TweakToadPrivacy policy
TweakToad lets agencies collect website feedback from their clients and pass approved changes to their AI coding agents. This page explains, in plain language, what data TweakToad handles, why, where it is stored and for how long.
Your account
- Email address. You sign in with a one-time code sent to your email; there is no password. Your email is held by our sign-in provider (Supabase Auth). TweakToad's own tables do not copy it, and other people in a workspace are not shown it.
- Display name. An optional name of 1 to 60 characters that others see next to your comments and actions. You can change it on your account page. Only you can read or change your own profile record.
Agency, project and review content
Agencies create projects for their clients' websites. TweakToad stores what you and your reviewers add: agency and project names, the registered website address, pins, comments, replies, scope decisions, revisions and the requests sent to connected AI agents. Each agency's content is separated from every other agency's at the database level, and only the agency's members and the clients they invite can see it.
Screenshots and other evidence
Reviewers can attach screenshots to a pin. Before anything is uploaded, the reviewer sees the final image and can crop it or black out parts of it. Images are kept in a private storage bucket that is not publicly readable.
- Evidence attached to a pin is kept for as long as its project exists.
- Uploads that were started but never finished are deleted after 24 hours.
- Evidence that has been removed is deleted 7 days later.
- Evidence of a deleted project or agency is deleted within 30 days.
The review script on your website
When an agency installs the TweakToad script on a website, each page load sends one small "installation check" to TweakToad containing only the project id, the website's origin (for example https://example.com, without the page path) and the script version. It sends no cookies and nothing about the visitor. TweakToad keeps only the latest origin, script version and time seen for each project, and deletes it with the project. The script does not send anything to analytics providers.
Guest reviewers
If an agency turns on guest reviews, a reviewer can leave feedback without an account by entering a display name (1 to 60 characters) and, optionally, an email address. A guest's email is stored as unverified and is never used to send email. TweakToad keeps a guest session for at most 7 days in a cookie that only the TweakToad review window can read. If the project has a review password, it is stored only as a one-way hash. To stop password guessing, TweakToad counts failed attempts for 15 minutes using a one-way hash of the project and the visitor's IP address, not the address itself.
Email notifications
TweakToad emails review invitations and "a fix is ready for your review" messages, each with a link back to TweakToad. The recipient's address is looked up at the moment of sending and is not stored with the delivery record. Delivery records are deleted 90 days after they finish; a minimal record (ids, message type, status and times, with no address or message text) is kept for one year and then deleted.
Product analytics
TweakToad uses PostHog to understand how agencies use the product, for example where setup gets stuck. It is not used for advertising.
- In your browser, only after you agree. Signed-in agency members see a consent banner; nothing is loaded or sent from your browser before you choose "Allow analytics", and you can change your choice on your account page. If your browser sends Do Not Track or Global Privacy Control, the banner is not shown and nothing is sent. Invited clients and guests are never tracked in the browser.
- What is sent. Your internal account id (never your email or name), your agency's internal id, page addresses reduced to templates such as /agencies/[agencyId], named product events such as "project created" or "setup step completed", which buttons and controls you use (recorded by element type and position, never their text or what you type), where on a page you click (for heatmaps) and page load speed. Review content, screenshots, comments and agency settings are excluded from this recording, and email addresses and full page addresses are not sent. Session recording and console logs are off, location lookup from IP addresses is turned off, and PostHog sets no cookie.
- From our servers. A small set of the same named product events is also recorded by TweakToad's servers, against internal ids only, whether or not you allowed browser analytics.
Cookies
TweakToad sets only these cookies, none of them for advertising:
| Cookie | Purpose | Lasts |
|---|---|---|
| Sign-in session (sb-…-auth-token) | Keeps you signed in | Until you sign out or the session expires |
| tt_analytics_consent | Remembers your analytics choice | 1 year |
| tt_display_name_prompt_skipped | Remembers that you skipped the display-name question | 1 year |
| tweaktoad-guest-… | Keeps a guest reviewer's session in the review window | At most 7 days |
Where your data is processed
| Provider | What for | Region |
|---|---|---|
| Supabase | Sign-in (Auth) and the PostgreSQL database | Singapore (ap-southeast-1) |
| Google Cloud | Running the app (Cloud Run) and storing screenshots (Cloud Storage) | Singapore (asia-southeast1) |
| Upstash | Short-lived rate-limit counters for AI agent connections | Singapore (ap-southeast-1) |
| Resend | Sending notification email | Tokyo (ap-northeast-1) |
| PostHog | Product analytics, as described above | United States |
Our hosting providers also keep standard request logs, which include IP addresses, to run and protect the service.
Keeping and deleting data
- Agency deletion. An agency owner can delete the agency from its settings. It disappears for everyone at once and is permanently removed 30 days later, together with its projects, reviews and evidence. Only a record of ids and dates is kept to show that the deletion happened.
- Your account. There is no self-service account deletion yet. To have your account and profile deleted, or to ask for a copy or a correction of your data, contact the workspace owner (no legal contact address is published yet).
- Other retention periods are listed in the sections above.
Children
TweakToad is a tool for businesses and is not meant for anyone under 16.
Changes and contact
When this policy changes, the version and date above change too. For questions about privacy, contact the workspace owner (no legal contact address is published yet).