Privacy policy

1. Who is responsible

tivq is responsible for personal data processed to operate the service, manage access, provide support and meet legal obligations. This policy covers the website, API, CLI and local and remote MCP.

When you upload personal data about others, you remain responsible for your purposes and instructions, your authority to share it, and notices to those people. If your organization needs a data processing agreement, contact us before using tivq for that processing.

2. Information we process

• Workspace and access data: workspace names and IDs, key labels, permissions, authentication hashes, publishing identities, timestamps and OAuth authorization records.
• Resources: encrypted payloads and listing metadata, resource types, sizes, expiry settings, revisions, comments and live session events. Feedback may include a chosen display name, quoted text and an annotation location.
• Opening activity: retrieval counts and times, time-based aggregates and up to 50 recent events per resource with a coarse browser, agent or unknown category. These are retrievals, not verified unique people.
• Service operation: aggregate hourly request counts, broad service channels, server error counts and response duration. IP addresses are processed transiently for connections and rate limiting; the application does not retain IPs or raw user agents in opening analytics or these aggregate metrics.
• Support: your email address and information you send when contacting us. For checkout, including sandbox testing, we process a billing email, customer and subscription identifiers, status and minimal transaction records.

3. What encryption protects

The web client, CLI and local MCP encrypt content on your device before upload. Listing titles and content sent through this path are stored encrypted. Default short links also store a per-resource key encrypted with a server-held secret, so tivq can recover the key and serve that resource. They are not a zero-knowledge sharing mode.

Private links keep the resource key in the URL fragment, which is not sent in the HTTP request. Remote MCP is a different processing path: it necessarily receives plaintext and delegated encryption credentials in server memory. Delegated credentials are encrypted at rest. Connected agents and recipients can retain data they receive under their own policies.

Anyone holding a valid share link can retrieve the resource and eligible feedback, and may be able to add comments or answers. Workspace credentials stay in browser local storage or the CLI's local credential file. Do not send credentials in support requests.

4. Purposes and legal bases

We process the data needed to deliver the service you request under our contract with you. Security, abuse prevention and proportionate operational monitoring serve our legitimate interests in keeping the service reliable. Applicable tax, accounting and other legal duties provide the basis for records required by law. Where a processing activity requires consent, we must obtain it separately; consent can be withdrawn without affecting earlier lawful processing. We do not make decisions producing legal or similarly significant effects solely by automated processing.

5. Providers and other recipients

Railway supplies hosting and PostgreSQL infrastructure. Network and hosting providers process technical connection data to deliver and protect their services; their infrastructure logging and backups are separate from tivq's application analytics. See Railway's privacy policy.

Paddle handles checkout and subscription management, including sandbox checkout. It acts as merchant of record for purchases it processes and handles payment details, billing information, tax and fraud checks under its privacy policy. tivq does not need your full card number. Your chosen AI or MCP provider separately processes the data you send to it. We may also disclose information when required by law or necessary to defend legal rights. We do not sell your personal data or use resource content for advertising.

Providers may process data outside your country, including outside the European Economic Area. Such transfers are subject to applicable data protection requirements, which may require an adequacy decision or appropriate contractual safeguards. Contact us for details of the locations and safeguards relevant to your use before uploading data with residency requirements. We do not promise EU-only hosting.

6. Retention and deletion

Expiring resources become inaccessible at expiry and are periodically deleted from the active database with their comments, revisions and live events. Single-read payloads are deleted on consumption; metadata and opening receipts remain until the resource's original expiry. Explicit resource deletion removes those receipts and events too. Authorized resources with no expiry persist until deleted or revoked.

Aggregate site metrics are kept for seven days. OAuth authorization requests last five minutes, authorization codes one minute, access tokens one hour and refresh grants seven days; public client registrations expire after thirty days. Workspace and key records remain while needed to operate the workspace and preserve authorship, subject to deletion requests and legal duties. Support correspondence is kept while needed to resolve the request and any related legal obligations.

Infrastructure backups, transaction logs and legally required records follow their separate retention schedules. Deletion from the active database does not immediately erase every backup or any copy already saved by another person. Disconnecting your browser removes its stored workspace key; it does not delete server-side resources.

7. Cookies and device storage

The web app uses local storage for your workspace credential and reader appearance preference. The private administration area uses a necessary session cookie. The application does not add advertising cookies or third-party tracking analytics. Paddle checkout loads its payment interface and has its own payment-related processing and notices. You can clear browser storage, but should save your access key first if you need to reconnect.

8. Your rights and contact

Depending on applicable law, you can request access, correction, erasure, restriction, portability or object to processing, including processing based on legitimate interests. Contact support. We may request proportionate evidence of identity or workspace control to protect other users; do not send your secret access key. We normally respond within one month, subject to lawful extensions.

You can also complain to the Spanish Data Protection Agency (AEPD) or your competent supervisory authority. Our terms of service explain your responsibilities when publishing and sharing. Changes to this policy will be dated here; material changes will be communicated as required by law.