Privacy Policy

Tideway (“Tideway”, “we”, “us”, or “our”) is an all-in-one operations platform for freelancers, independent studios, and creative teams. This Privacy Policy explains what personal information we collect, how we use it, who we share it with, and the choices you have, whether you are visiting our marketing website at tideway.co or using the Tideway application at app.tideway.co (together, the “Service”).

We are committed to complying with applicable Canadian privacy legislation, including the Personal Information Protection and Electronic Documents Act (PIPEDA) and Canada’s Anti-Spam Legislation (CASL). Where you are located outside Canada, we handle your information consistently with the protections described here.

Tideway holds two different kinds of personal information, and our role differs for each.

• Your information. The account and usage information you give us directly. For this information, Tideway is the party responsible for deciding how it is handled.
• Your business content. The client details, projects, invoices, notes, files, and other records you enter into Tideway to run your business. This content is yours. Tideway processes it strictly on your behalf and under your instructions, only to operate the Service for you. You are responsible for that content and for having the right to provide any personal information about your own clients that it contains (see our Terms of Service).

a) Information you provide

• Waitlist: your email address, plus the page or campaign the signup came from, so we can tell you when Tideway is ready and understand which messaging resonated.
• Account registration: your name, email address, and password or social sign-in identity, handled by our authentication provider. You may also add profile details such as a photo, business name, and preferences.
• Business content: information you enter into Tideway about your projects, clients, contacts, invoices, proposals, tasks, time entries, expenses, notes, calendar events, and files you upload. This content is yours.
• Payment information: when you subscribe to a paid plan, our payment processor Stripe collects your billing details and card information directly. Tideway does not see or store full card numbers.
• Communications: messages, support requests, bug reports, and feedback you send us, including anything you choose to include in them.
• Optional imports: if you choose to import contacts (for example from a CSV file or, if you connect it, Google Contacts), we collect the fields you import, such as names, emails, phone numbers, and companies. Imports are always initiated by you.

b) Information collected automatically

• Product analytics: pages viewed, features used, clicks, and similar interaction events, collected through PostHog and Vercel Analytics to help us understand how the Service is used and improve it. On our marketing website, PostHog may also record session replays and heatmaps of anonymized interactions. In the application, PostHog is used for feature analytics and to capture errors so we can fix them.
• Web analytics: aggregate traffic and engagement measured through Google Analytics, which helps us understand where visitors come from and how they move through the site.
• Performance data: load times, Web Vitals, and error information, collected through Vercel Speed Insights and our error monitoring, so we can keep the Service fast and reliable.
• Log and device data: IP address, browser type, device and operating system, and referring URL, retained by our hosting provider for security, abuse prevention, and operations. We also record IP addresses briefly to rate-limit waitlist signups against abuse.

c) Cookies & local storage

Cookies. In the application, our authentication provider sets the functional cookies required to keep you signed in. Our analytics providers (PostHog and Google Analytics) set their own cookies or identifiers to measure usage. We do not use advertising cookies, and we do not sell your information to advertisers.

Local storage. Both the website and the application store data in your browser using localStorage. Beyond interface preferences such as your theme, view density, and which version of a page you were shown, the application keeps a working copy of your workspace on your own device, so it stays fast and keeps working through a dropped connection. That copy can include your invoices, your business and invoicing profile, your billable and internal cost rates, your invoice logo, and a copy of your contact, project, and task records.

This local copy lives only in that browser profile. It is never shared with a third party, and it is cleared when you delete your Tideway account. Signing out does not remove it, so if you use Tideway on a shared or public computer, clear your browser data when you are finished.

• To provide, operate, secure, and improve the Service
• To create and manage your account and keep you signed in
• To notify you when Tideway launches or when your account is ready (waitlist)
• To process subscriptions and payments through Stripe
• To send transactional messages you have asked for, such as invoices you send to your clients, payment reminders, and portal invitations
• To respond to your inquiries, support requests, and feedback
• To monitor performance, diagnose problems, and prevent fraud or abuse
• To comply with our legal obligations

We will not use your email address for marketing communications without your consent. When you join our waitlist, we confirm your email through a double opt-in and you can unsubscribe at any time, in accordance with CASL.

Tideway includes AI-assisted features, such as Tideway AI and automated drafting and insights, built directly into the product. No setup or API key is required to use them.

When you use an AI feature, the relevant content needed to answer your request (for example the project, client, or financial data in view) is processed through Tideway’s servers and sent to our AI model provider, Google (Gemini models), to generate the response. We meter this usage for billing and abuse prevention, and we keep a record of the request for security and accounting. Your content is never sold, is never used to serve advertising, and is not used to train the AI provider’s models.

Rating an AI answer. Every AI answer in the app carries a thumbs-up and thumbs-down control. Rating one is voluntary, and nothing is sent unless you press it. When you do, we record your rating, the optional reason you pick, any comment you write, and which feature produced the answer, so we can measure where our AI performs badly and fix it. We do not store the answer itself, or the request behind it, unless you have turned on Improve Tideway AI in Settings → Data & privacy, which is off unless you switch it on. With it on, we also keep a copy of the request and the answer you rated and may use it to evaluate and improve Tideway’s own AI features. Even then, it is never sent to our AI provider to train its models, and never sold or used for advertising. You can turn the setting off at any time, which stops any further content being kept.

AI output can be inaccurate or incomplete and should not be relied on as legal, financial, or tax advice. AI features are optional. You can turn Tideway AI off at any time, and the rest of Tideway works exactly the same.

Your account and business content are stored on managed cloud infrastructure run by specialist providers: an identity and authentication provider, a managed PostgreSQL database for your account and business records, and an object-storage provider for the files you upload. We name each of them, and say exactly what they process, on our Sub-processors page.

We protect that data with a layered approach:

• Per-account isolation. Every record is scoped to your account and enforced at the database level with row-level security, so one customer’s records can never be read by another. Files you upload are held in separate, private object storage that is not publicly addressable — they are reached only through that same account-scoped lookup, and served over links that expire.
• Encrypted in transit and at rest. Your data is encrypted on the wire and encrypted where it is stored, across our database, file storage, and backups.
• Never sold, never used to train an outside AI. We do not sell your data or use it to serve advertising, and your content is never used to train our AI provider’s models. AI features send only the data needed to answer the request you make. If you rate an AI answer and have Improve Tideway AI switched on, we keep that request and answer to improve our own features, as described under AI features above.
• Yours to export or erase. You can export a full copy of your data at any time, and you can permanently delete your account and all of its data yourself from Settings.

These providers store data on servers located in the United States (our file storage and hosting may serve content from a global edge network). Because Tideway is operated from Canada and relies on providers in the United States and elsewhere, using the Service involves a cross-border transfer of personal information. By using the Service, you consent to this transfer.

We implement reasonable technical and organizational safeguards to protect personal information against unauthorized access, disclosure, or loss, including access controls, encryption, and audit logging. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

We share personal information only with the trusted service providers who process data on our behalf to run the Service. We do not sell, rent, or trade your personal information, and we do not share it with third parties for their own marketing.

They fall into these categories:

• Identity and authentication
• Database hosting for your account, business, and waitlist records
• File storage and content delivery
• Application hosting, security, and performance monitoring
• Product and web analytics, including session replay on the marketing website
• Error monitoring
• Email delivery, both transactional (invoices, reminders, portal invitations) and marketing (waitlist and product announcements)
• AI model processing, for the AI features described above
• Payment processing and subscription billing

Our Sub-processors page lists every one of these providers by name, what it processes, where it stores that data, and the safeguard covering the transfer. It is the authoritative list, and we update it before we add a new provider.

Each provider is contractually bound to protect your information and use it only to provide services to us. We may also disclose information if required by law, to enforce our Terms of Service, or to protect the rights, safety, or property of Tideway, our users, or the public.

You can control much of the optional data we collect:

• In the app: the Settings → Data & privacy screen lets you turn off usage analytics and performance data collection. Turning off usage analytics disables product-analytics tools (PostHog and Vercel Analytics); turning off performance data disables performance monitoring (Vercel Speed Insights).
• AI: rating an AI answer is always your choice, and the same Settings → Data & privacy screen holds the Improve Tideway AI switch, which decides whether a rated request and answer are kept for us to learn from. It is off unless you turn it on.
• Marketing email: every waitlist and announcement email includes a one-click unsubscribe link, and we honor it immediately.
• In your browser: you can block or clear cookies, and you can install the Google Analytics opt-out browser add-on to stop Google Analytics measurement.

Some information (such as security logs and functional cookies needed to sign in) is required to operate the Service and cannot be turned off while you use it.

We retain your personal information for as long as your account is active or as needed to provide the Service. When you delete data inside Tideway, it is moved to a recoverable state and then permanently removed on a rolling basis (files in Trash are typically purged within 30 days).

You can permanently delete your account at any time from Settings → Account in the app. When you confirm deletion, we immediately and irreversibly erase your account and all associated records from our database, delete your uploaded files from storage, and delete your sign-in identity, so your data cannot be recovered and the same credentials cannot sign back in. Residual copies may persist for a short period in routine encrypted backups that age out (typically within 30 days), and we may retain limited information where the law requires it (for example, fraud-prevention records). Because deletion is permanent, we prompt you to export your data first. Waitlist records are kept until you unsubscribe or ask us to remove them.

Under applicable privacy legislation, you have the right to:

• Access the personal information we hold about you
• Correct inaccurate or incomplete information
• Export a copy of your data in a portable format (Tideway offers full and per-entity CSV export at any time from Settings)
• Withdraw consent to our collection or use of your information, subject to legal or contractual limits
• Request deletion of your personal information

To exercise any of these rights, use the controls in Settings or contact us at the address below. We will respond within 30 days. If your request concerns personal information about one of your own clients that you entered into Tideway, please direct it to the business that collected it (which may be you).

Tideway is a business tool and is not directed at individuals under the age of 16. We do not knowingly collect personal information from children. If you believe a child has provided us with personal information, please contact us and we will delete it promptly.

We may update this Privacy Policy from time to time. When we do, we will revise the “last updated” date at the top of this page. For material changes, we will notify registered users by email. Continued use of Tideway after changes take effect constitutes acceptance of the updated policy.

If you have questions or concerns about this Privacy Policy or our privacy practices, please contact us at:

Tideway
PO Box 1172
Vernon, BC V1T 6N4
Canada
privacy@tideway.co

You also have the right to file a complaint with the Office of the Privacy Commissioner of Canada or your applicable provincial privacy commissioner.