Privacy policy
Last updated: draft, not yet in effect.
The short version
- We collect your email so we can send sign-in codes. That's the only required personal information.
- We store license plate characters and states that users post about. We never collect, buy, look up or display vehicle-owner information, and we do not access DMV records.
- We don't sell your data and don't share it with advertisers.
- You can delete your profile and every post you made at any time from your profile page.
What we collect
- Account: your email address (lower-cased) and when you joined.
- Optional profile info: display name, home state, city and bio, only if you enter them.
- Content: the plates, states and text you post, and reports you file.
- Security records: one-time codes (stored only as a salted hash, never in plain text), session records (a hash of your session token, its creation and expiry times), and short-lived rate-limit counters keyed to a hash of your IP address or your email. These are deleted automatically within about a day.
- Settings: dark mode and default search state.
What we do not collect
- Vehicle-owner names, addresses, phone numbers or any data from DMV records.
- Your location. Voice input runs through your browser's speech service; we receive only the resulting text you choose to search.
- Tracking cookies. TattleTags uses no cookies at all. Your sign-in lives in your browser tab's session storage and disappears when you close the tab. Your dark-mode choice may be remembered on your device.
How we use it
To sign you in, show your posts, run search and browse, enforce our rules, prevent abuse and keep the service secure. Sign-in emails are sent through our email provider (planned: Resend), which processes your email address only to deliver the code.
Who sees what
Your posts, display name and home state (if set) are public to signed-in users. Your email, city and bio are not shown on posts. Moderators can see reports and the account behind a post. We may disclose information if required by valid legal process, and we will push back on overbroad requests where the law allows.
Retention and deletion
Deleting your profile immediately erases your account, posts, reports and sessions from our database. Backups held by our hosting provider may persist for a limited period before rotation. [Counsel: confirm backup retention language for Cloudflare D1 Time Travel.]
Children
TattleTags is for people 18 and older. We don't knowingly collect information from minors.
Your rights
Depending on where you live you may have rights to access, correct, delete or port your data. Most of these you can do yourself in your profile; for anything else email [email protected].
Changes
We'll post changes here and update the date above. [Counsel: add business entity name, address and effective date.]