Privacy Policy

This policy explains what personal data Unfaded collects, why, and the choices and rights you have. Unfaded (“we”, “us”) is operated by Tiny Agency ApS (CVR 44 55 56 89), Denmark. We are the data controller for the personal data described here. Questions: privacy@unfaded.io.

What we collect

• Account data: your email address, and (if you sign in with Google) the basic profile your Google account returns to sign-in.
• Content you save: the links, notes, text, images, titles, tags, and related metadata you add to your library.
• Technical data: limited request logs and IP address, used to keep the service running securely and to rate-limit abuse.
• Cookies: only strictly-necessary cookies that keep you signed in. We do not use advertising or third-party tracking cookies.

Why we use it, and our legal basis

• To provide the service (store and show your library, authenticate you) - performance of our contract with you.
• Security and abuse prevention (rate limiting, logs) - our legitimate interest in keeping the service safe.
• Essential emails (sign-in links, account notices) - performance of our contract with you.
• Product-update emails - only if you opt in; based on your consent, which you can withdraw at any time.

Where your data is stored

Your account and content are stored in the European Union (our database, file storage, and authentication run on Supabase in the eu-west-1 region, Ireland). Some service providers below may process limited data outside the EU (for example, email delivery); where that happens it is covered by appropriate safeguards such as the EU Standard Contractual Clauses.

Service providers (sub-processors)

We share data only with providers that help us run Unfaded:

• Supabase - database, file storage, and authentication (EU region).
• Vercel - application hosting and content delivery.
• Resend - sending sign-in and (if opted in) product emails.
• Google - only if you choose to sign in with Google.
• Cloudflare - bot/abuse protection on the sign-in form.

We do not sell your personal data.

How long we keep it

We keep your data while your account exists. When you delete your account (Settings → Privacy & data), your items, images, tags, and API keys are deleted immediately; routine backups are rotated out shortly after.

Your rights

Under the GDPR you can access, correct, export, delete, restrict, or object to the processing of your data, and withdraw consent at any time. You can export your data and delete your account yourself in Settings, or email privacy@unfaded.io. You also have the right to complain to your data protection authority (in Denmark, Datatilsynet).

Security

Data is encrypted in transit. Each account's data is isolated at the database level so one user can never read another's. API keys are stored only as hashes.

Children

Unfaded is not intended for children under 16.

Changes

If we change this policy we will update this page and the date above. For anything else, contact privacy@unfaded.io.