Privacy Policy

This Privacy Policy explains how CollectiveTap handles information when you use the service. If you have questions or want to request deletion assistance, see Contact.

1

What We Collect

Link state data you enter (for example: list items, votes, scheduling availability, expenses, tasks, hub children).
Full IP addresses (IPv4 and IPv6) used for rate limiting, abuse prevention, and security monitoring.
Server logs (requests, errors, and operational diagnostics).
Analytics data (for example: Google Analytics / GA4).
Open Graph (OG) image render artifacts (PNG images generated for link previews and cached/stored in Supabase).

Important: IP addresses are stored in full and may be retained indefinitely for security and abuse prevention purposes.

2

What We Do Not Collect

User accounts or user profiles
Passwords
Payment information
Biometric identifiers
Government-issued identification numbers/documents

3

Data Retention

Link data: Links typically expire automatically after approximately 90 days unless extended.
OG PNG images: OG images are cached and stored in Supabase and may persist for up to one year (based on OG cache behavior/TTL).
IP address records: IP addresses may be retained indefinitely for security and abuse prevention.
Caching note: Expired or deleted links may not immediately purge associated cached images due to caching behavior.

We avoid publishing operational thresholds, internal infrastructure identifiers (such as storage bucket names), or other details that could increase attack surface.

4

Hub data and linked content

When you create or use Hub, CollectiveTap may process Hub metadata (title, description, member labels) and references to linked tools ("child links") so the Hub can render a unified coordination view.

Hub metadata: title, description, member labels, and layout-level settings.
Linked content references: pointers to child tools so Hub can surface card previews.
Preview artifacts: rendered OG previews may be cached for reliability and performance.

Hub organizes visibility, but each child tool keeps its own capabilities, controls, and lifecycle. Deleting or expiring a link may not instantly purge third-party caches.

Security FAQ

5

Cookies and Local Storage

Theme preference: stored locally in your browser (for example via localStorage) so your light/dark setting persists.
Analytics: analytics cookies and similar identifiers may be set by our analytics provider to measure usage and improve the service.

6

Third Parties We Use

CollectiveTap relies on a small set of infrastructure providers:

Netlify for hosting and serverless functions
Supabase for database and storage (including OG image storage)
Analytics provider (for example: Google Analytics / GA4)

We do not publish internal infrastructure identifiers (such as storage bucket names) on public pages.

7

Your Rights and Controls

Delete links you control: if you have the appropriate capability link for a given tool/link, you can delete or manage it using the tool's controls.
Contact for removal requests: if you cannot access a link you created or need help removing content, contact us (see Contact).
International users: you may have additional rights depending on where you live; we will consider reasonable requests consistent with applicable law and the platform's design.

Because CollectiveTap does not use accounts, access is controlled by the capability links you hold. If you lose an admin-cap link, we may not be able to verify ownership.

8

International Users

CollectiveTap may be used from many countries. Some jurisdictions (including those in the European Union) provide privacy rights such as access, deletion, and objection. We do not claim any certification or formal compliance status, but we aim to be transparent about collection, use, and retention and to respond to reasonable requests.

9

Changes to This Policy

We may update this policy occasionally to reflect product or infrastructure changes. We will update the "Last updated" date at the top of this page. Annual review is typically sufficient.