Privacy Notice — Tidemark

This notice explains how we handle personal data when you use Tidemark Cloud, the hosted service at app.tidemarkanalytics.com. It is operated by Michael Kinder, who is the data controller for your account data. For the statistics your own websites send us, we act as your processor and handle that data only on your instructions.

What we collect

Account data: your name, email address, a hashed password, your timezone and the settings you choose (sites, goals, shield rules, API keys, team members you add).
Billing data: payments are processed by Creem, our merchant of record. Creem collects your payment details, billing address and tax information. We receive only your plan, subscription status, customer ID and email, never your card number.
Support messages: if you open a ticket from the app or reply to our emails, we keep the conversation in our help desk, which we run ourselves. When you open a ticket we also record your plan, subscription status, payment provider customer and subscription IDs, number of sites, events this month and your account ID, so we can help you faster.
Statistics from your websites: aggregate visit and event rows, as described in how Tidemark counts visitors (page, referrer, country, browser, device, custom events). We don’t store visitors’ IP addresses or raw user agents.
Technical logs: our servers briefly keep standard access logs (IP address, requested address, status) to run, secure and debug the service. They are rotated automatically and kept only as long as needed.
Emails we send you: confirmation and password-reset messages, usage notices (for example when you reach your monthly event limit) and subscription notices. We don’t send marketing email without your consent.

Cookies and local storage

When you sign in to the dashboard we set an essential session cookie and a second small flag cookie, tm_in, on the tidemarkanalytics.com domain. The flag holds no personal data, only that you are signed in, so our website and documentation can show a Dashboard button instead of Sign in. It is removed when you sign out. The tracking script we give you sets no cookies and uses no local storage on your visitors’ devices. The dashboard remembers your light or dark choice and a few interface preferences in your browser’s local storage. We use no advertising or cross-site tracking cookies.

Why we use it

To provide the service and your account (performing our contract with you);
To bill you and meet tax and accounting obligations (legal obligation, and the contract);
To keep the service secure, prevent abuse and fix problems (our legitimate interests);
To contact you about the service (contract and legitimate interests).

Who we share it with

We don’t sell personal data and we don’t share it with advertisers. We use a small number of providers to run the service: Creem (payments), OVHcloud (server hosting for the app), Cloudflare (network security and delivery), Vercel (hosting for this website), hosting.com (outgoing email) and our own help desk (customer support, on our server at OVHcloud). Some of them process data in the United States or elsewhere outside your country, under their own data protection commitments. We may also disclose information where the law requires it.

How long we keep it

Account data: while your account is open, and for up to 30 days after you delete it.
Statistics: for the history your plan includes (6 months on Free, 5 years on Pro), then deleted automatically. Deleting a site removes its data.
Billing records: as long as tax and accounting law requires, held by Creem.
Backups: server backups expire within about 30 days.

Your rights

Depending on where you live (for example under the GDPR, UK GDPR or California’s CCPA/CPRA), you can ask to access, correct, export or delete your personal data, to restrict or object to some processing, and to complain to your data protection authority. Open a ticket from Support in the app and we will respond within 30 days. You can also export your statistics and delete your account yourself from the dashboard.

Security

Connections are encrypted (HTTPS), passwords are hashed, two-factor sign-in is available and access to our servers is restricted. No system is perfectly secure; if a breach affects your personal data we will tell you as the law requires.

Children and changes

The service is not intended for people under 16. If we change this notice in a way that matters, we’ll update the date above and notify you by email or in the dashboard.

If you self-host Tidemark

This notice covers Tidemark Cloud. If you run the open-source software on your own server, your data stays on that server and this notice does not apply: you decide what is collected and you are responsible for your own privacy notice. Tidemark sends nothing to us, apart from an optional update check that asks GitHub for the latest version number and sends no site or visitor data. See how Tidemark counts visitors for how it is designed.

This website

This site sets no cookies and loads no third-party scripts, fonts or trackers. It is hosted by Vercel, which, like any web host, sees the address and request of each page load in its server logs. It measures itself with Tidemark, installed on our own server, and the resulting dashboard is public so you can see exactly what is collected. The only thing stored in your browser is your light or dark theme choice, if you change it. If you are signed in to Tidemark Cloud, the site reads the tm_in flag cookie the app set, only to show a Dashboard button; it sets no cookies itself. Personal data for Tidemark Cloud accounts is covered above.