Privacy Policy

Last updated: June 17, 2026

TileToday ("we", "us", or "our") operates tile.today. This Privacy Policy explains what information we collect, how we use it, and the choices you have. By using TileToday you agree to this policy.

1. Information We Collect

Account information

When you sign up we collect your email address and, if you choose to sign in with Google, your Google account name and profile photo. This is handled by Clerk, our authentication provider. We store your chosen username and profile photo in our database.

Location data

Claiming a square requires you to share your GPS coordinates with the app. We collect your latitude, longitude, and GPS accuracy at the moment of each claim. This data is stored permanently and associated with your account to verify physical presence and display your activity on your profile.

User content

Text descriptions and URLs you add to tiles you own are stored in our database and displayed publicly on the map to all visitors.

Usage data

We store your claim history (which squares you have claimed and when) and your daily claim count. We do not use third-party analytics trackers.

Rate limiting data

Your IP address is temporarily stored in an in-memory cache (Upstash Redis) solely to enforce rate limits. This data expires automatically within minutes and is never linked to your account or retained long-term.

2. How We Use Your Information

To operate the service: verifying GPS claims, displaying the map, and managing your account.
To show your public profile: your username, avatar, claim count, and activity history are visible to other users.
To enforce usage limits: daily claim limits and rate limiting to protect the platform from abuse.
To contact you: we may send account-related emails (e.g. email verification, password reset) via Clerk. We do not send marketing emails without your explicit consent.

3. What We Share and With Whom

We do not sell your personal data. We share data only with the service providers necessary to operate TileToday:

Clerk (clerk.com)

Authentication, session management, and profile photos. Clerk processes your email address and OAuth data. Clerk's own privacy policy applies to data they hold.

MongoDB Atlas

Our primary database, hosted on MongoDB Atlas. Your account data, GPS claims, and tile content are stored here.

Vercel

Our hosting provider. Vercel processes network requests including IP addresses in server logs for standard operational purposes.

Upstash

Redis-based rate limiting. Only your IP address is processed, transiently, to enforce API rate limits.

CARTO

Map tile provider. CARTO serves the map imagery you see. Your GPS coordinates are never sent to CARTO — only your general viewport (the area of the map you are looking at) is implicit in which tiles are loaded.

4. Location Data

Your precise GPS coordinates are collected only at the moment you tap "Claim this square". The app requests your location continuously while the map is open so it can show your position and enable the Claim button — this continuous location is processed only in your browser and is never sent to our servers until you initiate a claim.

GPS coordinates from each claim are stored permanently in our database. Your claimed squares and their general locations are visible on your public profile. We do not track your location at any other time.

5. Cookies and Local Storage

We use cookies solely for authentication. Clerk sets a session cookie when you sign in, which keeps you logged in between visits. This cookie is essential for the service to function and cannot be opted out of while using the app.

We do not use advertising cookies, cross-site tracking cookies, or fingerprinting of any kind.

6. Data Retention

Your account data, GPS claims, and tile content are retained for as long as your account is active. If you delete your account (via your Clerk account settings), we will delete your associated profile and claim data from our database within 30 days.

Tile content (descriptions and URLs) you have set on squares you own will be removed or anonymised when your account is deleted.

7. Your Rights

Depending on where you live, you may have the following rights regarding your personal data:

Access: Request a copy of the personal data we hold about you.
Correction: Update your username or profile photo via the profile page at any time.
Deletion: Request deletion of your account and associated data.
Portability: Request an export of your data in a machine-readable format.
Objection: Object to processing of your personal data in certain circumstances.

To exercise any of these rights, contact us at privacy@tile.today.

8. Children

TileToday is not directed at children under the age of 13. We do not knowingly collect personal data from children under 13. If you believe a child under 13 has provided us with personal data, please contact us and we will delete it.

9. Security

We use industry-standard measures to protect your data: HTTPS for all connections, authentication via Clerk (which handles password hashing and OAuth security), and access-controlled database credentials. No method of transmission over the internet is 100% secure, and we cannot guarantee absolute security.

10. Changes to This Policy

We may update this Privacy Policy from time to time. We will update the "Last updated" date at the top of this page. For significant changes, we will notify you via email. Continued use of TileToday after changes constitutes acceptance of the updated policy.

11. Contact

For privacy-related questions or requests, contact us at privacy@tile.today.