Privacy Policy

The controller of your data is Md. Emtiaz Zahid, a sole proprietor trading as Ollfy. Contact: [email protected].

• Account: your email address. If you sign in with Google, also the name and profile picture Google shares with us.
• Purchases: your plan, its status and dates, and the customer and subscription IDs Paddle gives us. Paddle collects your payment details and billing address; we never see your card.
• Things you save: layers you like, and API keys you create (we store only a hash of each key).
• Server logs: IP address, browser user agent, the page requested and the time, kept for a limited period to keep the service secure and fix errors.

We set one essential cookie: your sign-in session. It is needed for the site to work when you are signed in, so it does not need consent. We use no advertising, analytics or tracking cookies.

• To provide your account and the plan you bought (performance of our contract with you).
• To send sign-in links and essential account or billing emails (performance of contract).
• To prevent abuse and keep the service running (our legitimate interest in security).
• To meet tax and accounting duties (legal obligation; Paddle keeps the invoices).

We do not sell your data and we do not use it for advertising.

• Paddle, our Merchant of Record, for checkout, payments, invoices and tax (Paddle privacy notice).
• Cloudflare, for DNS, content delivery and protection against attacks; it sees your IP address when you visit.
• Our hosting provider, which runs the server that stores account data.
• Our email delivery provider, which sends sign-in links and account emails.
• Google, only if you choose to sign in with Google.

Layer previews load fonts from Google Fonts, code libraries from jsDelivr and placeholder photos from Unsplash, so your browser contacts those services when a preview is shown. Some of these providers process data outside your country, under their own safeguards for international transfers.

• Account data: while your account exists. We delete it within 30 days of a deletion request.
• Purchase records: as long as tax and accounting law requires.
• Server logs: a limited period, then they are deleted.

You can ask to see, correct, export or delete your data, or object to how we use it. Email [email protected] and we will answer within 30 days. You can also complain to the data protection authority where you live.

Tileio is not meant for anyone under 16, and we do not knowingly collect their data.

We will post any update here with a new date, and email account holders about significant changes.