Privacy Policy

Last updated: 12 November 2026

1. Summary

• TweakTick stores what is needed to run client reviews and approvals. We don't sell personal data and we don't show ads.
• No tracking cookies in the app or on client review pages. They use only the cookies needed to keep you signed in. Our public website counts visits with Google Analytics, with no advertising features, and sets no analytics cookies for visitors in the EEA, UK and Switzerland (section 6.1).
• For the work and comments inside a workspace, the agency is in charge of the data (the "controller") and TweakTick handles it on its behalf (the "processor").
• Approval records are kept even after deletion, because they are a record of what was agreed.

2. Who we are

TweakTick is run by TERRANOAH ECOM VENTURES (OPC) PRIVATE LIMITED, D/1401 Kanakia Sevens, Andheri Kurla Road, Marol Naka, Mumbai, MH 400059, India.

Contact for privacy questions, requests and complaints (including our grievance contact under India's Digital Personal Data Protection Act, 2023): support@tweaktick.com.

3. Our two roles

If you are a client who was sent a review link: the agency that sent it decides what is collected and how long it's kept. Please send requests about your data to that agency first. If you can't reach them, contact us and we'll pass it on or help where we can.

4. What we collect

Agency users

• Account: name, email, a securely hashed password (or your Google account ID and email if you choose "Sign in with Google").
• Workspace: projects, files, comments, team members, settings.
• Billing: plan, payments and invoices. Card or bank details are handled by the payment provider you use: Paddle (when you pay through Paddle; Paddle is the reseller and Merchant of Record) or Razorpay (when you pay through Razorpay), or AppSumo for AppSumo deals, or the marketplace you bought a code from (for example Dealify); we don't store full card details. For Indian businesses, an optional GSTIN.
• Security: sign-in sessions, and a log of owner-level actions (for example API keys or members added or removed) with the IP address.
• Mobile app: if you install the TweakTick app and allow notifications, a device push token. Notifications carry only short titles (for example a project name), never comment text.

Clients (guests)

• The name and email you type when you start commenting, your comments, pins, drawings, voice notes and attachments.
• When you approve: your name, email, the approved version, the time, your IP address and browser details. This goes into the sign-off record (section 8).
• Which screen sizes and versions you viewed, so the agency can see progress.
• Technical details with a comment you leave on a live website, if the agency has this on (it is on by default): your browser and operating system, screen size, language, time zone, the page address without its query string, errors and warnings the page logged, requests that failed, and the clicks, page changes and scrolls of the 2 minutes before the comment. Never what you type, cookies, browser storage or the contents of requests. Email addresses, codes and tokens are removed before saving. Only the agency's team sees them; they are deleted with the comment.

Files under review

• Screenshots of the website being reviewed, and uploaded images, PDFs, videos, audio and other files. These can contain personal data if the work itself does.

5. How we use it

• To run the Service: show reviews, take screenshots, convert files, send notification and approval-code emails.
• To keep it secure: rate limits, abuse prevention, error tracking, and a "verify you are human" check (Cloudflare Turnstile) on sign-up, sign-in code, waitlist and Founding checkout forms. Turnstile receives your IP address and browser signals from that form only, and Cloudflare's privacy policy applies to it.
• To bill customers and meet tax and legal duties.
• To answer support requests.

TweakTick staff may access account data when needed for support, billing and security, and every such access is logged.

We don't use workspace content to train AI models, and we don't build advertising profiles.

Legal bases (GDPR): contract (running the Service you signed up for), legitimate interests (security, fixing errors, counting visits to our public website), legal obligation (tax records). Where the agency is the controller, it chooses the legal basis for its clients' data.

6. Cookies and similar storage

In the app and on client review pages we use only necessary cookies:

• Agency sign-in session (pr.session_token).
• One review session per project for clients (pr_g_…), so you don't have to enter your name again.
• Short-lived cookies during sign-up, payment and licence redemption.

No analytics, advertising or third-party tracking cookies in the app or on client review pages. The Turnstile check (section 5) runs in a Cloudflare frame on those forms and on the four screenshot free tools only. The video uploader keeps unfinished upload details in your browser's local storage so an upload can resume.

6.1 Analytics on our public website

• Our public website (every logged-out page on tweaktick.com, such as the home page, pricing, the Founding page, comparisons, integrations, free tools, help, legal pages and sign-up) uses Google Analytics to count visits and see which pages are useful. The app, client review pages and review links never load it.
• Four free tools (website screenshot, mobile-friendly test, website mockup and visual regression check) send the web address you type to our capture server, which takes the screenshot and sends it straight back. The screenshot is not kept. To stop abuse we count requests per IP address for one day and use the same Turnstile check.
• Visitors in the EEA, the UK and Switzerland get no analytics cookies. Google only receives cookieless signals (which page was visited, with no identifier that recognises you on a later visit).
• Visitors elsewhere: Google Analytics sets first-party cookies on tweaktick.com (_ga and _ga_…) that last up to 2 years, so a repeat visit is counted once.
• What Google receives: the page address (only campaign tags such as utm_source are kept from the link; anything else after ? is removed), the page title, your browser and device type, and an approximate location from your IP address. When a sign-up form is sent we record that a sign-up happened, never who. We never send your name, email or anything from a workspace or a review.
• No advertising features and no Google signals. The data is not used for ads.
• Google Analytics keeps this data for 14 months, then deletes it.
• Google is listed on the Sub-processors page.

7. Optional features that send data elsewhere

• AI review is off by default. If a workspace owner turns it on, they add their own key for an AI provider they choose (for example Anthropic, OpenAI, Google or OpenRouter), and review images are sent to that provider. That provider's terms apply.
• Email client previews send the HTML of the email being reviewed to Mailgun to render, only when someone starts a preview. We save the result screenshots with us and then ask Mailgun to delete the test.
• Integrations and webhooks a workspace connects receive the review events the workspace chooses to send. Details for each kind are in the sections below.
• Workspace email (SMTP): if an agency sends client emails through its own mail server, that provider handles those emails.
• Mobile push notifications go through Expo, and then Apple or Google, only for team members who install the app and allow notifications.
• YouTube videos: when an agency asks for feedback on a YouTube link, the video plays in YouTube's own player (youtube-nocookie.com). Nothing loads from YouTube until you press play. After you press play, Google receives your IP address and browser details, and YouTube's privacy policy applies to that player. We don't send YouTube your name or email, and TweakTick itself sets no tracking cookies for it.

7.1 Browser extension (Chrome)

The TweakTick extension has two uses: clients leave feedback on a site they were sent a review link for (including sites that block the review script), and members of a TweakTick workspace leave comments with a screenshot on any page ("team mode").

• Where it runs: only on the tab where you click the TweakTick button, and only after that click. On a tab you opened from a TweakTick review link it shows the review tools. On any other web page it takes one screenshot of the visible part of that tab and opens it in the extension's own editor (team mode). It does not read or change other tabs or sites, and it does nothing in the background.
• Permissions: activeTab (the tab you clicked), scripting (to show the review tools on that tab, and to read that tab's window size, language, time zone and title), storage (see below) and identity (the sign-in window for team mode).
• What the extension stores: for review links, a short-lived sign-in for that tab, kept in the browser's memory and cleared when the browser closes. In team mode, the screenshot you just took, in the browser's memory until you post it (at most 4), and your TweakTick sign-in (access and refresh tokens) plus your workspace's name in the extension's own local storage, encrypted with a key kept only inside the extension, until you press Disconnect, which deletes them and asks our server to revoke them. Websites cannot read the extension's storage.
• What it keeps on the reviewed website: so the review tools survive a page reload, they save your name and email, the project name, the review link and the review settings in that website's own session storage for the tab (under pr_ext: and the project's id). That website's own scripts can read it; your sign-in token is never stored there, and it is deleted when you close the tab. Team mode stores nothing on the website.
• What it sends to TweakTick, and only when you save or post a comment: for review links, the page address, your comment (with any drawing, voice note or attachment you add), where on the page you pinned it, your screen size, a picture of the area you pinned, and the name and email you typed to start commenting. In team mode, the page address and title, the screenshot with the pin, box or arrow you drew on it, where you marked it, your comment, whether the client may see it, and your window size; plus, if you choose "New project from this page", that page address as the new project's address. Technical details (browser and operating system, language, time zone, errors and warnings the page logged and requests that failed; for review links also the clicks, page changes and scrolls of the 2 minutes before the comment) are sent only when the workspace has them on, under the same rules as in section 4, and in team mode only when you leave "Attach technical details" ticked. Team-mode sign-in happens on app.tweaktick.com; the extension never sees your password.
• What it never collects: your browsing history, your keystrokes, passwords, cookies, browser storage or the contents of requests. A team-mode screenshot shows whatever is visible in the tab when you click, so check it before you post.
• The extension sends data only to TweakTick. We don't sell it, use it for ads or credit checks, or share it except as described in this policy.
• Chrome Web Store Limited Use: TweakTick's use of information received from the extension adheres to the Chrome Web Store User Data Policy, including the Limited Use requirements.

7.2 Figma plugin

• The plugin sends the frames you select, as PNG images with their frame names, to your TweakTick workspace. Nothing else from the Figma file is sent.
• It uses a workspace API key that you paste in. The key is stored in Figma's plugin storage on your computer, and Disconnect removes it.
• The plugin can only connect to tweaktick.com.
• To re-send a frame to the same project, the plugin saves the TweakTick project id in the Figma file, readable only by the plugin.

7.3 API keys, automation apps (Zapier, Make, n8n) and AI assistants (MCP)

• API keys are created by a workspace owner in Settings → API. We store only a one-way hash of each key and its first 12 characters, so we can't show the key again. Owners can revoke a key at any time; revoking it also removes the automation hooks it made.
• Zapier, Make and n8n connect with an API key. They can read and write what the key's permissions allow (for example projects and comments, including commenters' names), and they receive the review events they subscribe to. They never receive internal comments, client emails, sign-in links, tokens or screenshots.
• AI assistants (MCP) connect with OAuth: the owner picks one workspace and approves the permissions. We store only one-way hashes of the access tokens (valid 1 hour) and refresh tokens (valid 30 days). Revoking in Settings → MCP deletes them. AI assistants can't approve work, delete anything, change access or email clients. Client-written comments are marked as untrusted for the assistant.
• Each API and assistant call is logged (which tool, when, success or error), never its contents.
• Once data reaches Zapier, Make, n8n or an AI assistant, that service's own terms and privacy policy apply.

7.4 Connected tools (Slack, Jira, Linear, ClickUp, Trello, Todoist, Asana, monday.com, Airtable, Notion)

A workspace owner can connect these tools. The workspace chooses them; they are not our sub-processors (see the Sub-processors page).

• Sign-in tokens: each tool's access tokens are encrypted before they are stored, never logged and never sent to a browser. We also store the tool account's id and name, and the workspace or board the owner picks.
• What we send: for comments on projects linked to the tool: the comment text and author's name, the pin number, the project and round, a link back to TweakTick, a picture of the pinned spot, the names (not the contents) of attachments, and status, assignee, priority and due date changes. Slack gets notices of review events. Never client emails, sign-in links or tokens.
• Internal comments: task tools receive them marked "[Internal]" unless the owner turns on "exclude internal" for that project. Slack, webhooks, Zapier, Make and n8n never receive them.
• What comes back (two-way tools: Linear, ClickUp, Trello, Todoist): status changes, assignee and priority changes, and replies, with the replier's display name in that tool. Replies that come back are visible only to the agency unless the owner chooses to share them with clients.
• Team member matching: an owner can match TweakTick members to people in the tool. We store that person's tool account id and display name.
• Deleted accounts: each week we ask Atlassian (Jira) which matched accounts were closed or changed, and delete or refresh the names we hold. We run the same kind of check with Trello for removed members.
• Disconnect: removes the tool's webhooks, asks the tool to cancel our access where the tool supports it, and deletes the stored tokens.
• Inbound tool events are kept for 30 days, then deleted.
• Each tool's own terms and privacy policy apply to the data it holds.

8. The sign-off record

When a client approves, TweakTick writes an append-only, hash-chained record (each entry includes a fingerprint of the one before, so changes can be detected). The database does not allow these records to be edited or deleted.

This record is kept after the project, workspace or account is deleted, because it is the evidence of what was agreed. We keep it for at least 6 years after the last approval in the project.

9. How long we keep data

When a workspace is deleted, its projects, files and comments are deleted from the live system (files by a background job shortly after). Copies in backups expire on the schedule above.

10. Who we share data with

Only with the service providers that help us run TweakTick, listed on the Sub-processors page, and when the law requires it. We don't sell personal data.

We don't share your personal data with any other third party without your consent. Data goes to a tool your workspace connects (such as Slack, Jira or Todoist) only after you connect it and choose what to send, and you can disconnect it at any time (section 7.4).

11. International transfers

We are based in India and our servers are hosted by OVH in Canada (Beauharnois). Files are stored with Bunny.net in Germany, with a replica in Sweden, emails are sent through Amazon SES in the United States, server logs and metrics are sent to Grafana Cloud in India, and visit counts from our public website go to Google Analytics (Google LLC, United States). Some providers may process data in other countries. Where the GDPR applies, we rely on appropriate safeguards such as standard contractual clauses offered by those providers.

12. Security

Passwords are hashed with argon2id. Secrets you give us (AI keys, integration tokens, staging logins) are encrypted. Website screenshots are taken in a separate, isolated, locked-down container. More on the Security page.

13. Your rights

Depending on where you live (for example under the GDPR or India's DPDP Act), you can ask to:

• see the personal data we hold about you, and get a copy;
• correct it;
• delete it (except records we must keep, such as sign-off records and tax records);
• object to or restrict some uses, or withdraw consent where we rely on it;
• nominate another person to act for you (DPDP Act).

Agency users can delete their account in Settings → Account and workspace owners can export a workspace there too. For anything else, email support@tweaktick.com. We reply within 30 days. If you're a client, the agency that sent you the link handles most requests (section 3).

If you're not happy with our answer, you can complain to your data protection authority (in India, the Data Protection Board of India).

14. Children

TweakTick is for businesses and is not meant for anyone under 18.

15. Changes

We'll update the "Last updated" date when this policy changes and tell account owners by email about important changes.