Privacy Policy

Last updated: October 2026 (rev. 9) · Bjørkå Flatin ENK / Tinn

Tinn is a product specification and mood board tool for architects, engineers, interior designers, and builders. This policy explains what personal data we collect, why we collect it, who we share it with, how long we keep it, and what rights you have.

1. Who is responsible for your data

Data controller: Bjørkå Flatin ENK, org. no. 933 152 893, Norway. Contact: privacy@tinn.app

If you have questions about how your data is handled, or want to exercise any of your rights, email the address above. We will respond within 30 days.

2. What data we collect and why

Account and profile data

Email address, required to create an account and send you sign-in links.
Full name and company name, provided by you at registration, used to personalise the interface.
Sign-in provider: we record whether you signed in via email or Google so we can route authentication correctly.

Legal basis: performance of a contract (GDPR Art. 6(1)(b)), these are necessary to provide the service.

Project and specification data

Everything you create inside Tinn: projects, products, mood boards, notes, supplier links, images.
Your project files are stored locally on your device as .tinn files. We do not access your project content except to diagnose technical problems at your request.

Legal basis: performance of a contract (Art. 6(1)(b)).

Onboarding and preference data

Role, project type, team size, and currency preference, collected optionally on first login to personalise the experience.
You can skip this at any time. It does not affect access to the service.

Legal basis: legitimate interest (Art. 6(1)(f)), improving the product for professional users.

Usage and technical data

Basic server logs (IP address, browser type, page visited, timestamp) collected automatically by our hosting provider (Vercel). Retained for up to 30 days.
No third-party analytics scripts on this website (no Google Analytics, no tracking pixels).

Legal basis: legitimate interest (Art. 6(1)(f)), diagnosing errors and ensuring security.

Anonymous usage data (desktop app, only if you say yes)

If you choose “Yes, share usage data” when Tinn asks, or turn it on in Settings, the desktop app sends a short list of anonymous events: when Tinn opens and closes and how long it was open, how many days since you installed it, when a project is created or opened, when a PDF is exported, and which tab you open, plus basic technical facts such as your Windows version and screen size.
It is linked to a random number created on your computer, never to your name, email, or account. It never includes your projects, files, product names, prices, client names, or anything you type. Your IP address is discarded and not stored.
It is off until you say yes, and saying no changes nothing in the app. You can turn it off at any time in Settings.

Legal basis: consent (Art. 6(1)(a)). You can withdraw it at any time in Settings.

Feedback you send from the app (only when you send it)

When you use Send feedback, Tinn sends what you write and the form lists what goes with it. That can be the screen you were on, your Tinn version, your computer’s basic facts, the element you pointed at (its label and value), and a picture of the window if you leave that on.
You choose whether to send it with your name or anonymously. An anonymous report carries no name, email, account or project name, and the picture is off by default.
Reports are stored in the EU (Supabase Stockholm) and read only by us. A picture can show what was on your screen, so look at it before you send.

Legal basis: consent (Art. 6(1)(a)). You choose to send each report.

We do not sell or rent your data. We use the following third-party processors:

Supabase, database, authentication, and file storage. Data is stored in the EU (Stockholm region, eu-north-1). SOC 2 Type 2 compliant.
Vercel, application hosting and CDN. Server logs held for up to 30 days.
Cloudflare, DNS, marketing site hosting (Cloudflare Pages), object storage for binary downloads (R2, EU region), and email routing for hello@tinn.app, support@tinn.app, press@tinn.app. GDPR compliant.
Resend, transactional email (magic links, service notices). Your email address and name are shared.
Stripe, payments for paid plans. Only if you buy one: Stripe handles your payment details and we keep a customer reference.
Sentry, error and crash reporting. Device type, OS version, anonymised stack traces, and IP address may be shared when a crash occurs.
PostHog, product analytics, EU Cloud (Frankfurt). Only if you turn on usage data in the desktop app: the anonymous events described in section 2. No project content is shared.
Google, optional “Sign in with Google”. If you use this, Google shares your name, email, and profile picture with us. Governed by Google’s own privacy policy.

One optional service we do not run: Photoroom. The desktop app can send a product photo to Photoroom for sharper background removal. This is off by default. It only works if you turn on cloud cleanup in Settings and add your own Photoroom API key, and even then an image is only sent when you right-click that one image and choose “Re-clean with cloud service”. The image goes straight from your computer to Photoroom and the cleaned image comes back; it never passes through Tinn’s servers and we never see it. Because it runs on your own Photoroom account, Photoroom’s own terms and privacy policy apply to it.

All processors are required by contract to process your data only on our instructions and to protect it in accordance with GDPR.

4. How long we keep your data

Account and profile data, kept for as long as your account exists. When you delete your account they are removed straight away, and copies in our database backups are gone within 30 days.
Project data (local), stored on your device as .tinn files. Tinn does not control or delete local files.
Server logs, up to 30 days, then automatically deleted by Vercel.
Anonymous usage data, kept for up to 12 months, then deleted.
Feedback reports, kept for up to 24 months, then deleted. Ask us at any time to delete a report sent with your name.

You delete your account yourself in the desktop app: Settings → Account → Delete account. You need to be signed in, and you confirm by typing your email. Deletion is permanent and cannot be undone.

What is deleted: your account and profile, your clips and everything else stored online (including anything from the old web app), feedback you sent with your name and its pictures, the browser extension’s access, and the clip library on the computer you delete from.
What stays: your .tinn project files, which are not touched. Feedback you sent anonymously and anonymous usage data, which cannot be linked to you. Payment records such as receipts and invoices, which bookkeeping law requires to be kept. If someone else’s project lists you as a contact, that entry stays with their project. Server logs follow the time limit above.
Paid plans: deleting your account ends a paid plan at once. You are not charged again, and there is no refund for the time left.
If the app cannot finish it: an account with a payment record or older images stored online cannot yet be deleted from the app alone. Tinn tells you so and deletes nothing. Email privacy@tinn.app and we will do it by hand within 30 days.

5. Cookies and local storage

Session cookie (sb-*), set by Supabase to keep you signed in. Expires after 30 days of inactivity.
Auth marker cookie (tinn_auth), a lightweight indicator used by our server to route you correctly. Contains no personal data.

No advertising cookies. No cross-site tracking. No consent banner is shown because we only use strictly necessary cookies.

6. International data transfers

Your data is primarily stored within the EU (Supabase Stockholm, Cloudflare EU). Vercel may route requests through servers in other regions as part of its CDN, but does not persistently store personal data outside the EU. Any transfers outside the EEA are covered by Standard Contractual Clauses (SCCs).

If you are in the EU/EEA, you have the following rights:

Access, request a copy of the personal data we hold about you.
Rectification, ask us to correct inaccurate data.
Erasure, ask us to delete your data. You can also do this yourself via Settings → Account → Delete account.
Data portability, request your data in a machine-readable format by emailing privacy@tinn.app.
Restriction, ask us to pause processing while a complaint is pending.
Objection, object to processing based on legitimate interest.
Withdraw consent, where processing is based on consent, you may withdraw it at any time without affecting the lawfulness of prior processing.

To exercise any right, email privacy@tinn.app. We will respond within 30 days. You also have the right to lodge a complaint with the Norwegian Data Protection Authority: Datatilsynet (datatilsynet.no), or the supervisory authority in your country of residence.

8. Security

We implement industry-standard security measures: HTTPS everywhere, row-level security on the database, scoped API keys, and rate limiting on sensitive endpoints. No system is perfectly secure; if you discover a vulnerability, please report it to privacy@tinn.app.

9. Children

Tinn is a professional tool intended for adults. We do not knowingly collect data from anyone under 16. If you believe a minor has created an account, please contact us and we will delete it promptly.

10. Changes to this policy

We may update this policy. If changes are material, we will notify registered users by email at least 14 days before they take effect. The “last updated” date at the top always reflects the current version.

Questions? privacy@tinn.app · Terms of Service