Privacy Policy

Last updated: July 16, 2026

Who we are

TUNLstack is made by aioLABS Limited, a corporation in Nova Scotia, Canada. For any privacy question or request, email privacy@tunlstack.com.

What we collect and why

We collect only what we need to run your trial, sell licenses, keep the referral program honest, and run the creator program:

• Account identity — when you start a trial you sign in with GitHub, Google, or a verified email. We store your account id and email to anchor your trial to you (so a reinstall doesn't reset it) and to recover your license. A free account is required to start the trial; your signup email and OAuth identity are processed as described in this policy.
• Trial & device signals — a one-way hashed form of your IP address, a device fingerprint, and a device hash. We never store your raw IP. These let us honour one trial per account and detect abuse.
• Engagement heartbeats — periodic active-minute counts your app reports, used to release a referrer's reward only for genuinely-used referrals.
• Referral graph — if you were referred or you refer others, we record the link between referrer and referee, referral-link clicks (with a hashed IP and browser user-agent), and team-invite email addresses you ask us to invite.
• Creator program agreement — if you join our creator (affiliate/partner) program, we record evidence that you accepted the program terms: a timestamp, your IP address, and the terms version you accepted, kept for the life of the agreement.

We use the device, click, and heartbeat data for one additional purpose: detecting and preventing referral fraud (fake or farmed referrals). This is our legitimate interest in protecting a fair program. These signals feed a human-reviewed audit queue — they never automatically block your use of the app.

Feedback you send us

If you choose to send feedback or a bug report from the app, we receive the message you write, your account email address (so we can reply), and the app details shown in the form before you send: app version, extension version, Windows build, performance tier, and edition. We use this only to respond and to fix problems. It is never sold or shared, and you can ask us to delete it any time at privacy@tunlstack.com.

How long we keep it

• A held referral that never becomes active lapses after about 30 days.
• A purchase attributes to a referral only within about 90 days of signup.
• Hashed IPs, fingerprints, clicks, and heartbeats are kept for the minimum needed to run fraud prevention and then aged out; outside the creator-program acceptance record above, we do not retain raw IPs.

Who processes it

We use a small number of processors strictly to operate the service: Supabase (database + authentication), Paddle (our Merchant of Record for payments and tax), Resend (sending referral invite and notification emails), and Groq (cloud speech-to-text for the optional dictation feature — see below). We don't sell your data or use it for advertising.

Dictation (voice-to-text)

TUNLstack's dictation feature is optional. When it is enabled in its default cloud mode, the audio you dictate is sent to Groq for speech-to-text and the transcript is returned to your device; you can switch dictation to a fully offline, on-device engine that sends nothing to the cloud. TUNLstack does not retain your dictation audio.

Email & your choices (CASL)

If a friend invites you, the email is sent by aioLABS Limited on their behalf, identifies us, and includes a one-click Unsubscribe link that we honour. You can also email privacy@tunlstack.com at any time to access or delete your data or to opt out.

Analytics & app census

Our website uses cookieless, privacy-preserving analytics (PostHog, EU-hosted) to count page views and understand which pages matter. It sets no cookies, stores no identity, and does no cross-site tracking — we see aggregate numbers, never individual profiles.

When the desktop app checks for messages (about twice a day), the request includes the app version (for example TUNLstack/1.0.0). We count these to know how many installations run each version so we can support them well. No identifier of any kind accompanies that request.

Purchases

Purchases are handled by Paddle, our Merchant of Record. Paddle collects the payment and billing details needed to complete your order under its own privacy policy. From Paddle we receive only order metadata — such as your name, email, country, the product purchased, and a transaction reference — so we can issue and support your license. We never receive or store your full card details. We keep order and license records for as long as needed to support your license and to meet legal, tax, and accounting requirements.

Your content stays on your device

TUNLstack is local-first. The text the app reads aloud, your reading queue, your settings, and your usage history are processed and stored on your own machine. Our in-house text-to-speech and the local speech-to-text engine run on your device, so the content being read never leaves it. We do not read, collect, or transmit the content of your work sessions.

License validation

To confirm your entitlement and prevent abuse, the app periodically contacts our licensing service and transmits your license key, a minimal machine-binding identifier, and the app version. This is used solely to validate your license — it does not carry the content of your work.

The website & cookies

The website is served by Cloudflare, which processes standard technical logs (such as IP address and browser user-agent) to deliver and secure the site. Beyond the strictly-necessary cookies used to serve and secure the site, the site sets no cookies of its own, and our analytics are cookieless (see above). If you email us, we keep the correspondence so we can respond and maintain support history; you can ask us to delete it at any time.

Your rights

Subject to applicable law, you can ask us to access, correct, or delete the personal information we hold about you, and ask what we hold — email privacy@tunlstack.com and we will respond within a reasonable time. We handle personal information in line with Canada's Personal Information Protection and Electronic Documents Act (PIPEDA). Where the EU or UK GDPR applies, we process personal information on the bases of contract (operating your account, trial, and license), legitimate interests (security and fraud prevention), and consent where we ask for it. We do not "sell" or "share" your personal information as those terms are defined under US state privacy laws such as the CCPA/CPRA. If you are unsatisfied with our response, you may contact the Office of the Privacy Commissioner of Canada or your local supervisory authority.

Security

We use reasonable technical and organizational safeguards appropriate to the small amount of personal information we handle. No method of transmission or storage is 100% secure.

Children

The website and the app are not directed to children under 13, and we do not knowingly collect personal information from them.

International transfers

We are based in Canada. Our processors — such as Supabase, Paddle, Resend, Groq, and Cloudflare — may process information in other countries under their own safeguards and agreements.

Changes to this policy

We may update this policy from time to time. Material changes will be posted on this page with an updated date.