Privacy Policy

Last updated: October 31, 2026

1. Introduction

This policy explains what TinyFn ("we", "our", or "us") collects when you use our website, API and MCP server, why we collect it, who processes it for us, and the choices you have.

2. Information We Collect

Account information

When you create an account, we collect:

  • Your email address
  • Your password, which is handled by our authentication provider (Supabase) and stored only in hashed form
  • Your plan, request counts and the date you signed up
  • For each API key: a SHA-256 hash, a short prefix, its name and when it was last used

Billing information

Stripe processes payments, and we never see your full card number. We store your Stripe customer and subscription IDs and your plan.

API and MCP usage

  • We store the endpoint called and the date and time against your account, to count usage and enforce plan limits.
  • Our application logs record the method, path, status code, response time and IP address of API and MCP requests.
  • We use IP addresses to apply rate limits.

We don't save what you send to the API in our database. Our error and performance monitoring (Sentry) can capture request details, though, including IP addresses, request headers, URLs with query parameters, and request contents. Please don't send secrets or sensitive personal data to the API.

Newsletter

If you subscribe, we store your email address and the date you subscribed.

Website analytics

We measure website traffic with Plausible and Cloudflare Web Analytics, which don't use cookies. We also send Plausible events when someone signs up, copies an API key or clicks a pricing plan. These events don't include your email address.

Messages to us

If you email us, we keep the message and your address so we can reply.

3. How We Use Your Information

If you're in the EEA or UK, the legal basis for each use is shown in brackets.

  • To provide the service, manage your account and process payments (performance of our contract with you)
  • To send service-related emails, such as your API key (performance of our contract with you)
  • To keep the service secure, prevent abuse, fix errors and understand how it's used (our legitimate interests in running a reliable service)
  • To send the newsletter, if you subscribed (your consent, which you can withdraw at any time)
  • To keep billing records and respond to lawful requests (legal obligation)

4. Who Processes Your Data

We do not sell your personal data, and we don't use it for advertising. These providers process data for us:

  • Supabase: database and authentication (hosted in the United States)
  • Railway: application hosting and logs
  • Stripe: payment processing
  • Resend: sending email
  • Sentry: error and performance monitoring
  • Cloudflare: content delivery, security and web analytics
  • Plausible: website analytics
  • Google Fonts: typefaces (your browser requests font files from Google, which discloses your IP address to Google)
  • Mintlify: hosting for our documentation at docs.tinyfn.io

We may also disclose data when the law requires it.

Your data is stored and processed mainly in the United States. If you use TinyFn from another country, including the EEA or UK, your data is transferred there.

5. Data Security

  • Connections to our website and API use HTTPS
  • Passwords are stored only in hashed form
  • API keys are stored only as SHA-256 hashes

No system is perfectly secure, so we can't guarantee absolute security.

6. Data Retention

  • Account data, API keys and usage records: kept until your account is deleted. Email us to delete your account, and we'll do it within 30 days.
  • Newsletter address: deleted as soon as you unsubscribe
  • Billing records: kept as long as tax and accounting law requires
  • Logs and monitoring data: deleted according to our providers' retention periods

7. Your Rights

Depending on where you live, including the EEA, UK and some US states, you may have the right to:

  • Access your personal data
  • Correct inaccurate data
  • Delete your data
  • Export your data
  • Object to or restrict processing
  • Withdraw consent you've given

Email [email protected] to exercise these rights. If you're in the EEA or UK, you can also complain to your local data protection authority.

8. Cookies and Browser Storage

TinyFn doesn't set tracking or advertising cookies, so there's no cookie banner. Our website uses your browser's local storage to keep you logged in and hold your API key while you use the site. That data stays in your browser until you log out or clear it, except that your login token and API key are sent to us to authenticate your requests.

Other sites have their own practices: Stripe's checkout pages use Stripe's cookies, and our documentation site, hosted by Mintlify, stores an anonymous ID in your browser's local storage.

9. Children

TinyFn isn't directed at children under 16, and we don't knowingly collect their data. If you believe a child has given us personal data, email us and we'll delete it.

10. Changes to This Policy

We may update this policy, and the date at the top will change when we do. We'll tell you about significant changes by email or on the website.

11. Contact Us

For privacy questions, email [email protected].