Privacy

Who we are

Tabard is run by Alik Elimkhajiyev, in Astana, Kazakhstan. When this notice says “we”, that’s who it means, and he decides how the data below is used. For anything on this page, write to alike010000dev@icloud.com.

Visiting tabard.dev

The site sets no cookies and loads no analytics, ad pixels or other trackers. Its fonts are served from tabard.dev itself. Vercel, our host, receives your IP address and browser details to deliver each page, as any web host does.

When error tracking is switched on, a page that breaks sends Sentry a report: the error, the page’s address without its query, and your browser type. Cookies, headers and anything you typed are removed before the report leaves your browser.

Asking for access

The form asks for your website or App Store link and your email. We use them to decide on your request and, if we accept it, to email you an invitation. The link also suggests your workspace’s name. Nothing else: no newsletter, and we don’t pass them on.

• If we decline, we delete the request.
• If we accept, we delete it 30 days after we create your workspace.
• Any request is deleted 12 months after it arrives.

To stop scripts flooding the form, we accept 10 requests an hour from one IP address. For that we keep a keyed hash of the address, made with a secret only our server holds, and a count, and delete both within two days after the hour ends.

Using the app

Members are the people at our customers’ companies who log in to app.tabard.dev. For them we hold:

• your name and email, for your account;
• login codes we email you, which last 10 minutes and are stored encrypted, and invitation links, which last 7 days and are stored as a hash;
• keyed hashes of your email and IP address, with counts, so nobody can guess login codes, deleted within two days after their window ends;
• a session cookie that keeps you logged in until you log out or go 30 days without using the app, and a record of that session with the IP address and browser it started from. Logging out deletes the record, and an expired one is deleted within a day;
• two cookies that remember your layout: whether the sidebar is open, and how wide you made the editor’s panels;
• what your workspace makes: business profiles, the sources you upload or link (websites, App Store pages, brand books, screenshots), experiences and their versions, and what you ask the AI.

We use this to run the service for your company: to log you in, build and host your experiences, and answer your emails. The app has no analytics or ad trackers of its own. Pages that show a customer’s brand, such as business profiles and the editor, load the brand’s fonts from Google Fonts, so Google sees your IP address.

To build business profiles and experiences, we send your sources, the pages we read from your website, and your instructions to AI models through Vercel AI Gateway. Today the models come from OpenAI, and from TypeSafe for some checks.

A workspace’s data stays while the workspace exists. When an Admin deletes it, it’s archived for 90 days in case that was a mistake, then deleted for good, members’ accounts included. Deleted data can stay in our database host’s restore history until that history rolls over, at most 30 days. To have your own account removed sooner, email us.

Visitors to our customers’ experiences

Our customers publish experiences with Tabard: quizzes, onboarding flows and forms, at their own address. If you reached one from an ad or a link, the business that published it decides what it collects and why, and we store and process that data on its behalf. Send questions and requests about it to that business. Its forms link its privacy policy when it has given us one.

What we keep for the business: the steps you saw, the answers you gave, what you typed into its forms, your country and region, device and language, the page and the ad that brought you, and, where ad pixels are allowed, the ad’s click ID and your browser type. Depending on where you are, your visit is remembered with a cookie (in the US), only in the browser tab (in the EU, the UK and most other countries), or not at all. The page loads the brand’s fonts from Google Fonts. Ad pixels load only if the business turns them on, and outside the US only after you agree. Visit data is deleted after 25 months, or sooner if the business deletes it.

Who else handles it

These companies handle data for us, only to provide their service:

• Vercel hosts the site and the app, runs our server code in Washington, D.C., stores uploaded files, and passes requests to AI models through its AI Gateway.
• Neon runs our database, in Amazon’s US East region (Virginia).
• Resend sends our emails, from the US East region.
• OpenAI and TypeSafe provide the AI models.
• Google serves our customers’ brand fonts (Google Fonts) on experiences and on the app’s brand pages.
• Sentry receives error reports, when error tracking is switched on.

Where it’s kept

Everything we keep is stored in the United States, whichever country you’re in, and our server code runs there. Vercel and Google may deliver pages and fonts from servers nearer to you. For people in the EU, the UK and Switzerland that’s a transfer out of Europe. Our providers’ data processing terms cover it, using the standard contractual clauses the European Commission approved for these transfers.

Why we’re allowed to

• Access requests: you asked us to consider one.
• Members’ accounts and workspace content: we need them to provide the service your company uses.
• Rate limits, session records and error reports: our legitimate interest in keeping the service secure and working.
• Visitors to experiences: the business that published the experience decides, and we follow its instructions.

Your rights

Wherever you live, you can ask us to:

• show you the data we hold about you, or send you a copy;
• correct it;
• delete it;
• stop using it for a purpose you object to.

Email alike010000dev@icloud.com. We reply within 30 days, and may ask you to confirm the address is yours. If you’re unhappy with our answer, you can complain to the data protection authority where you live.

If you live in California, you have the right to know what personal information we collect about you and to have it deleted, and we won’t treat you differently for asking. We don’t sell or share personal information, in the sense California law gives those words.

Children

Tabard is a tool for businesses and isn’t meant for children. Our terms don’t allow experiences aimed at them.

Changes

When this notice changes, the date at the top changes too. If a change affects how we use members’ data, we email members before it takes effect.