Privacy Policy

Cadmium Creations LLC

Effective: October 26, 2026. Version 2.0.

Key Privacy Points

• Our money comes from one-time purchases, memberships and affiliate commissions. Never from your data. We will never sell, rent, or trade your personal information to anyone.
• We don’t run ads. There are no advertisers to share your data with. There never will be.
• Your artwork is yours. We never use your creative work for marketing, AI training, or any purpose other than showing it back to you inside the app.
• Our analytics are anonymous. We use privacy-preserving analytics that don’t track you personally. No cookies, no device fingerprinting.
• You can delete everything. You can delete your account and all associated data at any time.
• We designed for privacy from day one. Our architecture stores data locally on your device first, syncing to our servers only when needed.

1. Who We Are

Tidepost is operated by Cadmium Creations LLC, a California limited liability company. When this policy refers to “Tidepost,” “we,” “us,” or “our,” it means Cadmium Creations LLC.

For users in the European Economic Area (EEA) and United Kingdom (UK), Cadmium Creations LLC is the data controller responsible for your personal data.

Email: hello@cadmiumdev.com
State of Organization: California, United States

2. What We Collect and Why

We collect only what we need to make the app work for you.

Account Information

Email address, password (encrypted), display name (optional), creative discipline, and schedule preferences. Used to create and manage your account and personalize your curriculum. You can use Tidepost without an account; an anonymous identifier then stands in for an account until you create one.

Curriculum Progress

Lesson completion status, day count, phase progression, and checkpoint responses. Used to track where you are in the 90-day curriculum.

Your Creative Content

Studio Log entries, session reflections, cognitive reframes, and your project card, next steps and Practice Plan. Stored locally on your device and synced for backup. The name of the person you show your project to stays on your device and is never sent to us. We never use your creative content for marketing, AI training, or any purpose beyond providing the Service to you.

Purchase Information

Purchase status (the Foundation and Studio Membership), billing period dates, the platform of purchase, and whether an access code was redeemed. Payment card details never reach us.

Anonymous Usage Analytics

Aggregated, non-identifiable interaction data collected without cookies or device fingerprinting. We cannot identify any individual user from this data. You can turn analytics off in Settings at any time.

Crash reports

When the app crashes or hits an error, a report goes to Sentry: the device model, the operating system and app versions, and where in the code the error happened. Reports never include your lessons, notes, project, reframes or Practice Plan, and they aren’t linked to your account.

Communications

If you contact us for support, we retain the content of your messages and our responses.

3. What We Never Collect

• We never collect your location data
• We never access your contacts, camera roll, microphone, or other device sensors beyond what you explicitly initiate
• We never collect data from other apps on your device
• We never use device fingerprinting or advertising identifiers
• We never set cookies or use local storage for tracking
• We never build behavioral profiles of individual users
• We never purchase data about you from data brokers

4. Our Service Providers

We work with a small number of carefully selected service providers:

• Supabase: database, authentication and serverless functions. SOC 2 Type 2 certified. Data encrypted at rest (AES-256) and in transit (TLS).
• RevenueCat: purchases and entitlements. Receives your app user identifier, never your name or email address. SOC 2 Type II certified.
• Stripe: web payments on tidepost.app. Your payment card details go to Stripe and never reach us.
• PostHog: anonymous analytics in cookieless mode. Data stored in the United States. SOC 2 certified.
• Sentry: crash reports, with no account or content attached. Data stored in the United States.
• Resend: account emails (confirmations and password resets). Receives your email address only to send them.
• The Metropolitan Museum of Art API: public-domain artwork. Artwork is requested from the MET’s public API directly from your device, so the MET’s servers see your device’s IP address, as any website would. No account information is sent.
• Apple and Google: app distribution and in-app payments.
• Cloudflare: hosting for tidepost.app.

5. Affiliate Links and Third-Party Websites

Tidepost includes curated book recommendations. Some are affiliate links to Amazon.com and Bookshop.org. If you make a purchase, we may earn a small commission at no extra cost to you.

When you tap a link, you leave Tidepost and are subject to that website’s privacy policy. We may receive aggregated commission reports but not your personal purchase details or browsing history.

6. Your Rights and Choices

• Access: request a copy of all personal data we hold about you
• Delete: delete your account and all associated data at any time, using the controls in the app or on tidepost.app/delete-account
• Correct: update inaccurate personal information
• Export: take a portable copy of your data in a standard format (JSON) from Settings, Export my data
• Opt Out of Analytics: disable anonymous usage analytics in Settings
• Withdraw Consent: where we rely on consent, you can withdraw it at any time

Exercise any of these rights by emailing hello@cadmiumdev.com or using the controls in the app. We respond within 30 days and will never charge a fee or degrade your experience.

7. For Users in the EEA and UK

We process your personal data under GDPR lawful bases: performance of a contract, legitimate interest, consent, and legal obligation.

For international data transfers, we rely on the EU-U.S. Data Privacy Framework and Standard Contractual Clauses. Our analytics and database can be configured to process data within the EU.

EEA and UK residents additionally have the right to restrict processing, object to processing based on legitimate interest, and lodge a complaint with their local data protection authority.

8. For California Residents

Under the CCPA/CPRA, we collect identifiers, commercial information, anonymous network activity, and creative content you upload.

We do not sell or share your personal information. We have not sold or shared personal information in the preceding 12 months.

California residents may request to know, delete, or correct their personal information by contacting hello@cadmiumdev.com. We respond within 45 days.

9. Data Retention

• Active account data: retained for account duration + 30 days after deletion
• Purchase records: retained for account duration + 7 years (tax compliance)
• Anonymous analytics: up to 24 months, then purged
• Support correspondence: 2 years after most recent message
• Creative content: deleted within 30 days of request or account deletion

10. Security

• All data encrypted in transit (TLS) and at rest (AES-256)
• Row-level security enforced at the database level
• Authentication tokens stored using platform-native secure storage
• Local-first architecture reduces exposure to server-side breaches

In the event of a data breach, we will notify affected users and relevant authorities within required timeframes (72 hours under GDPR).

11. Children’s Privacy

Tidepost is not directed at children. You must be at least 16 years old to use the Service. We do not knowingly collect personal information from anyone under 16.

12. Changes to This Policy

We will notify you at least 30 days before material changes take effect, via in-app notification and email where possible. If you disagree, you may close your account before the changes take effect.

13. Contact Us

Cadmium Creations LLC
Email: hello@cadmiumdev.com
State of Organization: California, United States

For GDPR-related inquiries, include “GDPR Request” in your subject line. For CCPA requests, include “CCPA Request.” We respond within 30 days.

This page is generated from the text in the Tidepost app, so the two always match.