Privacy policy

1. Creators

• Account: your email address (for sign-in links and account notices) and your country. You may instead sign in with GitHub or Google; if you do, that service shares your account’s email address and account id with us through Supabase Auth, our sign-in provider.
• Payments: your Stripe connected-account id and its status (whether it can take charges and receive payouts). Stripe collects and holds your identity and bank details; we don’t receive them.
• Tip jars: app names, slugs, an optional supporter message and monthly goal, the colors and text you set for the widget (shown publicly with it), and the totals of tips received.
• MCP token: only a one-way hash is stored; the token itself is shown to you once and never kept.
• Provider API keys: inference-provider keys you add (OpenRouter, Anthropic, OpenAI) are encrypted at rest with AES-256-GCM, used only server-side to read your usage and cost for the burn counter, and never shown back to you, to supporters, or in logs.

2. Supporters

• Card details are entered on Stripe Checkout and processed by Stripe. We never see or store card numbers.
• For each tip we keep the amount, the fees, which app it went to, the time, the Stripe payment reference and, when Stripe passes it to us, your email address for a receipt. The creator you tipped can access the record of that tip; other creators can’t.

3. Visitors and the widget

The widget is served from our domain and sets no cookies. Like any web server we receive the IP address and browser details of each request, which we use only for rate limiting, security and short-lived operational logs. While a tip to a new creator is open in checkout, we keep a keyed hash of your network address (never the address itself) with it, to limit how much of that creator’s new-account allowance one network can hold; it stops counting when that checkout ends (41 minutes at most) and is deleted within a day after that. If you leave such a checkout unfinished, the widget remembers its checkout id in the session storage of the site it is on, for that browser tab only (other tabs never see it, and it is ignored after 31 minutes), so your next tip there replaces it instead of waiting for it to expire. When you tip, the widget sends us the address of the page it is on (or one the site chose), so checkout can link you back to it. From the page address the widget first drops parameters named like a token, a password, a code, an email address or a phone number, or whose value looks like a key; it does not look for contact details anywhere else, so the address we receive can still contain one, such as an email address in the path. Before that address goes to Stripe with the checkout, we remove every parameter named like a secret, a code, an email address or a phone number, and every parameter or piece of the path whose value looks like a key or token, an email address, or a phone number written with a leading + or as a tel:, sms:, callto: or whatsapp: link (the path is cut short at the first such piece), and the part after # unless it is a route within the page; a contact detail in another form, such as a phone number in local format outside such a link, is not removed. We do not log the address we receive. Asking for a sign-in code sets a security cookie that ties the code to this browser; it holds a hash of the email address you entered (not the address itself) and expires after 60 minutes. While that code is valid we also keep the same keyed hash on our server, with a count of attempts, to limit guesses at the code; it is deleted within a day after the code expires. Signed-in creators also get a session cookie that keeps them signed in; it is renewed as they use the site and expires at most 7 days after their last visit. This site also stores your light/dark choice in your browser. So the site can open offline, your browser keeps a copy of our public pages and site files (a service worker and its cache); it holds nothing about you, is replaced on each update, and clearing this site’s data removes it. We don’t use advertising or cross-site tracking.

4. Who processes data for us

• Stripe — payments, payouts and creator identity checks.
• Supabase — database and sign-in.
• Vercel — hosting and request logs.
• Resend — transactional email.
• Cloudflare (Turnstile) — the bot check on the sign-up page, which receives the IP address and browser details of the person using it.
• OpenRouter, Anthropic, OpenAI — only for creators who add a key, and only to read that creator’s own usage.

Some of these providers process data in the United States.

5. Retention

Payment records are kept for as long as accounting, tax and payment-network rules require, even after an account closes. Within that, we remove what we no longer need: a supporter’s email can be erased from a tip record on request, and a creator’s provider keys and token are deleted when they remove them or close their account. Stripe keeps its own record of each payment under its own privacy policy.

6. Your rights

You can ask for a copy of your data, a correction, or deletion where we aren’t required to keep it, and you can object to processing. Write to hello@tab.baby. For a tip, include the email address you paid with and the tip’s date and amount, so we can find it. If you are in the UK or EU you can also complain to your data-protection authority. Our legal bases are performing our contract with you (running the tip jar and processing tips), legal obligations (payment records) and legitimate interests (security and abuse prevention).

7. Security

Data is encrypted in transit; provider keys are additionally encrypted at rest; database access is limited to our server, with row-level security so a signed-in creator can read only their own records. No system is perfectly secure; we will notify affected people of a breach as the law requires.

8. Children and changes

The service is not meant for children under 16. We will post changes to this policy here and update the date above.

Contact

Questions, requests and complaints: hello@tab.baby.