Privacy policy
Effective date: August 21, 2026
Last updated: August 31, 2026
Version: 2026-08-31
TinyBond is a pre-launch project of TinyBond LLC, a Massachusetts limited liability company in the United States. This policy covers the TinyBond website at tinybond.app and its waitlist. It does not cover the TinyBond app, which is not yet available. When the app launches, it will have its own privacy policy.
The controller of the data described here — the one who decides why and how it is used — is TinyBond LLC, Massachusetts, United States, hello@tinybond.app.
For Brazil, our data protection officer (encarregado, LGPD Article 41) is [to be appointed — placeholder], reachable at [address to be added — placeholder].
If you have any question about this policy or your data, write to us at hello@tinybond.app.
What we collect
If you join the waitlist, we collect one thing: your email address, which you give us voluntarily through the waitlist form.
If you just visit the site, we don't collect anything that identifies you personally. Analytics cookies (described below) collect some technical data, and only after you consent.
Why we collect it
We use your email address to tell you when TinyBond launches and to send occasional pre-launch updates. That's it. You can unsubscribe at any time using the link in any email, or by writing to hello@tinybond.app.
The legal basis for each thing we do
| What | Legal basis |
|---|---|
| Keeping your email address and writing to you about the launch | Your consent — GDPR Article 6(1)(a), LGPD Article 7(I). You give it by submitting the form, and can withdraw it at any time. |
| Analytics cookies and the data Google Analytics collects | Your consent — GDPR Article 6(1)(a) and Article 5(3) of the ePrivacy Directive, LGPD Article 7(I). Given through the cookie banner. |
| Serving the site at all — the two items of local storage that remember your language and your cookie choice | Our legitimate interest in operating the site, GDPR Article 6(1)(f), LGPD Article 7(IX). These are strictly necessary and exempt from the consent requirement. |
Withdrawing consent does not undo what was lawful before you withdrew it, but it stops everything from that moment on.
Cookies and analytics
The site uses one third-party tool:
Google Analytics helps us understand how people use the site. It uses cookies and collects device identifiers, approximate location, and page interactions (which pages you visit, how long you stay, what you click). This data is shared with Google. Google also uses some of it for its own purposes — to run and support the Analytics service and, in aggregated form, for industry benchmarks — as described in How Google uses information from sites or apps that use our services.
We run no advertising tools at all. There is no Meta Pixel, no retargeting tag, and nothing on this site that follows you anywhere else. If we ever add one, this policy changes first, the version at the top moves, and every visitor is asked again before a single tag loads.
Analytics does not load until you consent through the cookie banner — not a delayed version, not a cookieless one. If you decline, the site still works normally, and only strictly necessary storage is used. You can change your choice at any time through Cookie settings in the footer of every page.
What we never send them. No names, no email addresses, nothing typed into a form. The address of the page is stripped of anything after the "?" before it reaches Google, so a link that ever carried an address or a token could not pass one on. We do not use Google's User-ID feature, we keep Google Signals switched off, and we have not enabled any advertising feature inside Analytics.
We also honor the Global Privacy Control browser signal: if your browser sends it, analytics is treated as declined the moment you arrive, whatever you may have chosen here before.
The Cookie Policy lists every cookie by name, what it does, and how long it lasts.
Who we share data with
We do not sell your data. We share it only with the service providers we need to run the site:
- Supabase stores the waitlist (servers in the United States)
- Google hosts the website and provides our email service (Google Workspace) and analytics, as described above
These providers process data on our behalf or for the purposes described in this policy. We don't share your email with anyone else.
We do not sell or share personal information, ever. That includes the broad meaning California's CPRA and the state laws written after it give to "sharing" — disclosing personal information for cross-context behavioral advertising, even where no money changes hands. We run no advertising tags, so that kind of sharing does not happen here. Analytics on its own is not sharing.
Where your data lives
Your data is stored and processed in the United States — by Supabase (the waitlist) and by Google (hosting, email, analytics).
If you are in Europe or the United Kingdom, that is a transfer outside your own jurisdiction, and Chapter V of the GDPR governs it. Google LLC is certified under the EU–US Data Privacy Framework and its UK extension, and our arrangements with our providers also rest on the European Commission's Standard Contractual Clauses.
If you are in Brazil, the same transfer happens when you submit the form, and Article 33 of the LGPD governs it. We rely on the contractual safeguards above and, for the waitlist itself, on your specific consent — which is what you give by submitting the form, and which you can withdraw at any time.
How long we keep it
Your email address: until you unsubscribe or ask us to delete it. If you unsubscribe, we stop emailing you.
Analytics data: Google Analytics is set to keep event and user data for 14 months from your last visit — the longest a standard Analytics property allows — after which it is deleted automatically. We chose the maximum because it is the shortest setting that still lets us compare one year to the next, which is the whole reason we look at it. It sits inside the 25-month benchmark France's CNIL uses for analytics, and we consider it no longer than necessary under both the GDPR and the LGPD.
The _ga cookie: 13 months, rather than the two-year default, which is the CNIL's benchmark for a cookie of this kind.
Every one of these is listed again, per cookie, in the Cookie Policy.
Your rights
Wherever you are, you can ask us at any time to:
- confirm whether we process your data
- access the data we hold about you
- correct it if it's wrong
- delete it
- withdraw your consent
- tell you who we share it with
To exercise any of these, email hello@tinybond.app. We'll respond as quickly as we can, and we won't charge you or make you create an account to ask.
If you are in Europe or the United Kingdom
The GDPR gives you the rights of access, rectification, erasure, restriction of processing, data portability (a copy in a machine-readable format), and objection to processing based on legitimate interests. You may withdraw consent at any time without affecting what was lawful beforehand. You also have the right to lodge a complaint with a supervisory authority — your own country's data protection authority, or the ICO if you are in the UK.
If you are in Brazil
Article 18 of the LGPD gives you the right to ask us for:
- confirmation that we process your data at all
- access to it
- correction of anything incomplete, inaccurate or out of date
- anonymisation, blocking, or deletion of data that is unnecessary, excessive, or processed outside the law
- portability to another provider
- deletion of data processed on the basis of your consent
- information about the public and private bodies we have shared it with
- information about what happens if you refuse consent, and what your options are
- revocation of consent, at any time and by a free and straightforward procedure
Our data protection officer (encarregado) is named at the top of this policy. If you believe your rights have not been respected, you may also complain to the Autoridade Nacional de Proteção de Dados (ANPD), the Brazilian supervisory authority, at gov.br/anpd.
If you are in the United States
This section covers California's CCPA/CPRA and the comparable laws in Colorado, Connecticut, Virginia, and the other states that have followed.
Categories of personal information we collect. Identifiers — your email address, if you give it to us, and the pseudonymous cookie identifiers described above. Internet or network activity — pages viewed, time on page, referring site, and general device and browser information. Approximate geolocation — city-level at best, inferred from IP address by Google Analytics; we never collect precise location. We collect no other category: no financial information, no biometric data, no health information, no contents of communications.
Sources and purposes. Everything comes either directly from you, or from your browser as you use the site. We use it to run and improve the site, and to email you about the launch if you asked.
Do we sell or share it? We do not sell personal information, and we never have. We do not "share" it for cross-context behavioral advertising in the specific sense those laws use, because we run no advertising tags on this site. We do not knowingly sell or share the personal information of anyone under 16.
Sensitive personal information. We do not collect any, and so we do not use or disclose any for purposes that would trigger a right to limit it.
Your rights are to know, to access, to delete, to correct, to opt out of sharing, and not to be discriminated against for exercising any of them. Nothing on this site is withheld, slowed, or priced differently based on your choices — there is nothing to withhold.
How to exercise them. Use "Cookie settings" in the footer of any page to turn analytics off immediately, with no account and no form to fill in. For access, deletion, or correction of a waitlist entry, email hello@tinybond.app. We honor the Global Privacy Control signal as a valid opt-out, applied automatically on arrival, and we apply it to every visitor rather than only to those in states that require it. You may use an authorised agent; we may ask them for proof that you appointed them.
Children
This site is for adults. We do not knowingly collect data from anyone under 18. If you believe someone under 18 has joined the waitlist, write to hello@tinybond.app and we will delete the entry.
Emails and unsubscribing
Every email we send identifies TinyBond LLC as the sender and includes a working unsubscribe link. We honor unsubscribe requests promptly, as required by US law (CAN-SPAM).
Changes to this policy
If we change this policy, we'll update the date and the version number at the top. The version number is the same one recorded with your cookie choice, so if it changes, the banner asks you again rather than assuming an old answer still stands. If the change is significant — for example, if we start collecting something new — we'll tell waitlist subscribers by email before it takes effect.
Contact
TinyBond LLC
Massachusetts, United States
hello@tinybond.app