Privacy policy

Short version: Tenty keeps what it needs to show you your findings, keeps it in Europe and explains below what it keeps, why, for how long and what you can do about it.

Last updated 29 October 2026. We handle personal data under the law that applies to us and work to comply in full with the EU GDPR.

1. Who we are

Soft Signal SRL runs Tenty and is the controller of your data. Reach us any time at public@tenty.dev.

2. Data we collect

• Account: your email address.
• Sign in: a one-way hash of your sign-in link, and a session with a hash of its token, your IP address, your browser details and an expiry date. The session lives in your browser's local storage.
• Your apps: the addresses you add, the ownership records for your domains, your access token (kept encrypted) and your hook address.
• Scan results: findings with their evidence, the list of requests Tenty made, facts Tenty noticed about the app (such as frameworks and routes), and your decisions to set a finding aside with the reason you gave.
• Reports: the notes you write when you report a wrong finding.
• Demo scans: the address you scanned, the result lines and a one-way hash of your IP address that counts the hourly limit. If you ask for the result by email, your address is used to send that one email.
• Emails we send: sign-in links, access reminders and alerts about your apps.
• Emails you send us: they stay in our mailbox. The soul, garden and village emails are counted for a small case study on who reads terms, and your name goes on its public list only when you ask for that in the email.

Tenty reads public pages of the apps it checks. The findings and their evidence are what we keep.

3. Why we use it and on what basis

• Running your account and showing your findings: contract
• Checking your apps, rechecking domain ownership and sending alerts: contract
• Security, abuse prevention and the logs for it: legitimate interest
• Fixing errors and keeping the service up: legitimate interest
• Writing fix prompts: legitimate interest, from the kind of finding only

4. Who sees your results

The verified Owner of a domain sees its findings, evidence, request log and access token. A visitor who runs a demo sees counts and public kinds of findings. Our team looks at data when it investigates a problem or a report.

5. What stays in your browser

The only thing Tenty keeps in your browser is your sign-in session, in local storage, until you sign out or it expires.

6. AI

An AI model writes the fix prompt for each kind of finding. It gets the name of the kind and its meaning. Finding issues is done with plain code.

7. Who processes data for us

• Hetzner (Germany): servers, database and background work.
• Plunk (EU): sends our emails.
• Vercel (EU and USA): delivers the website and sees your IP address and browser when you visit.
• Anthropic (USA): writes the fix prompts from the kind of finding and its meaning.

We have a data processing agreement with each of them. Where a provider is in the USA, the transfer rests on the EU standard contractual clauses or the EU-US Data Privacy Framework, and we send as little as possible.

8. How long we keep it

• Your account: until you ask us to erase it.
• Sessions: they expire after 30 days, and signing out ends one at once.
• Check logs of an app, the list of requests: 3 days on Free, 15 days on a paid plan by default and up to 30 days when you set it.
• Findings and scan history of an app: until you remove the app, then they are erased.
• Demo scans: erased 60 minutes after the demo.
• Reports about wrong findings: until your account is erased.

9. Your rights

You can access, correct, delete or export your data, limit its use, object to how we use it and withdraw a consent whenever you want. Write to public@tenty.dev and we answer within one month. You can also complain to the data protection authority of your EU country, or to the National Centre for Personal Data Protection (CNPDCP) of Moldova.

10. Security

Everything travels over HTTPS and your data lives on servers in Germany. Sign-in links and session tokens are stored as hashes, access tokens are encrypted, and access to the servers is limited to the people who need it. If a breach puts your data at risk, we tell the authority within 72 hours and you without delay when the risk to you is high.

11. Changes to this policy

When we change it, the date at the top changes too. For a change that matters, we also tell you by email.

12. One more thing

If you read all the way to here, write to public@tenty.dev with the word garden in the subject. It belongs to the same case study as section 18 of the terms and sits outside this policy. Say so in the email and your name goes on the list of people who read terms.