Chores Privacy Policy

Who we are

Tinyhat is a Tinyloop product. This policy covers the Chores plugin, its connected service and Chores website. For privacy questions or requests, email privacy@tinyloop.co. Other Tinyhat products have a separate privacy policy.

Information we receive and why

Guide searches. We receive the chore description, city or region, and guide you request to find relevant home-service guidance. You can browse public guides without signing in.
Job briefs and submissions. When you submit a chore or guide suggestion, we receive the text file, filename, service and location you include. A brief may contain contact details, a service address, equipment details, availability and other job instructions. Send only what the job needs. We save submissions with your account so we can review them, report their status and avoid duplicate requests.
Account and sign-in information. We process your email address, account and user identifiers, sign-in challenges and codes, verification attempts, session records and connected-client permissions to verify ownership and protect private chores. If you choose Google sign-in, we process Google's verified identity response to confirm your email account. Dedicated reviewers can use a password checked against an existing allowlist and a password verifier; ordinary accounts use email or Google sign-in. Native plugin connections use Tinyhat's secure sign-in page; coding clients can also use Tinyhat's email-code authentication API. Keep sign-in credentials out of Chores tool arguments, searches and job files. Do not include passwords, API keys, payment-card data, government identifiers or medical records.
Decisions and diagnostics. We save submission and delivery times, approval or cancellation decisions, decision-maker identifiers, status and error codes, retry identifiers and hashes (digital fingerprints) of requests and responses. Authenticated events may be linked to account and user identifiers. These records support status checks, security, troubleshooting and duplicate prevention. Our application audit records use hashes of search text, locations and private content rather than raw copies; public guide responses may be recorded. Hashes can still be linked to you and do not make this information anonymous. Website and GET search API requests put search text and city or region in the URL, which our hosting provider's request logs can record alongside IP addresses and browser information. Rate-limit keys use hashes of IP addresses or sign-in identifiers.

We do not sell personal information.

Who receives information

Tinyhat's team and Slack. Submitting a delegation requires your permission to share the complete submitted file and its service and location with Tinyhat's internal team in Slack for review. Sharing can occur while the request is pending, before it is approved or automatically declined. A decline does not erase that copy. Manual chore and guide submissions may also be shared in full with the internal team for review. If Tinyhat accepts provider coordination, job details needed for outreach may be shared with service providers within the scope you authorize. Acceptance does not itself authorize bookings or payments.
ChatGPT or Codex. The host processes your conversation and tool requests under its own policies. Tool results can include guide content, job labels, filenames, file hashes, delegation identifiers, decisions and their reason codes, deadlines, content expiry or deletion times, and delivery status. The Chores panel receives your account email and display name and your chore summaries to show your work. When signed out, the host may supply a display-only identifier that the panel receives; it does not establish ownership or provide access to private chores. Disconnecting the plugin does not delete your host conversation.
OpenAI for optional search. Only when you opt in for that search, we send its chore description and city or region to OpenAI's API to match guides. This search does not send your account, uploaded job brief or sign-in information. You can choose search without this model step instead.
Service providers. We use cloud hosting, database and network providers to operate the service, and Resend to deliver sign-in email. They process the information needed for those functions. Google handles optional Google sign-in and receives its authorization requests. We may also disclose information when required by law or to address fraud, abuse or security incidents.

Information held by other services is also subject to their policies: OpenAI, Slack and Resend, and Google.

How long information stays

Delegation files. The service supports removal of backend file content, filename, service and location after 30 days from submission when automatic retention is enabled. This is not an unconditional deletion deadline: without that setting, content has no automatic age-based expiry. You can request file removal sooner through the plugin's removal action.
Account, submission and audit records. Account records, manual chore or guide submissions, diagnostic records and the minimal decision, ownership, hash and retry records kept after file removal have no automatic age-based expiry in the current service. Contact us to request deletion of information we control.
Sign-in validity. Email codes and connection flows expire after 10 minutes, authorization codes after one minute, and Google sign-in attempts after five minutes. Access tokens expire after at most 15 minutes, and owner sessions after 30 days. Refresh access cannot outlive its owner session. Expiry or revocation of a reviewer allowlist entry or verifier also stops its access. Credential expiry stops use of a credential; it does not mean every related database record or delivery log is deleted. Rate-limit counters expire after their short enforcement window, normally one minute or one hour.
Copies elsewhere. Slack copies follow the workspace's retention settings. Cancellation and file removal cannot recall those copies or delete ChatGPT, Codex, email or service-provider records. Their retention may differ from ours.

Your choices and deletion requests

You can browse without an account, decline optional model search, decline team sharing, read a delegation's status, or cancel a pending delegation. Once the team has approved a delegation, contact Tinyhat to agree a handback of provider coordination.

Confirming file removal permanently clears that delegation's backend file and service/location labels and cancels it if still pending. It preserves the decision, ownership, hashes and retry record. It does not reverse an approved delegation. Signing out or disconnecting access is separate from requesting data deletion.

Email privacy@tinyloop.co to request access, correction, export or deletion of personal information Tinyhat controls. Identify the account or submission involved, but do not send credentials. We may need to verify your identity and retain records needed for security, disputes or legal obligations. For product help, see Support.

Website analytics and cookies

Clean public directory and reference pages use Google Analytics for page visits, with first-party cookies, the page path and title, referring site's origin, and technical information such as browser and IP address. Search URLs, private chore data and this policy page are excluded from that analytics collection. You can block analytics cookies or scripts in your browser and still use Chores. Google handles analytics data under its privacy policy.

Security and policy changes

We use HTTPS, server-side ownership and permission checks, and hashed sign-in credentials to protect access. No system can guarantee absolute security. We will update the date on this page when this policy changes. Contact privacy@tinyloop.co with questions.