Privacy Policy

View Terms of Service

tidepin (the "Company") takes user privacy seriously and complies with applicable law. This Policy explains what personal information the Company collects, how it is used and stored, and what rights users have.

Article 1 (Personal Information Collected and Collection Methods)

1. At registration (Google login)

• Required items: email address, name, profile image, Google account unique identifier (provider/uid)
• Collection method: automatically collected via Google OAuth 2.0 authentication

2. When connecting a Pinterest account

• Items collected: Pinterest account unique identifier, Pinterest username, access and refresh tokens (stored encrypted), token expiration times, IDs of your Pinterest boards (board names are read from Pinterest when shown, not stored)
• Collection method: collected via Pinterest's official OAuth 2.0 API, requesting permission to read your account, read and create boards, and read, create and delete pins. We create a board or delete a pin only when you ask us to — for example with Suggest boards or Clean up. The Company never collects or stores a user's Pinterest password.

3. When connecting a site or shop

• Items collected: the URL of the site a user registers, and content already publicly posted by that site via its sitemap (sitemap.xml) or public feed — including post URLs, titles, prices (if available), and image URLs. For a Shopify store, its public product list; for an Etsy shop, its listings read through Etsy's official API. For a topic project, the topic, keywords and link you enter.
• Collection method: periodically checking the public sitemap/feed of a user's registered site. The Company does not access a site's admin login information or private backend data — only information that is publicly accessible to anyone is collected.

4. At payment

• Items collected: subscription status, and customer/subscription identifiers assigned by the payment processor (Paddle)
• The Company does not directly collect or store credit card numbers or other payment method information. Payment information is collected and processed directly by Paddle.com Market Limited as the Merchant of Record.

5. Information automatically generated while using the Service

• Generated pin images and copy, AI-generated photos, scheduled publishing times, publishing results (success/failure), account health determination history, access logs, cookies (see Article 5)
• Pin performance numbers (impressions, saves, clicks) are read from Pinterest when you open Analytics and are not stored.

6. Content you upload

• Items collected: photos you upload to your image library or as pins, and the rows of CSV files you import (such as image links, titles and keywords)

7. When you contact support

• Items collected: the subject and messages you write, any screenshots you attach, the page you were on when you opened the form, and your browser's name and version (user agent)
• Collection method: entered by you in the Service's Contact support form

8. When you try the pin preview without an account

• The page address you enter is used once to make the preview and is not stored. To limit how often the preview can be used, we count tries for 10 minutes under a scrambled form of your IP address that can't be turned back into the address. We never store the address itself.

9. When you invite a team member or create an API key

• Team invites: the email address of the person you invite
• API keys: the name you give the key and its first few characters. API keys are stored only as a one-way hash — the full key is shown to you once and is not kept.

10. If you add your own AI key

• Items collected: your OpenRouter API key (stored encrypted) and the AI model you choose. You can remove them in Account settings › AI model at any time.

11. If you join the early list before we open

• Items collected: your email address, and later whether you used your early-list price
• We use it only to email you once when tidepin opens, with your early-list price. We delete it 30 days after that email, or right away when you use the "Remove me from the list" link.

Article 2 (Purposes of Collection and Use)

1. Member identification and maintaining login sessions (email, Google identifier)
2. Authentication to publish pins on behalf of a user's Pinterest account, and to create boards and remove pins when the user asks (Pinterest tokens)
3. Automatic detection of new posts and pin generation (site content information)
4. Subscription billing and plan management (Paddle identifiers)
5. Monitoring and warning of Pinterest account suspension risk (publishing success/failure history)
6. Writing pin titles, descriptions and board choices, keyword ideas and AI photos with AI (site content information)
7. Answering support requests (support messages, screenshots, page and browser information)
8. Sending service emails, such as pins ready to review, paused schedules, posting problems, team invites and support replies (email address). Optional emails can be turned off in Account settings › Your account.
9. Telling early-list members when tidepin opens and giving them the early-list price (early-list email address)
10. Responding to service outages, preventing fraudulent use (including limiting how often the preview can be used), and fulfilling legal obligations

Article 3 (Retention and Use Period)

1. As a general rule, the Company destroys personal information without delay once the purpose of its collection and use has been fulfilled.
2. If a user disconnects their Pinterest account, that account's access and refresh tokens are deleted immediately.
3. If a user deletes their account, all personal information — including identifying information such as email — and connected data (sites, content, pins, uploaded and AI-generated photos, Pinterest tokens, payment identifiers, account health history, support requests and their screenshots, team invites, API keys) are immediately and irreversibly deleted.
4. Early-list email addresses are deleted 30 days after the launch email, or when you remove yourself from the list.
5. However, transaction records that applicable law (such as e-commerce or tax law) requires to be retained for a set period will be separately stored for that period before destruction.
6. Two kinds of records stay after account deletion, without your name, email or site names: payment event records (Paddle's subscription and event IDs and what our system did with them), and the log of actions our administrators took. They are kept for accounting and security and no longer connect to an account.
7. Canceling a subscription (stopping payment) without separately deleting the account does not delete the account's data; it remains stored, and only paid features are restricted.

Article 4 (Third-Party Disclosure and Processing Entrustment)

The Company does not provide personal information to third parties without user consent, except in the following case:

• When required by law, or requested by an investigative agency following the procedures set out by law

The Company entrusts the following tasks to provide the Service:

OpenRouter (at your choice): only if you add your own OpenRouter key in Account settings, the same page information we would send to Gemini for pin text is sent to your own OpenRouter account and the AI model you picked, under your agreement with OpenRouter. You can remove the key at any time.

Article 5 (Cookies and Other Automatic Collection Tools)

1. The Company uses essential session cookies to maintain login sessions and for security (CSRF prevention).
2. The Company also uses a few preference cookies that remember screen choices on your browser, such as a notice you closed or a menu you hid. They contain no personal information.
3. The Company does not currently use third-party cookies for advertising or analytics purposes (e.g., ad tracking, retargeting). If analytics tools are introduced in the future, this Policy will be revised and users will be notified in advance.
4. Users may refuse cookies through their browser settings, though this may limit use of the Service, including the ability to log in.

Article 6 (User Rights and How to Exercise Them)

1. Users may request access to, correction of, deletion of, or suspension of processing of their personal information at any time.
2. Users can immediately disconnect Pinterest via the "Disconnect" button within the Service, and delete their entire account (and personal information) via the "Delete Account" feature.
3. Other rights may be exercised by contacting the information below; the Company will act within the period required by applicable law.

Article 7 (Measures to Ensure Security)

1. Authentication credentials for external services, such as Pinterest access and refresh tokens, are stored encrypted.
2. Raw tokens, passwords, and card information are never written to personal information processing logs.
3. Each user's data is isolated and access is controlled so that it cannot be accessed by anyone other than that user.
4. The number of staff handling personal information is minimized, and access is restricted to cases where it is necessary.

Article 8 (Children's Personal Information)

The Service is not directed at children under the age of 14 and is intended for adult users. If the Company becomes aware that it has collected personal information from a child under 14, it will delete that information without delay.

Article 9 (Overseas Transfer of Personal Information)

The Company operates from the Republic of Korea, and the providers the Service relies on keep their servers outside Korea. To provide the Service, the following information is transferred to them:

• When and how: sent over encrypted network connections when you use the feature that needs it (for hosting, whenever the Service stores your information).
• Retention: each recipient keeps the information only as long as it needs to provide its service to us, as set out in its privacy policy. When you delete your account, we delete your information from our hosting and file storage.
• How to refuse: these transfers are needed to provide the Service, so you can refuse them by not using the Service or the feature (or by deleting your account). You can stop the transfer to OpenRouter at any time by removing your key.
• Each recipient's privacy policy, with its contact details:

• Render Privacy Policy: https://render.com/privacy
• Resend Privacy Policy: https://resend.com/legal/privacy-policy
• Google Privacy Policy: https://policies.google.com/privacy
• Pinterest Privacy Policy: https://policy.pinterest.com/privacy-policy
• Paddle Privacy Policy: https://www.paddle.com/legal/privacy
• Cloudflare Privacy Policy: https://www.cloudflare.com/privacypolicy/
• Sentry Privacy Policy: https://sentry.io/privacy/
• OpenRouter Privacy Policy (only if you add your own key): https://openrouter.ai/privacy

Article 10 (Data Protection Officer and Contact)

• Privacy contact: the tidepin privacy team, which handles privacy requests and complaints
• Contact: support@tidepin.com
• For reports or inquiries regarding other rights infringements, users may contact the relevant authority, such as the Personal Information Protection Commission (privacy.go.kr).

Article 11 (Users in the EU, EEA, UK and Switzerland)

1. The operator of tidepin is the controller of your personal information. You can reach us at support@tidepin.com.
2. We process your personal information on these legal bases:
   • performance of our contract with you — your account, sites, pins, publishing, billing and support;
   • our legitimate interests — keeping the Service secure, preventing abuse (such as limiting the preview), and finding and fixing errors;
   • your consent — for choices you make, such as adding your own OpenRouter key; you can withdraw it at any time;
   • legal obligation — keeping transaction records that tax and other laws require.
3. You have the right to access, correct and delete your personal information, to restrict or object to its processing, to data portability (a copy in a commonly used format), and to withdraw consent. Write to us and we will answer within one month.
4. You also have the right to lodge a complaint with the data protection supervisory authority in the country where you live or work.
5. We operate from the Republic of Korea, which the European Commission has recognised through an adequacy decision. Your information is stored and processed by the providers in Article 4, mostly in the United States. Where required, those transfers rely on safeguards such as the European Commission's Standard Contractual Clauses or the EU–US Data Privacy Framework.
6. We do not make decisions about you based solely on automated processing that have legal or similarly significant effects.

Article 12 (California residents)

1. In the last 12 months we collected the categories described in Article 1: identifiers (such as email and account IDs), commercial information (subscription status), internet activity (access logs and support context), and content you provide (sites, pins, uploads). We use them only for the purposes in Article 2.
2. We do not sell or share your personal information, as those terms are defined in California law, and we do not use it for cross-context behavioral advertising.
3. You have the right to know what personal information we hold about you, to correct it and to delete it. You may use an authorized agent. We verify requests through your account email and answer within 45 days.
4. We will not discriminate against you for exercising these rights.

Article 13 (Changes to This Policy)

This Policy may be revised to reflect changes in law, policy, or security technology. Any changes will be announced within the Service at least 7 days before their effective date.

Effective date: This Policy is effective as of October 22, 2026.