan, and status information needed to deliver the product and support the purchase. TidalUI uses that information to derive and store its own access entitlement and stores the associated provider identifiers and statuses, along with the terms version, URL, document digest, and timestamps for the purchase. TidalUI does not store full card details or raw Stripe webhook bodies.

For checkout before sign-in, we use a random, secure HttpOnly guest cookie and store only its digest with an internal purchase owner. After payment, you must possess that cookie and sign in to a verified account to claim access. An email address or a Checkout URL alone cannot claim a purchase.

If you create an agent key, TidalUI shows the secret once. We store its label, owner identifier, secret digest, and creation, expiry, revocation, and last-used timestamps. We do not store readable agent-key plaintext.

Security and operations

We process limited request, network, account, and credential information to authenticate sessions, prevent abuse, rate limit requests, protect source access, and investigate failures. TidalUI reduces rate-limit identifiers to opaque keyed digests before storing counters. Application failure summaries contain fixed error categories, status codes, counts, and timestamps rather than email addresses, sign-in codes, agent-key values, payment payloads, or request headers. Cloudflare and the other providers may keep separate security and delivery records under their systems.

Why we process information

We process account, authentication, purchase, billing, and source-access information as needed to provide TidalUI and perform our agreement with you. Providing the email, account, and billing information needed for the requested account or purchase is contractual; without it, we cannot create the account, complete the purchase, or provide paid access.

We process transaction and related records where needed to meet applicable legal obligations. We process limited security, fraud-prevention, support, reliability, and non-advertising analytics information for our legitimate interests in operating, protecting, supporting, and improving TidalUI, subject to applicable rights. Where applicable law requires consent for a particular activity, we request it before that activity. You may withdraw that consent for future processing at any time.

Optional advertising measurement relies on your consent. You can reject it or withdraw it through Cookie preferences. We treat an enabled Global Privacy Control signal as a refusal of optional advertising tracking.

Automated rules authenticate sessions, rate limit requests, and determine source access from verified account and purchase status. They do not infer purchase ownership from a name, a similar email address, an amount, or a purchase description. Contact us if you believe an account or access status is wrong.

Providers and disclosure

We disclose information to the service providers described above only as needed for their roles:

• Cloudflare for hosting, network security, application infrastructure, database services, and website analytics;
• Supabase for account authentication;
• Resend for authentication-email delivery;
• Stripe and its affiliate Sold through Link, LLC for Checkout, Link, billing, payments, merchant-of-record services, applicable indirect-tax handling, receipts, order and subscription management, fraud, refunds, disputes, and transaction support; and
• Google for optional Google sign-in and Google Workspace for support and privacy-request email; and
• X for optional, consent-based advertising measurement, under X's privacy policy.

Stripe and Sold through Link may act as independent controllers for their customer-facing payment, Link, merchant-of-record, fraud, tax, support, and compliance services and describe that processing in Stripe's privacy notice. We may also disclose information when required by law, to protect rights or security, or in connection with a lawful business reorganization. We do not sell personal information for money. Optional X advertising measurement may constitute sharing for advertising under applicable privacy laws. You can refuse that processing through the cookie controls or Global Privacy Control.

International processing

TidalUI is operated from the United States. The providers above may process information in the United States and other countries where they or their subprocessors operate. Where applicable law requires a safeguard for a restricted international transfer, we use the legally recognized mechanism incorporated into the applicable provider agreement, such as an adequacy framework, the European Commission's Standard Contractual Clauses, or the United Kingdom addendum. Contact us for information about safeguards relevant to your information.

Cookies and similar storage

When accounts are enabled, TidalUI uses secure access and refresh cookies to maintain your session and a first-party cookie to protect account changes against cross-site request forgery. Access and refresh credentials are HttpOnly and unavailable to ordinary page JavaScript; the protection cookie must be readable by the first-party account page. Refresh and protection cookies are configured for 30 days, while the access-cookie lifetime follows the authentication session. Signing out clears local session cookies and may revoke the provider session when the current session and abuse-protection checks permit. Signing out does not delete the account or purchase records.

Cloudflare Web Analytics is separate from those account cookies. The TidalUI storefront does not use browser local storage, session storage, IndexedDB, or a service worker. A secure guest cookie can last up to 30 days and is cleared after a successful purchase claim. Short-lived HttpOnly cookies protect Google sign-in and password recovery. A first-party cookie remembers your optional advertising choice for 180 days. When you accept optional tracking, X may use its own cookies or similar technology; rejecting or withdrawing consent stops future loading of its script. Stripe Checkout and Link may use their own cookies or similar technology for payment, authentication, fraud prevention, analytics, and account features under Stripe's notices.

Retention

We keep account and access records while they are needed to provide active service. We keep transaction, consent, refund, dispute, and related records while needed to fulfill the purchase, meet applicable tax or accounting obligations, prevent fraud, protect security, resolve disputes, or establish, exercise, or defend legal claims. We keep support and privacy-request records while needed to handle and document the request.

We review records when those purposes end and delete or de-identify information that is no longer needed. Providers may keep separate records under their own legal obligations, agreements, backup cycles, and security processes. Stripe and Sold through Link handle valid requests they receive for data in their systems; TidalUI remains responsible for requests it receives about data it controls. A cookie, sign-in code, agent key, or rate-limit window expiring does not by itself delete related account, security, transaction, support, or provider records. Closing an account does not automatically cancel billing, issue a refund, delete Stripe or Link records, or erase every provider copy.

Your choices and rights

Depending on where you live, you may have rights to request access to, correction of, deletion of, restriction of, objection to, or portability of your personal information. Send a request to support@tidalui.com.

For an account-linked request, we use a separate one-use privacy challenge sent only to the email address confirmed by our authentication provider. Do not send us a password, one-time sign-in code, cookie, session token, API key, agent key, or card details. Some requests may be limited where information is needed to provide the service, complete a transaction, protect security, meet a legal obligation, or establish, exercise, or defend legal claims. We will explain the result.

If the GDPR applies, you may also withdraw consent for future processing where consent is the basis, object to processing based on legitimate interests, and complain to the data-protection authority where you live, work, or believe an infringement occurred.

Account access, agent-key revocation, billing cancellation, refunds, account closure, and deletion are separate actions. A privacy request does not automatically cancel a subscription, issue a refund, close an account, or surrender Lifetime access. For a Managed Payments purchase, Sold through Link may apply its own customer refund policy or issue a refund when required by law or its terms, including where that result is more favorable than TidalUI's policy.

Changes to this notice

We will update this notice before materially changing the providers, tracking, purposes, or customer-data practices described here. The updated notice will show its effective date.