Privacy Policy

Tearoff is operated by Marco Mezzavilla, the data controller. For privacy questions or requests, email info@tearoff.app.

• Account details: your email address, login requests, and optional display name and profile link. These let you sign in, manage your account, and choose how your name appears on flyers.
• Flyers and interactions: the text, image URLs, tabs, and other content you save, plus records of tabs being torn. A random visitor identifier helps prevent repeated tears on the same flyer. Published flyers and any creator details you choose to display can be viewed by other people.
• Payments: your email address, payment status, and Stripe customer reference. Stripe handles payment details on its checkout page; Tearoff does not receive or store your full card number.
• Technical and usage data: IP addresses, browser and device signals, page visits, and security checks are processed to operate the site, prevent automated abuse, and understand how the service is used.

Account and payment processing is necessary to provide the service you request. Security and service measurement support our legitimate interests in operating and improving Tearoff. We also process information where required by law. An email address is required to create an account; profile details are optional.

• Resend delivers login emails. Email correspondence sent to our contact address is handled through Fastmail.
• Stripe processes payments and checks transactions for fraud.
• Cloudflare Turnstile checks login requests for automated abuse. The invisible check processes IP addresses and browser/device signals. Its use is covered by the Cloudflare Turnstile Privacy Addendum.
• Umami Cloud provides usage statistics, such as visited pages, referrers, browser/device type, and approximate location. Its web tracker does not use cookies.
• Gravatar supplies account avatars using a hash of your email address. Bunny Fonts supplies web fonts. Your browser also contacts external image hosts when displaying linked images. These requests expose technical information such as your IP address to those providers.

Tearoff's application server is hosted by Hetzner in Germany. Other providers may process data in countries outside your own, including outside the EEA. Contact us for details about the providers, locations, and applicable transfer safeguards.

Tearoff uses session and sign-in cookies to keep you logged in and protect requests. When you visit a flyer, the tearoff_visitor cookie stores a random identifier for up to one year to remember tab interactions. You can clear cookies in your browser, but doing so may sign you out or reset these features.

• Accounts and flyers: retained while your account remains open, unless you delete the content or request account deletion. We do not automatically delete accounts or flyers simply because they are inactive.
• Login requests: links expire after 15 minutes. The associated records are kept for a further 24 hours and then removed by an hourly cleanup task.
• Security counters: email rate-limit counters expire within 15 minutes and IP rate-limit counters within one hour.
• Application logs: rotated daily. A daily cleanup removes application log files once they are older than 30 days.

Web-server access logs have separate retention settings from application logs. Email delivery records, analytics, support correspondence, and payment records held by our providers follow the retention settings and obligations of those services, as described in their linked privacy policies. Records needed for accounting, legal obligations, or resolving disputes may need to be kept after account deletion.

You can edit profile information and delete flyers from your account. To request access, correction, account deletion, restriction, or a portable copy of your personal data, email info@tearoff.app. You may also object to processing based on legitimate interests and withdraw consent where processing relies on consent. These rights apply subject to the conditions in applicable law.

You can lodge a complaint with your local data protection authority, including the Italian Garante per la protezione dei dati personali.