Privacy Policy

This policy describes what Tilion collects when you use tilion.dev, the dashboard, and the API (the “Services”), why we collect it, and what happens to it. The short version: we collect what running a browser service requires, your page traffic is processed to serve you and not mined, and we do not sell personal data.

1. What we collect

• Account data. Name, email address, and password hash, held by our authentication provider (Supabase).
• Payment data. Card type, last four digits, and billing address, held and processed by Stripe. Full card numbers never touch our servers.
• Usage and device data. IP address, browser type, request metadata, and analytics events on our own site (page views, interactions, referrers).
• API usage. Session counts, browser time, egress volume, and per-key usage, which drive the dashboard and billing.
• Browser traffic. Pages your automation visits pass through our infrastructure so we can return results. See section 2.
• What you send us. Emails, support messages, and the waitlist address if you join it.

2. Browser traffic

The content of pages you fetch through a session is processed transiently to serve your request. If you use recordings or replays, those captures are stored for up to thirty days for debugging and then deleted. We do not read your session content except to operate the Services, debug a problem you report, or investigate abuse, and we do not use it to train AI models without your explicit consent.

3. How we use it

To provide and secure the Services, meter and bill usage, answer support requests, detect fraud and abuse, understand how the product is used so we can improve it, and meet legal obligations. We send product email you can opt out of; transactional email (receipts, security notices, verification codes) is part of the service.

4. Who we share it with

• Infrastructure and service providers that run parts of the product: hosting, authentication (Supabase), payments (Stripe), analytics.
• Law enforcement or regulators when legal process requires it.
• A successor entity if Tilion is acquired or merges; this policy would continue to apply to data collected under it.
• No one else. We do not sell personal data and we do not share it for third-party advertising.

5. Retention

Account data is kept while your account exists and deleted on request when you close it. Usage records are kept as long as billing and accounting require. Session replays are deleted after thirty days. Logs and security data are kept only as long as operating and protecting the Services requires.

6. Security

Traffic is encrypted in transit, credentials are hashed, API keys are stored so that the full key is shown only once at creation, and access to production systems is restricted. No system is perfectly secure; if a breach affects your data we will notify you as the law requires.

7. Cookies and analytics

We use cookies for sign-in and session state, and a lightweight analytics script on our own site to understand traffic. We do not run third-party advertising trackers. Browsers that send “Do Not Track” are treated the same as those that do not, because there is no advertising tracking to turn off.

8. Your rights

You can access, correct, export, or delete your personal data. Depending on where you live (including the EU, UK, and California) you may have additional statutory rights: to object to processing, to restrict it, to withdraw consent, and to complain to a supervisory authority. Requests go to the address below and we answer within the timelines the applicable law sets.

9. Children

The Services are not directed at children and we do not knowingly collect personal data from anyone under thirteen. If you believe a child has given us personal data, contact us and we will delete it.

10. Changes

We may update this policy. Material changes get notice through the dashboard or by email before they take effect, and the date at the top always reflects the current version.

11. Contact

Privacy questions and requests go to team@tilion.dev. See also the Terms of Service.