Privacy policy

Last updated 7 October 2026

Tavle is a workspace for notes, pages and databases at tavle.maelandcc.no, with apps for iPhone, iPad and Mac on the way. This policy explains what personal data Tavle processes, why, and what rights you have. The controller is Kristian Mæland (Maeland Code Craft). Contact: km@maelandcc.com.

What Tavle stores

• Account: email address, name and profile picture from GitHub, Google or Apple when you sign in.
• Profile: your language and which version of the terms you accepted, and when.
• Content: pages, databases, comments, files and page history in your workspaces, plus the members of each workspace and the email addresses you invite.
• Keys and integrations: API keys you create (stored as a hash) and a log of what they are used for; your OpenRouter key and a workspace's GitHub token, both encrypted in Supabase Vault.
• Feedback you send from the app.
• Technical data: logs and error data needed to run and secure the service.

Tavle only uses cookies for sign-in and your settings (language, sidebar). There is no advertising, analytics or tracking.

Where the data is

• Supabase stores the database, sign-in, files and the search index in the EU (Stockholm, eu-north-1). The search index is built inside Supabase.
• Vercel runs the web app, in Stockholm (arn1).
• GitHub, Google and Apple handle sign-in when you choose them.
• Fyret, our own operations portal, receives the feedback you send: your user id, the message, an optional rating and app context (platform, app version, device and the page you were on). It runs on Vercel and stores the feedback in the same Supabase project. When you report a page or comment, Tavle sends an excerpt of the reported content, its author's user id and your note to Fyret so the operator can review the report.

AI features (OpenRouter)

AI is off until you add your own OpenRouter key under Settings. Only when you then use an AI feature does Tavle send your request and the content it needs, such as the page or selection you ask about, to OpenRouter, which passes it to the model you use. OpenRouter's terms and privacy policy apply to that request. You can remove the key at any time.

GitHub integration

If a workspace is connected to GitHub with a personal access token, Tavle fetches the issues, pull requests and commits you link to or sync, and receives GitHub webhooks for synced repositories. Removing the connection deletes the token.

Push notifications

The native apps will store a push token for each device you sign in on, so Tavle can send notifications through Apple (APNs) and later Google (FCM). The token is deleted when you sign out on that device or delete your account.

Why we process the data

To provide the service you ask for (contract, GDPR Art. 6(1)(b)) and to keep it secure and running (legitimate interest, Art. 6(1)(f)). We do not sell your data.

Retention and deletion

We keep the data for as long as you have an account. You can delete your account under Settings → Delete account. That deletes the account, your profile and every workspace where you are the only member. A shared workspace you own passes to its longest-standing admin, otherwise its longest-standing member. Pages, comments and AI conversations you wrote in shared workspaces stay and are shown as written by "Deleted user". Your OpenRouter key and the GitHub tokens of deleted workspaces are erased from encrypted storage. Remaining traces in logs and backups are removed within a reasonable time.

Your rights

You have the right to access, rectification, erasure, restriction and data portability under the GDPR, and you can export your content from Settings. You can complain to the Norwegian Data Protection Authority (datatilsynet.no). Contact us at km@maelandcc.com to use your rights.

Changes

When this policy or the terms of use change materially, Tavle asks you to accept the new version before you continue.