Tillping Privacy Policy
Effective date: October 25, 2026
Tillping is operated by Hanna Rynkov, a sole proprietor (Osek Murshe) registered in Israel. She is responsible for your data. For any privacy question or request, email support@tillping.online.
What we collect
- Your email address, when you sign in or join our email list.
- The addresses and domains you add or scan, and the scan results: how the server answered, the findings and the fix steps.
- A hashed IP address. We scramble your IP address with a secret key and store that, not the raw address. We use it for rate limits, to stop abuse and for simple visit counts.
- Consent records: when you agreed to our terms, confirmed you may scan a site, or ticked the boxes at checkout.
- Plan and order details from Lemon Squeezy, such as your plan, status and dates. We never see your card number.
- Messages you send us.
Please never send us passwords, API keys or signing secrets.
If someone else scanned your site, we may hold its address and your server's answer. Email us to see it or delete it.
Why we use it
To run scans, sign you in, send sign-in links, alerts and service emails, manage plans and payments, prevent abuse, count visits without cookies, and meet legal duties. We only send our newsletter if you signed up and confirmed. Every newsletter has an unsubscribe link.
AI fix tips
Some fix tips are written by DeepSeek's AI, whose servers are in China. We send it only finding codes and titles, such as "redirect" or "HTTP 307". We never send your URLs, domain, IP address, email or any other personal data.
Who processes your data
| Company | What it does for us |
|---|---|
| Vercel | Hosts the website |
| Supabase | Database and sign-in |
| Resend | Sends our emails |
| DeepSeek | Writes AI fix tips (finding codes and titles only) |
| Lemon Squeezy | Payments, tax and invoices, as our Merchant of Record, under its own privacy policy |
We may also share data when the law requires it, to handle a complaint about an unauthorized scan, or with a new owner if Tillping is sold. We do not sell your data, and we don't use it for ads.
These companies may process data outside your country, including in the United States, and where the law requires it we rely on their standard data-protection terms.
How long we keep it
| Data | How long |
|---|---|
| Your account | Until you delete it. We delete it within 30 days of your request. |
| Scans from signed-in users | 12 months, or until you delete your account |
| Scans without an account | 30 days |
| Hashed IP address on a scan | 30 days |
| Visit counts | 12 months (the hashed visitor value is removed after 90 days) |
| Rate-limit records | 7 days |
| AI usage records | 90 days |
| Copies of emails we send | 30 days |
| Email list | Until you unsubscribe. We keep a note of the unsubscribe so we don't email you again. |
| Billing records and checkout consents | 7 years, because tax law requires it |
| Support emails | 24 months |
Our providers also keep short logs under their own settings.
Cookies
We only use essential cookies that sign you in and keep you signed in. No ad or tracking cookies.
Your rights
Email support@tillping.online to:
- get a copy of your data (we can export it as a file),
- correct it,
- delete your account and data, or
- object to how we use it, or withdraw your consent.
We reply within 30 days. You can also complain to your data protection authority. In Israel, that is the Privacy Protection Authority.
Children
Tillping is for people 18 and older. If a child has sent us data, tell us and we will delete it.
Changes
If we change this policy in an important way, we will email account holders before the change takes effect.