Privacy policy

When you sign in we store your email address. If you sign in with Google, Google tells us your email address, name and profile picture; we only use the email address to identify your account. We never see your Google password.

We store the links you create — the short link, where it points, and any name, tags or preview you add — and the workspaces you belong to.

Redirects set no cookies. For links owned by an account, each click records the time, the visitor’s country (from Cloudflare), the referring website (domain only), a rough device and browser type, the network’s ASN, and whether it looked like a bot. We don’t store IP addresses or full user-agent strings with clicks. Links that haven’t been claimed by an account record no clicks at all.

We set cookies only to keep you signed in, to remember which anonymous links your browser made (so you can claim them later) and to remember your active workspace. To limit abuse, we count anonymous link creations and page-preview fetches per IP address for up to two days.

Our website pages (not redirects) use Google Analytics configured with no client-side storage and anonymised IP addresses, to understand which pages people visit.

We use these providers to run tap.je, and share only what each needs:

• Cloudflare — hosting, redirects and image storage
• Supabase — database and sign-in
• Resend — sign-in and invite emails
• Stripe — payments (we never see your card number)
• Google — optional sign-in and website analytics

Account data and links stay until you delete them or ask us to delete your account. Anonymous links expire 30 days after they’re made unless claimed. Deleting a link deletes its click history.

You can ask us for a copy of your data, to correct it, or to delete your account and everything in it. Email hi@10kb.co and we’ll reply within 30 days.

If this policy changes in a way that matters, we’ll update the date above and, for significant changes, email account holders.