Privacy policy

Overview

This policy explains what personal information Tapeleaf (“we”) collects, how it is used, where it is kept, who it is shared with, how long it is kept, and what your rights are. We collect only what the service needs, never sell personal information, and have no ads or third-party analytics on the site.

What we collect

• Your account: the email you log in with; if you signed up with an email and a password, a salted hash of the password (never the password itself); if you log in with Google or Apple, the user identifier they give us and the email and name they share.
• Your journal: the pages you save to your account, with their words, title, date, place, layout, ink colour and photos. Photos are scaled down in your browser before upload, which also removes details stored in the file such as where it was taken.
• Membership and credits: your plan, subscription status and renewal date, the customer number Stripe assigned you, and the record of credits given and used.
• Community: the journals you share and the reports you make (the reason and any note).
• Security records: to stop password guessing and abuse, we briefly record the IP address and account behind logins and code requests; server logs also record the IP address and time of each visit.

What we do not collect

• Before you save, ordinary editing keeps a draft in your browser. Using AI is an exception: the request and the page content needed for it are sent through our service to the model, even if you have not saved the journal. Photo references are sent when you choose a feature that uses them or allow the AI to see photos.
• Card details. The payment page is hosted by Stripe; card numbers never pass through our servers.

How we use it

• To provide the service: logging you in, saving and showing your journal, handling the AI requests you make, giving and taking credits, handling subscriptions.
• To send the emails the service needs: login codes, email confirmation, password resets. We do not send marketing email.
• If you turn on the weekly email in Settings, once a week we also send you your own week: how many pages you wrote, with their dates and titles or the first words of each. It never contains photos or hidden lines. It is off unless you turn it on, needs a confirmed email address, and each one has a link that stops it at once.
• For safety and moderation: preventing abuse, reviewing community shares, handling reports and infringement claims.
• We do not use your journal to train AI models.

Who we share it with

• Stripe, to process payments and subscriptions; it receives your email and payment details.
• Resend, to send login codes, account emails and, if you turn it on, the weekly email; it receives your email address and the email.
• Google and Apple, only when you choose to log in with them, exchanging what their consent screens show.
• AI providers, only when you use an AI feature: they receive the description you wrote and the words of the page. When the AI writes, scaled-down copies of the page’s photos are sent too by default, so it can write from them; turn off “Use photos to write” in the chat and no photos are sent.
• Infrastructure: our servers are run by Tencent Cloud (Singapore), art and backups are kept in Volcengine object storage (Hong Kong), and the site is delivered through Cloudflare’s network.
• Journals you share to the community are public. Beyond that, we give information to authorities only when the law requires it.

Where it is kept

Your account and journal are kept on servers in Singapore, and database backups in Hong Kong. If you use the service from mainland China or elsewhere, your information is transferred to these places to be processed. Connections are encrypted (HTTPS); your photos can be seen only by you (and by visitors, if you share a journal with its photos), and our storage is not open to the public.

How long it is kept

• Your account and journal: until you delete them or your account.
• Your login lasts 30 days; codes are valid for 5 minutes; anti-abuse records are normally cleared after a day; server access logs are kept for 14 days.
• Backups: one a day, kept for 14 days. What you delete is gone from the backups within 14 days, as old backups are cleared.
• Payment records are kept by Stripe as the law and accounting rules require; deleting your account does not affect them.

Cookies and local storage

We use only the cookies the service needs: your login (readable only by the server), the interface language you chose, and a short-lived value that protects the sign-in with another provider from forged requests. When you arrive from another site, a cookie that lasts 30 minutes remembers which of our pages you came to, what kind of site sent you (a search engine or an AI assistant, for example) and the kind of device (phone, tablet or computer), so that we can count, as totals only, how people find us and whether they go on to start a journal. It holds nothing that identifies you, and nothing is counted when your browser sends Do Not Track or Global Privacy Control. Drafts you have not saved are kept in your browser’s storage. If you try AI without an account, a cookie remembers for a year that this browser has used its free try; it holds nothing that identifies you. We use no advertising or tracking cookies.

Your rights

• See and export: you can see what you saved under “My journal” at any time and export it as images.
• Correct and delete: you can change or delete any page (its photos go with it) and stop sharing to the community.
• Delete your account: on the “Membership and credits” page. It deletes at once the account, all its journals and photos, community shares, credits and membership, and cancels the subscription at Stripe.
• Anything else (a copy of your information, withdrawing consent, a complaint): email [email protected], and we will answer within 15 working days.

Children

If you are under 14 (or the higher age set where you live), use the service only with a parent’s or guardian’s consent. If we learn that we collected a child’s personal information without that consent, we delete it as soon as we can.

Changes to this policy

This policy may be updated. Important changes will be posted on this page and announced on the site or by email before they take effect.

Contact

For any question about your personal information, email [email protected].

AI generation and recovery on this browser

An AI request may include your instructions, relevant page text and fields, selected source records, and photo references where enabled. These are transmitted for generation before account saving; keeping a local draft does not make an AI request local-only.

For personalized generation, your occupation, about-you text, writing instructions and tone saved with your account may be sent as model context. Saved memories are included only when account memory is on and the individual memory is enabled. The request uses the requesting account’s settings and memories.

Source extensions have been removed, and saved connection credentials have been deleted. Previously saved source snapshots remain encrypted and tied to your account, usable for up to 30 minutes from their original creation, and are deleted periodically once expired. Expiry or revoked permission prevents later use. Expiry does not guarantee immediate physical deletion.

Ordinary drafts, photo copies and recovery edits for saved journals use this browser’s local storage and database. Recent creation conversations and design versions for saved pages may also be kept here. These records have no automatic 24-hour expiry; they may remain until replaced, cleared by an app action or removed with browser data. They do not automatically sync to another browser.

To recover an unfinished book generation in the same browser, a separate record can keep planned text, photo copies, exact generation requests and completed designs. Recovery is valid for 24 hours; expired records are checked and cleanup is attempted when the feature is used, and run records are cleared when applied or discarded. Continuing the remaining pages requires this browser; it is not a continuously running server task. A request already sent may still finish.

The 3D pop-up books you make are kept in your account: for each page, the paper pieces drawn for it, the photo it was drawn from and the place and time you wrote. Only you can open them. Deleting a book deletes its pages and files; closing your account deletes them all.

Product analytics with PostHog

When configured, Tapeleaf sends PostHog limited events about visits, registration, AI generation status, saving, return visits, page previews, save prompts, credit offers and clicks on their purchase buttons. These interface events use fixed offer-reason, plan, billing-interval and purchase-type categories. These use fixed source, device and language categories, durations and payment amounts, with a pseudonymous account ID. We do not send journal text, prompts, titles, photos, photo links, email addresses, raw browser descriptions or full page addresses. We do not use automatic click capture or session recordings. A first-party signed cookie lasts up to 180 days to link an anonymous visit to your account when you sign in. PostHog processes these events in the configured US or EU region; this is separate from our local aggregate discovery counters. We honor Do Not Track and Global Privacy Control by stopping collection and clearing pending events. Already delivered events require a separate deletion request; contact us to request deletion.

A visit is labelled only with a fixed name for the kind of page, such as a tool or guide page, never its address. Making something with a tool and downloading it or putting it in a journal are counted with a fixed tool name, page count and way of export.

First-party discovery measurements

To understand which public journal-making pages help people create a journal, we keep daily totals for visits, starts, first completed journals and export actions. The totals are grouped by a fixed page, template and referral category. A first-party cookie remembers that category and entrance for up to 30 minutes; it contains no visitor identifier, full referring address, journal text or photos. An account flag prevents counting its first completed journal again. These measurements stay with Tapeleaf, respect Do Not Track and Global Privacy Control, and are best-effort event counts rather than a record of each visitor.