Who is responsible
Tiha is a free-to-use app project by Sergej Nejc Gorišek. Contact [email protected] for privacy questions or requests about website feedback and support correspondence.
This policy covers the website and the local apps. The Privacy page explains the product-specific boundaries. Using an app does not send us your vault, usage analytics or crash reports.
Your app data stays on your device
The local apps keep content and private preferences in separate encrypted vaults on your device. We do not receive those vaults through this website, run a family-wide content sync service, or collect vault contents for advertising, behavioural profiles or AI training.
You control backups and exports. A decrypted export, an email attachment or content you deliberately send to another service leaves the vault’s protection. Device access, optional password protection and the individual app’s limits still matter.
Some product features have separate network boundaries. Calendar stores events locally. Mail and Chat are still in development. See online feature boundaries before connecting a service.
What this website processes, and why
We use no analytics, advertising trackers, remote fonts or third-party embeds. The site sets no application cookies. Your selected colour theme is remembered in local browser storage. This preference stays on your device; clear browser storage to remove it.
- Serving and protecting the website
- Cloudflare processes connection information, including IP addresses and request metadata, to deliver the site and protect it. Our feedback database does not store raw IP addresses. Short-lived anonymous counters help prevent abuse.Purpose and legal basis: our legitimate interests in providing a reliable website and preventing abuse, under Article 6(1)(f) GDPR.
- Feature requests and bug reports
- When you submit the form, we receive the chosen product, report type, title, description and submission time. Optional bug fields are included in the private description. No visitor name or email address is required. We use this information to evaluate ideas and investigate problems.Purpose and legal basis: our legitimate interests in responding to voluntary feedback and improving the software, under Article 6(1)(f) GDPR. Submission is optional.
- Searching approved ideas
- Your search terms and filters go to our website service. “Find similar ideas” sends the draft title and chosen product only when you select that action. Typing a draft alone does not send it. Search terms are not stored in the feedback database.Purpose and legal basis: our legitimate interest in providing the search you requested, under Article 6(1)(f) GDPR.
- Emailing support
- If you email [email protected], we receive your address, message, any attachments and the email metadata needed for delivery. Email providers process that correspondence. Use email when you want a reply; the anonymous website form cannot send one.Purpose and legal basis: our legitimate interest in answering correspondence, under Article 6(1)(f) GDPR; Article 6(1)(b) where needed to take steps you request towards a contract or perform one; and Article 6(1)(c) where a legal obligation requires us to keep a record.
Providing feedback or email is voluntary. Without a contact address we cannot reply directly. We do not use these submissions for marketing lists, sell them, or send their contents to an AI service. We do not make decisions with legal or similarly significant effects through automated profiling.
What can appear on the public board
Feature requests start in a private review queue. If approved, we may publish an edited public title and description, the product, status and dates. The original submission stays private. We do not intentionally publish contact details or other personal information on the board.
Bug reports are not published. Please keep passwords, vault contents and personal documents out of either form. You may ask us to correct or remove personal information in a published idea by contacting [email protected].
Who processes information with us
Cloudflare provides website hosting, network protection, Pages Functions and the D1 feedback database. The people authorised to review feedback can access the private queue. Email delivery and mailbox providers process support messages. We may also disclose information when required by law or when necessary to establish, exercise or defend legal claims.
Cloudflare operates a global network and may process information outside the European Economic Area, including in the United States. We do not promise Europe-only processing. Its published data processing terms describe safeguards, including standard contractual clauses for relevant international transfers. Contact us for details of the providers and transfer arrangements that apply to your correspondence.
We do not automatically forward website form submissions to an email service. Emailing us is a separate choice. External links and services you choose have their own data practices.
How long information stays
App content remains on your device and in the copies you keep, until you remove it. Clearing a vault here does not erase backups or exports elsewhere, and we cannot remotely delete a local vault we do not hold.
Private feedback is kept while needed for review, product planning, investigation or follow-up. Approved public ideas may remain as part of the product history. Reports are deleted through moderation; there is no automatic report-expiry job. You can request deletion of information about you, subject to applicable exceptions.
Abuse counters expire after their short minute/day protection windows and are cleared on later submissions; they can remain until that cleanup runs. Theme and notice-dismissal preferences stay in your browser until cleared. Support correspondence is kept for the request and necessary follow-up, or longer where legal recordkeeping or a dispute requires it. Hosting-provider operational records follow the provider’s applicable retention rules.
Your rights and how to use them
Under the GDPR, where applicable, you can ask for access to your personal information, correction, erasure, restriction and portability. You may object to processing based on legitimate interests. Where processing relies on consent, you may withdraw it without affecting the lawfulness of earlier processing. These rights have conditions and exceptions.
Email [email protected]. Tell us enough to find the relevant message or report. We may need proportionate information to verify a request; we will not ask for your vault passphrase. We normally respond within one month, with any permitted extension explained to you.
You may complain to the Slovenian supervisory authority, Informacijski pooblaščenec, or the authority in the EU country where you live or work or where the alleged infringement occurred. Contacting us first is welcome but is not required before making a complaint.
Share only what the question needs
The website’s feedback database is separate from your encrypted app vault and does not use your vault passphrase. Access to the private review queue is protected, but no system can promise absolute security.
Please do not send passphrases, authentication codes, private vault exports or sensitive personal information. For an issue, use a fictional example or a redacted description where possible. If you accidentally send private information, contact us so we can assess removal.
The site does not ask for age information and is not directed specifically at children. If you are concerned about information submitted by a child, please contact us. We do not use the website to build advertising profiles of children or other visitors.
Changes and contact
We will update this policy when the website, products or processing practices change and revise its effective date. A new account system, payment flow or network service would need its own clear information before you use it.
For privacy questions, corrections or requests, contact [email protected] or visit sergejgorisek.com.