Tideora privacy policy

1. Who is responsible for your data

The controller is Ville Similä, a private person. There is no company behind Tideora.

Privacy questions: tideora@mail.grokbot.com

2. What we process and why

The statistics do not include your user id. They are linked to you only with a secret hash, so they can be deleted when you delete your account.

Location: We do not store a GPS trail. If you use GPS in Discover, the location is used only for that search. We store only your home location and a place you choose yourself.

3. Aamubrief and AI

Aamubrief is a Plus feature, and it is off by default. When you turn it on, we write the brief with Google’s Gemini AI. Gemini receives only:

• the names and times of the day’s events
• place names
• weather, traffic and public-holiday information
• at most three of your earlier briefs.

Gemini does not receive your email address, your user id or your coordinates. Note, though, that an event title can contain someone’s name if you wrote it there yourself.

If you ask the AI for tags on a public event, Gemini receives the event name, description, the organizer’s name and the place.

4. Weather and traffic

• The Finnish Meteorological Institute and Fintraffic do not receive your location. We fetch warnings and traffic information for the whole of Finland and compare them with your home location on our own server.
• MET Norway (Norwegian Meteorological Institute) receives the coordinates of your home location for the morning-brief forecast and the sunset time, but not your name or your email. The request identifies Tideora. Forecast and sun data are used under CC BY 4.0.
• The US National Weather Service receives the coordinates of your home location when your home is in the United States, so the morning brief can include an active weather alert. It does not receive your name or your email. The request identifies Tideora.
• Google Places receives the text you type in place search and an approximate location hint: your GPS location if you have allowed it, otherwise a place inferred from the IP address, or central Helsinki.
• Public holidays come from the offline date-holidays dataset (CC BY 3.0) for your country. Nothing about you is sent. Crisis bulletins (GDACS, USGS) are fetched without personal data.

5. Who we share data with

We use the following services to run Tideora:

When data is transferred outside the EU and the EEA, the transfer is based on safeguards approved by the EU, such as standard contractual clauses or the EU–US Data Privacy Framework.

6. How long we keep data

• Account details, your profile, events, messages, friends, notifications and briefs stay until you delete them yourself or delete your account.
• A password-reset link expires in one hour, and an email confirmation link expires in 24 hours.
• Unfinished event drafts are deleted after about a day.
• Your sign-in cookie lasts 30 days.
• By default we import calendar events for 12 months.
• How long we keep server logs: [CHECK]

7. When you delete your account

You delete the account in Settings. You confirm by typing the word DELETE and your password.

Removed:

• your account, profile, profile photo and sign-in details
• your own events and friends’ events, with their cover images, including events imported from a calendar
• your messages, votes, attendances, saves, invites, friends and blocks
• your notifications, push subscription, calendar connections, briefs and two-factor authentication data
• statistics that relate to you.

Moved or kept:

• Group and public events move to another admin. If you are the only admin, they are deleted. The same applies to groups and organizations.
• Photos you added to events that are kept stay visible. They are transferred to the event organizer.
• Other users’ accounts, messages and photos remain.

Account deletion does not reach these: emails already sent through Resend, Google’s Gemini logs, server logs, test feedback sent to GitHub, and Google and Microsoft calendar permissions. Instructions for removing those permissions are below.

8. Disconnecting a calendar

When you disconnect a calendar, Tideora deletes the access tokens and hides the imported events. The events are deleted completely only when you delete your account.

Also revoke access on the service’s own page:

• Google: Google Account → Security → Third-party connections (myaccount.google.com/connections) → Tideora → Remove connection. Tideora also tries to revoke the Google permission itself when you disconnect the calendar.
• Microsoft: Microsoft account → Privacy → Apps and services (account.live.com/consent/Manage) → Tideora → Remove permissions. For a work or school account, contact your organization’s admin if you need to. Tideora does not revoke the Microsoft permission automatically.

9. Cookies

We use only cookies the service needs in order to work:

• sign-in cookie (30 days)
• time zone and clock format
• a short-lived cookie for connecting a calendar (10 minutes).

We do not use advertising or tracking cookies.

10. Your rights

You have the right to:

• access your data
• correct inaccurate data
• erase your data (you can also delete your account yourself in Settings)
• restrict processing
• object to processing that is based on legitimate interest
• transfer your data to another service
• withdraw your consent at any time, for example by turning off Aamubrief, push notifications or a calendar connection.

The app does not yet have its own button for downloading your data. Ask for a copy at tideora@mail.grokbot.com. We reply within 30 days.

If you are unhappy with how we process your data, you can complain to the Office of the Data Protection Ombudsman: tietosuoja.fi.

11. Changes

When this policy changes, we update the date at the top of this page. We tell you about major changes in the app.