Privacy Policy

This Privacy Policy explains how Lina Noor Barkawi, d/b/a Lina's Thobe ("Tatreez.io," "we," "us," or "our") collects, uses, shares, and protects information when you use our browser-based design tool and related services (the "Service"). Please read it to understand our practices. If you do not agree with them, please do not use the Service.

1. Information We Collect

1.1 Information You Provide Directly

• Account information: your email address, which we use to create your account and send secure sign-in ("magic code") emails. We do not require or store passwords.
• Payment information: paid subscriptions are sold and processed by Creem, which acts as our merchant of record. Creem collects your payment details directly and handles them under its own privacy policy. We never receive your full card number, CVV, or other sensitive payment card data. We receive limited transaction information from Creem, such as subscription status, plan type, and billing history.
• User content: designs, patterns, motif selections, thread and color choices, and any other content you create, upload, or save using the Service ("User Content").
• Communications: information you provide when you contact us for support or feedback.

1.2 Information Collected Automatically

• Usage data: pages viewed, features used, clicks and other actions within the Service, session duration, and similar interaction data. We may also record sessions, meaning how you navigate and interact with the Service's interface. Text you type into fields is masked and not recorded.
• Device and technical data: browser type, operating system, IP address, device identifiers, and approximate location (such as city or country) derived from your IP address. We use this for security, troubleshooting, and improving the Service.
• Cookies and similar technologies: see Section 6.

We do not collect precise geolocation, biometric data, or sensitive categories of personal information.

2. How We Use Your Information

We use the information we collect to:

• Provide, operate, and maintain the Service, including saving and syncing your designs across sessions
• Authenticate your account through magic-code email sign-in
• Process subscriptions through Creem
• Understand how the Service is used through product analytics, so we can fix problems and decide what to improve
• Respond to support requests and communicate with you about the Service, including service updates, security notices, and product news if you opt in
• Monitor, troubleshoot, and secure the Service, including protecting against fraud, abuse, and malicious traffic
• Enforce our Terms of Service
• Comply with legal obligations

We do not sell your personal information, and we do not use it for advertising.

3. How We Share Information

We share information only in the following circumstances.

Service providers. We work with third parties who help us run the Service. Each one receives only the information it needs to do its job, and each is contractually required to use that information only to provide services to us:

• Cloudflare hosts the Service and delivers it through its global network. Cloudflare also provides security protections such as blocking malicious traffic. Because this network is global, your requests may be handled by the Cloudflare location nearest to you.
• InstantDB is our database provider. It stores your account information and User Content in the United States and sends our sign-in emails.
• PostHog provides product analytics. It stores usage and device data in the United States.
• Proton hosts our support email inbox and stores support messages in Switzerland.

Creem. As our merchant of record, Creem processes your purchase and handles your payment information as an independent company under its own privacy policy.

People you choose to share with. If you use collaboration features, the designs you share, along with your name or email address, will be visible to the collaborators you invite.

Our team and contractors. Our team, including independent contractors who help build and maintain the Service, may access limited data in order to develop, troubleshoot, and improve the Service. This includes usage logs and, where necessary for support, User Content. Your data is stored primarily in the United States, but team members who access it may be located in other countries, so it may be accessed from jurisdictions whose data protection laws differ from yours. We require everyone with access to protect your information consistently with this Policy.

Legal requirements. We may disclose information if required by law, subpoena, or other legal process. We may also disclose it if we believe in good faith that disclosure is necessary to protect our rights, your safety, or the safety of others.

Business transfers. If Tatreez.io is involved in a merger, acquisition, financing, or sale of assets, your information may be transferred as part of that transaction. We will notify you of any change in ownership or control of your personal information.

We do not publish your User Content. The Service does not currently include public community or gallery features. If we add them, they will be opt-in, and we will update this Policy before they launch.

4. Data Retention

• Account and User Content: kept for as long as your account is active.
• Deleted designs: moved to trash, where you can recover them for 30 days. After that they are permanently deleted.
• Deleted accounts: within about 30 days, we delete or anonymize your personal information, User Content, and the analytics records linked to your account. We may keep some information longer where the law requires it or where it is needed for tax, security, or fraud prevention.
• Analytics data: kept for up to 12 months, then deleted or aggregated so it no longer identifies you.
• Support communications: kept only as long as needed to resolve your request and maintain a reasonable support history.
• Backups: backup copies may persist for a limited additional period before they are purged.

Creem keeps its own transaction records under its privacy policy and legal obligations.

5. Your Rights and Choices

Wherever you live, you may:

• Access a copy of the personal information we hold about you
• Correct inaccurate information
• Delete your account and associated personal information
• Export your designs, using the export features included in your plan. You can also request a copy of your personal information in a portable format at any time, whatever plan you are on.
• Opt out of analytics by contacting us.
• Opt out of non-essential emails at any time through the unsubscribe link

To exercise any of these rights, email support@tatreez.io. We will respond within 30 days. We may confirm your request through the email address on your account before acting on it.

California residents: you have rights under the California Consumer Privacy Act, including the right to know what personal information we collect, to request its deletion or correction, and not to be discriminated against for exercising these rights. We do not sell personal information, and we do not share it for cross-context behavioral advertising.

EU, EEA, and UK residents: you have rights under the GDPR and UK GDPR, including the rights described above, the right to data portability, the right to object to or restrict certain processing, and the right to withdraw consent at any time. We process your information on these legal bases:

• To perform our contract with you, such as providing your account and saving your designs
• For our legitimate interests, such as securing and improving the Service
• With your consent, for analytics cookies where required and for marketing emails
• To comply with legal obligations

Your information is stored primarily in the United States, and support emails are stored in Switzerland. Where it is transferred from the EU, EEA, or UK, we rely on appropriate safeguards such as the Standard Contractual Clauses included in our providers' data processing terms. You also have the right to lodge a complaint with your local data protection authority.

6. Cookies and Tracking

Essential cookies and local storage keep you signed in, remember your design work between sessions, and protect the Service from malicious traffic. Cloudflare's security cookies are among these. The Service cannot work properly without them.

Analytics cookies and local storage are set by PostHog to recognize returning visitors and understand how the Service is used, as described in Sections 1.2 and 3. You can opt out at any time as described in Section 5.

We do not use advertising cookies or third-party advertising trackers. You can also block or delete cookies through your browser settings, but blocking essential cookies may stop the Service from working properly.

7. Children's Privacy

The Service is not directed to children under 13, or under the minimum age required in their country, and we do not knowingly collect their personal information. If we learn that we have collected it, we will delete it promptly. If you believe a child has given us personal information, contact us at support@tatreez.io.

8. Data Security

We use commercially reasonable technical and organizational measures to protect your information. No method of transmission or storage is completely secure, so we cannot guarantee absolute security. Because you sign in through your email, you are responsible for keeping your email account secure.

9. Pilot and Beta Notice

Tatreez.io is currently operating as a pilot. Our data practices, infrastructure, and this Policy may change as the Service develops. We will give notice of material changes as described in Section 10.

10. Changes to This Policy

We may update this Privacy Policy from time to time. If we make material changes, we will notify you by email or through a notice on the Service before the change takes effect. If you continue to use the Service after changes take effect, the updated Policy applies.

11. Contact Us

If you have questions about this Privacy Policy or how we handle your information, contact:

Lina Noor Barkawi, d/b/a Lina's Thobe

support@tatreez.io