Privacy Policy
This explains what personal data Tape Parrot collects, why, who else handles it, how long we keep it, and your rights. We collect as little as the service needs, and we don't sell or share personal data for advertising.
Who is responsible for your data
The data controller is Michal Tara, trading as Tape Parrot (a sole trader in the UK). Contact: support@tapeparrot.com. Our postal address is on the Contact page. We're registering with the Information Commissioner's Office (ICO) and will publish our registration number here once it's issued.
What we collect and why
| Data | Why | Lawful basis (UK GDPR) |
|---|---|---|
| Your email address; your name and profile picture if you sign in with Google; and, during the private beta, which invite code you signed up with | To create your account and sign you in, and to know which group of beta invitations an account came from | Contract — needed to provide the service you asked for |
| Your settings, watchlists, alert rules (including any webhook address you enter), alert history, and push-notification subscriptions | To run the features you set up | Contract |
| Your plan, and whether emails to you are bouncing | To give you the features you're entitled to, and stop emailing an address that doesn't work | Contract; legitimate interests (keeping our email deliverable) |
| Billing: when paid plans are available, the customer and subscription IDs Paddle gives us — never card details | To match your payment to your account | Contract |
| Messages you send us through the contact form or by email | To answer you, including account-deletion and data requests | Legitimate interests (handling your enquiry); legal obligation for data-protection requests |
| If you join the waitlist: your email address | To email you once when sign-up opens to everyone | Consent — you asked us to; withdraw it any time (see Your rights) |
| Feedback you send with the in-app Feedback button: your message, the page you sent it from (without any web address details after the page name), an email address if you choose to give one, and your account if you're signed in | To find and fix problems and improve the service, and to reply if you left an address. The message and page (never your email address or account) are forwarded to us by email. | Legitimate interests (running and improving the service) |
| Your IP address (on each request to our API, when you request a sign-in link, use the contact form, join the waitlist, send feedback, or enter an invite code) and the email address you enter to sign in — held only as a scrambled (hashed) key in a counter that expires within 24 hours | To stop abuse of the sign-in and contact forms, which send email, and to stop any one visitor overloading the service | Legitimate interests (security and preventing abuse) |
| Technical server logs and error reports: which page or route was requested, when, whether it worked, and any error, with your browser type for errors in the browser — not your IP address | To keep the service running and secure | Legitimate interests |
| Anonymous usage statistics (see Analytics below) | To understand which features are used, so we can improve them | Legitimate interests |
We don't make decisions about you by automated means that have legal or similarly significant effects. We don't use your data for marketing. If we ever send marketing email, we'll only do so with your opt-in consent, and every such email will let you unsubscribe.
AI features
AI features (“Why it matters”, catch-up summaries, daily briefings, and automatic tagging) send public headline text only to our AI provider, Anthropic. They never send your email, account, watchlists, alert rules or anything else about you.
Who else handles data
These providers process data on our behalf, under contracts that require them to protect it:
| Provider | What for | Where |
|---|---|---|
| Hetzner Online GmbH | Hosting: our servers, database, and self-hosted analytics all run here | Germany (EU) |
| Resend | Sending email — sign-in links, alerts, account email, and forwarding feedback to us | EU sending region; Resend is a US company. Transfers are covered by the UK standard contractual clauses in Resend's data processing agreement. |
| Porkbun | Our domain name, and forwarding email sent to our support address | United States. Porkbun protects these transfers with standard contractual clauses. |
| Google (Gmail) | The mailbox our support email is forwarded to | United States. Google LLC is certified under the UK Extension to the EU–US Data Privacy Framework. |
| Sentry (Functional Software, Inc.) | Error reports: when something breaks on our servers or in your browser, the technical details of the error. We remove email addresses, IP addresses, account identifiers and cookies before a report is sent. | EU data region (Germany); Sentry is a US company. Transfers are covered by the standard contractual clauses and the UK Addendum in Sentry's data processing agreement. |
| Anthropic | AI features — receives public headline text only, never personal data | United States (no personal data is sent) |
Some organisations handle data about you as independent controllers, under their own privacy policies:
- Paddle (Paddle.com Market Limited) sells our paid plans as merchant of record. When you buy, you give your payment details to Paddle, not to us.
- Google, if you choose “Continue with Google” to sign in.
- Your browser's push service (for example Google, Mozilla or Apple), if you turn on push notifications. Notification content is encrypted in transit to it.
- The owner of any webhook address you add to an alert rule, which receives the matching alerts.
How long we keep it
- Account data, settings, watchlists, alert rules and alert history: until you delete your account.
- Sign-in links: until used, or 24 hours at most. Sign-in sessions last up to 30 days.
- Abuse-prevention counters: 24 hours at most.
- Technical server logs: 14 days. Error reports: 30 days.
- Contact-form and support emails: as long as needed to deal with your request, and up to 2 years after.
- Waitlist: until we've emailed you that sign-up is open, then deleted within 30 days — and never more than 12 months after you joined.
- Feedback: 12 months, or until you delete your account if you sent it while signed in.
- News headlines (not personal data): 90 days.
Your rights
You can ask to access, correct, delete or move your data; to restrict or object to how we use it; and to withdraw any consent you've given. We'll respond within one month (extendable by two more for complex requests, in which case we'll tell you).
- Export or delete your data yourself from your account page. Deleting your account removes your account data, settings, watchlists, alert rules, alert history, push subscriptions, feedback you sent while signed in, and any waitlist entry for your address.
- On the waitlist, or sent feedback without an account? Ask us to remove it through the contact form (“Privacy or data request”) or email support@tapeparrot.com.
- Can't sign in? Ask for deletion or anything else through the contact form (“Delete my account / data”) or email support@tapeparrot.com. We may need to confirm you control the email address first.
- You can complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113. We'd appreciate the chance to put things right first.
Tape Parrot is not for anyone under 18, and we don't knowingly collect their data.
Cookies and storage on your device
UK law (the Privacy and Electronic Communications Regulations) covers cookies and anything else a site stores on or reads from your device. Here is everything Tape Parrot stores:
| Name | Type | What it does | How long |
|---|---|---|---|
| __Secure-authjs.session-token | Cookie | Keeps you signed in. Only set when you sign in. | Up to 30 days |
| __Host-authjs.csrf-token | Cookie | Protects the sign-in form against cross-site request forgery | Until you close your browser |
| __Secure-authjs.callback-url | Cookie | Remembers where to return you after signing in | Until you close your browser |
| __Secure-authjs.pkce.code_verifier, __Secure-authjs.state | Cookie | Secure the Google sign-in flow — only if you use it | 15 minutes |
| tp_invite | Cookie | Only during the private beta, if you follow an invite link or enter an invite code: holds the code until your account is created | Up to 24 hours; removed when your account is created |
| tp_seen | Cookie | Set only when you click “Open the tape”: remembers that choice, so the site address opens the app instead of the introduction page. Contains no identifier. | 1 year |
| juicebox:layoutPrefs, juicebox:squawk | Local storage | Your panel layout and voice-squawk settings — choices you made | Until you clear them |
| juicebox:lastActiveAt | Local storage | When you last had the tape open, so it can offer to catch you up on what you missed. It only leaves your device if you click “See what you missed”, as the start time of that summary. | Until you clear it |
| Service worker (/sw.js) | Browser script registration | Lets you install Tape Parrot as an app and receive push notifications if you turn them on. It doesn't cache pages or track you. | Until you clear site data |
| umami.disabled | Local storage | Only if you opt out of analytics below: remembers your choice | Until you clear it |
Why there's no cookie banner. Each item above is either strictly necessary for something you asked for (signing in, security) or remembers a choice you made yourself — the kinds of storage the law allows without asking for consent first. We don't use advertising or cross-site tracking cookies. An earlier version of the app kept a local-storage flag that existed only for analytics; we removed it rather than ask you to consent to it.
Analytics
We count visits with Umami, which we run ourselves on our own server in Germany — no analytics company receives your data. It uses no cookies and stores nothing on your device. For each page view it records the page address (without any query string), the page title, the referring site, your browser and operating system, device type, screen size, language setting and country. Your IP address is used to work out the country and to tell visits apart through a scrambled identifier that changes over time; the IP address itself is not stored. We see only totals.
Analytics is switched off automatically if your browser sends a “Do Not Track” signal. You can also turn it off for this browser here:
Security
All traffic is encrypted (HTTPS). Sign-in uses one-time links or Google — we never hold a password for you. Our servers are in Germany. To report a security problem, see the Contact page.
Changes
We'll update this policy when what we do changes, and tell you by email or in the app about any significant change.