Privacy Policy
Last updated: 31 October 2026
1. Summary
- TweakTick stores what is needed to run client reviews and approvals. We don't sell personal data and we don't show ads.
- No tracking cookies. We use only the cookies needed to keep you signed in, so there's no cookie banner.
- For the work and comments inside a workspace, the agency is in charge of the data (the "controller") and TweakTick handles it on its behalf (the "processor").
- Approval records are kept even after deletion, because they are a record of what was agreed.
2. Who we are
TweakTick is run by TERRANOAH ECOM VENTURES (OPC) PRIVATE LIMITED, D/1401 Kanakia Sevens, Andheri Kurla Road, Marol Naka, Mumbai, MH 400059, India.
Contact for privacy questions, requests and complaints (including our grievance contact under India's Digital Personal Data Protection Act, 2023): [email protected].
3. Our two roles
| Data | Who decides how it's used | TweakTick's role |
|---|---|---|
| Agency accounts, billing, support emails | TweakTick | Controller |
| Work under review, client names and emails, comments, approvals | The agency that owns the workspace | Processor, under the Data Processing Agreement |
If you are a client who was sent a review link: the agency that sent it decides what is collected and how long it's kept. Please send requests about your data to that agency first. If you can't reach them, contact us and we'll pass it on or help where we can.
4. What we collect
Agency users
- Account: name, email, a securely hashed password (or your Google account ID and email if you choose "Sign in with Google").
- Workspace: projects, files, comments, team members, settings.
- Billing: plan, payments and invoices. Card or bank details are handled by the payment provider you use: Paddle (when you pay through Paddle; Paddle is the reseller and Merchant of Record) or Razorpay (when you pay through Razorpay), or AppSumo for AppSumo deals; we don't store full card details. For Indian businesses, an optional GSTIN.
- Security: sign-in sessions, and a log of owner-level actions (for example API keys or members added or removed) with the IP address.
- Mobile app: if you install the TweakTick app and allow notifications, a device push token. Notifications carry only short titles (for example a project name), never comment text.
Clients (guests)
- The name and email you type when you start commenting, your comments, pins, drawings, voice notes and attachments.
- When you approve: your name, email, the approved version, the time, your IP address and browser details. This goes into the sign-off record (section 8).
- Which screen sizes and versions you viewed, so the agency can see progress.
- Technical details with a comment you leave on a live website, if the agency has this on (it is on by default): your browser and operating system, screen size, language, time zone, the page address without its query string, errors and warnings the page logged, requests that failed, and the clicks, page changes and scrolls of the 2 minutes before the comment. Never what you type, cookies, browser storage or the contents of requests. Email addresses, codes and tokens are removed before saving. Only the agency's team sees them; they are deleted with the comment.
Files under review
- Screenshots of the website being reviewed, and uploaded images, PDFs, videos, audio and other files. These can contain personal data if the work itself does.
5. How we use it
- To run the Service: show reviews, take screenshots, convert files, send notification and approval-code emails.
- To keep it secure: rate limits, abuse prevention, error tracking.
- To bill customers and meet tax and legal duties.
- To answer support requests.
TweakTick staff may access account data when needed for support, billing and security, and every such access is logged.
We don't use workspace content to train AI models, and we don't build advertising profiles.
Legal bases (GDPR): contract (running the Service you signed up for), legitimate interests (security, fixing errors), legal obligation (tax records). Where the agency is the controller, it chooses the legal basis for its clients' data.
6. Cookies and similar storage
We use only necessary cookies:
- Agency sign-in session (
pr.session_token). - One review session per project for clients (
pr_g_…), so you don't have to enter your name again. - Short-lived cookies during sign-up, payment and licence redemption.
No analytics, advertising or third-party tracking cookies. The video uploader keeps unfinished upload details in your browser's local storage so an upload can resume.
7. Optional features that send data elsewhere
- AI review is off by default. If a workspace owner turns it on, they add their own key for an AI provider they choose (for example Anthropic, OpenAI, Google or OpenRouter), and review images are sent to that provider. That provider's terms apply.
- Email client previews send the HTML of the email being reviewed to Mailgun to render, only when someone starts a preview. We save the result screenshots with us and then ask Mailgun to delete the test.
- Integrations and webhooks a workspace connects (for example Slack, Jira, Linear) receive the review events the workspace chooses to send.
- Workspace email (SMTP): if an agency sends client emails through its own mail server, that provider handles those emails.
- Mobile push notifications go through Expo, and then Apple or Google, only for team members who install the app and allow notifications.
- YouTube videos: when an agency asks for feedback on a YouTube link, the video plays in YouTube's own player (youtube-nocookie.com). Nothing loads from YouTube until you press play. After you press play, Google receives your IP address and browser details, and YouTube's privacy policy applies to that player. We don't send YouTube your name or email, and TweakTick itself sets no tracking cookies for it.
8. The sign-off record
When a client approves, TweakTick writes an append-only, hash-chained record (each entry includes a fingerprint of the one before, so changes can be detected). The database does not allow these records to be edited or deleted.
This record is kept after the project, workspace or account is deleted, because it is the evidence of what was agreed. We keep it for at least 6 years after the last approval in the project.
9. How long we keep data
| Data | How long | Source |
|---|---|---|
| Agency sign-in session | Up to 7 days, unless you sign out | Session length in the app |
| Client review session cookie | Up to 30 days | Guest cookie length in the app |
| Unfinished uploads and temporary files | Deleted after 24 hours without activity | Hourly clean-up job |
| Projects, files and comments | Until the agency deletes them, or deletes the workspace | |
| Workspace export download | Link works for 24 hours; videos in it are links valid for 7 days | Export job |
| Email preview tests at Mailgun | Deleted once the screenshots are saved | Preview job |
| Server logs | Rotated by size (5 files of 20 MB per service) | Server config |
| Database and file backups | Local copies 7 days; off-site copies 30 days (encrypted) | Nightly backup |
| Sign-off records | At least 6 years after the project's last approval, also after deletion (section 8) | Our policy |
| Bounced or "marked as spam" email addresses | Kept so we stop emailing them: a one-way hash of the address and its domain only, until an owner clears a bounce | Email bounce handling |
| Billing and tax records | As long as Indian tax law requires |
When a workspace is deleted, its projects, files and comments are deleted from the live system (files by a background job shortly after). Copies in backups expire on the schedule above.
10. Who we share data with
Only with the service providers that help us run TweakTick, listed on the Sub-processors page, and when the law requires it. We don't sell personal data.
11. International transfers
We are based in India and our servers are hosted by OVH in Canada (Beauharnois). Some providers may process data in other countries. Where the GDPR applies, we rely on appropriate safeguards such as standard contractual clauses offered by those providers.
12. Security
Passwords are hashed with argon2id. Secrets you give us (AI keys, integration tokens, staging logins) are encrypted. Website screenshots are taken in a separate, isolated, locked-down container. More on the Security page.
13. Your rights
Depending on where you live (for example under the GDPR or India's DPDP Act), you can ask to:
- see the personal data we hold about you, and get a copy;
- correct it;
- delete it (except records we must keep, such as sign-off records and tax records);
- object to or restrict some uses, or withdraw consent where we rely on it;
- nominate another person to act for you (DPDP Act).
Agency users can delete their account in Settings → Account and workspace owners can export a workspace there too. For anything else, email [email protected]. We reply within 30 days. If you're a client, the agency that sent you the link handles most requests (section 3).
If you're not happy with our answer, you can complain to your data protection authority (in India, the Data Protection Board of India).
14. Children
TweakTick is for businesses and is not meant for anyone under 18.
15. Changes
We'll update the "Last updated" date when this policy changes and tell account owners by email about important changes.