Privacy policy

1. Information we process

Account information includes your email address, authentication identifiers, and profile information you provide, such as your name and avatar. We also process organization membership, invitations, application settings, and content submitted through the console.

When an application integrates Indiana, its operator may send customer identifiers, profile attributes, tags, events, subscription and entitlement information, and transaction or usage records. The operator determines what it sends and is responsible for its own privacy disclosures and lawful use of the service.

Our infrastructure also processes technical information needed to deliver and protect the service, including request and security logs, device and browser information, errors, and performance measurements.

2. Sign in with Google

Google sign-in requests only openid, email, and profile permissions. Google provides an account identifier, email address and verification status, and available basic profile information such as your name and profile picture. Supabase Auth processes this information and the authentication credentials needed to establish your Indiana account and session.

We use Google sign-in information to authenticate you, identify your account, and display your profile. This login integration does not request access to Gmail, Google Drive, contacts, or calendars. We do not sell Google sign-in data, use it for advertising, or use it to train AI models.

Our use and transfer of information received from Google APIs follows the Google API Services User Data Policy, including its Limited Use requirements where applicable. You can revoke the connection in your Google Account settings; revoking access does not automatically delete information already held in your Indiana account.

3. How we use information

We process information to operate accounts and workspaces, enforce permissions, deliver configured growth experiences and commercial features, provide support, diagnose failures, prevent abuse, and meet applicable legal obligations. Customer data submitted by an application is processed to provide the features configured by that application's operator.

4. Service providers and disclosure

We use Supabase for authentication and database hosting, Vercel for application hosting and site monitoring, and Upstash for Redis-backed caching and request controls. Google handles Google sign-in. Email and payment services may process information when the corresponding features are configured. Providers receive the information needed for their role in delivering the service.

Workspace information is available to members according to their permissions. We may also disclose information when necessary to comply with applicable law or to protect the service and its users. Infrastructure providers may process information outside your country; our current Supabase projects are hosted in the United States.

5. Cookies and monitoring

We use essential cookies for sign-in sessions, security flows, workspace selection, and language preferences. Authentication session cookies are HttpOnly. Production monitoring uses Vercel Analytics, Speed Insights, and error reporting to understand service usage and reliability. Our monitoring filters authentication handoffs and removes query strings and fragments from reported page URLs.

6. Security and retention

We use HTTPS, server-side credential handling, and tenant access controls to protect information. No system can guarantee absolute security. We keep information for as long as needed to provide the service and support security, dispute resolution, and applicable recordkeeping obligations. Limited records and backups may remain after an account or data deletion request while those purposes still apply.

7. Your choices and requests

Contact victor@tinkerland.ai to request access, correction, export, or deletion of your account information, or to ask a privacy question. We may need to verify your identity and authority before acting. Available rights depend on applicable law. If your information was submitted by an application using Indiana, contact that application's operator first so it can handle your request and instruct us as appropriate.

8. Children and policy changes

The Indiana console is designed for business users and developers, not for children. Contact us if you believe a child has supplied personal information through a console account. We will update this page when our practices change and revise the effective date. A new use of Google data requiring additional consent will be disclosed before that use begins.