Privacy Policy
Who we are
tldr is a public-record service that tracks Terms of Service and Privacy Policy changes across hundreds of companies. It is run by a private individual in the Netherlands. You can contact us at hello@xo.vision.
What we collect
Analytics (Umami)
We use self-hosted Umami analytics to understand how the site is used. Umami is cookieless and collects no personal data automatically. It records: page URL visited, HTTP referrer, browser type and version, operating system, device class (mobile/desktop/tablet), country derived from your IP address (IP address itself is not stored), screen resolution, and a salted daily-rotating hash of your IP address and user agent as an anonymous visitor ID.
Public API requests
When you ask us to track a company (POST /api/v1/requests), we store the domain you named (for example, example.com), how many times it has been requested, and the dates of the first and latest request. A lookup (GET /api/v1/lookup) stores nothing. We also keep a daily count of how many lookups and requests the API answers, with no record of who made them. We do not store your IP address in the database.
Rate limiting
To prevent abuse, we keep track of API request rates per IP address in the web process memory. These in-memory counters are discarded after one hour and never written to disk.
The browser extension
The tldr browser extension runs on your device, in your browser. For each website you visit, it sends that site's hostname (for example, discord.com) to our lookup API (GET /api/v1/lookup) to check whether we track that company, and caches the answer for the rest of your browser session so the same site is not sent twice. It never sends the page URL, the page content, or anything you type. If you explicitly ask us to track a company, the extension sends that domain to our request API (POST /api/v1/requests). Your settings, per-domain "requested" and acknowledgement flags, and the short-lived lookup cache stay in your browser's extension storage; we do not receive them. The extension sends no telemetry, reports no usage, and makes no other network calls.
Support link
Our "Support this work" link directs you to Ko-fi, an external service. Ko-fi's own terms and privacy policy apply to any data you share there.
Why we collect it
Legal basis
We process analytics data and API request data on the basis of legitimate interest: to understand how the service is used, to prevent abuse and fraud, and to improve the site.
Data retention
Umami keeps its aggregate analytics until we delete them; no automatic retention period is set. Request counts (from the API) are kept for as long as the request is open (status: open, planned, added, or declined). In-memory rate-limit counters are discarded after one hour. Browser extension data is stored only in your browser and never sent to us.
Where data is processed
The tldr website and API run on a server in Nuremberg, Germany, hosted by Hetzner Cloud. The operator is based in the Netherlands. Your data therefore stays inside the European Union, and no transfer to a third country takes place.
No cookies
We do not set any cookies on the public site or extension. The extension uses browser storage APIs (chrome.storage.local and chrome.storage.session) which are not cookies.
No access logs
The web server (Caddy) is not configured to write access logs. HTTP request logs are not retained on disk. The operating system's service journal may record service errors.
Your rights under GDPR
If you are in the EU, you have the right to: access personal data we hold about you, rectify inaccurate data, request erasure (right to be forgotten), restrict processing, data portability, and object to processing. To exercise these rights, contact us athello@xo.vision. If you are named in a document we republish, you can also request removal of the full text from our removal-requests page.
Children
The site is not directed to children under 16, the age of digital consent in the Netherlands. If we learn that a child has given us personal data, we will delete it.
Changes to this policy
We may update this privacy policy. Material changes will be announced on this page with an updated effective date.
Contact
Questions about this privacy policy? Contact hello@xo.vision.