Privacy policy
What we hold and why
| Data | Why | Kept |
|---|---|---|
| Email address; password hash (Argon2id) if you set one; the identifier a sign-in provider gives us (Google, Microsoft, GitHub) if you use one | Your account, signing in, sending you the emails below | Until you delete the account |
| Uploaded files and the tables made from them | The service itself | Free plan: 24 hours. Other plans: until you delete them or the account |
| API tokens (only a hash), their names, when created and last used | Letting your programs in, showing you which token is in use | Until revoked and the account is deleted |
| Browser sessions (a hash, browser name, expiry) | Keeping you signed in | 30 days, or until you sign out |
| Usage events: which tool a program called, whether it succeeded, how long it took, the first line of an error | Your usage page, enforcing plan limits, billing later, finding faults | 13 months |
| Server logs: request path, status, timing; never the content of a query or a file | Running and securing the service | About 3 weeks (rotated) |
| Encrypted backups of the database and your files | Recovering from a fault | 90 days |
The SQL your programs send is executed and not stored. Uploaded content is read by the server to build tables; no person reads it in the normal course of the service.
Legal basis
Performing the contract with you (account, files, tokens, usage), our legitimate interest in keeping the service secure and working (logs, limits, backups), and consent where you choose to sign in with a provider.
Who else touches the data
| Company | What | Where |
|---|---|---|
| Oracle (Oracle Cloud Infrastructure) | The server, its disk and the encrypted backups | Toronto, Canada (a country with an EU adequacy decision) |
| Brevo | Sending account emails (verification, password reset) | EU |
| Cloudflare | DNS for our domains; the landing page passes through its network, the app and data endpoints do not | Global |
| Google, Microsoft, GitHub | Only if you sign in with them: they confirm your email to us | Their own terms |
We do not sell data and there is no advertising. We share data only with the companies above, to provide the service, or when the law requires.
Your rights
You can see and take your data at any time: the app's Usage page has an export that returns everything we hold about your account as one file. You can delete the account there too; that removes the account, files, tokens, sessions, identities and usage events at once. Encrypted backups age out within 90 days. You may also ask us to correct data, object to a use, or complain to the Irish Data Protection Commission.
Cookies
One cookie, tsk_session, keeps you signed in to the app. No analytics, no tracking cookies.
Changes
Updates to this page are announced by email when they matter and dated at the top.