Privacy Policy

Last Updated: January 2026

Quick Summary

TINNOTU pays human writers via impressions and quest rewards, and licenses content to AI companies for training. We protect your personal data (emails, payment info) and never include it in AI packages. Quest application data and performance metrics are collected for platform operations. You control your content and can request deletion, though content already licensed to AI partners may remain in their systems.

Personal Information

Account Data: Email, display name, password (encrypted)
Payment Information: PayPal email for writer payouts (stored securely, never shared)
Profile Data: Bio, avatar, social links (publicly visible)

Content Data

Articles & Stories: All written content you publish
Quest Applications: Quest selections, application status, completion data
Writer Performance: Level progression, posts published, total views, quest history
Engagement Metrics: Views, likes, comments, reading time
Usage Analytics: Device type, browser, location (city-level only)

Fraud Detection Data

View Tracking: Unique identifiers to prevent duplicate impressions (24-hour transients)
Payment Verification: PayPal email, transaction logs for tax compliance
Anti-Gaming Metrics: IP patterns, device fingerprints to detect bot traffic and multiple accounts

Important: Your published articles may be licensed to third-party AI companies for model training purposes. This is how we generate revenue to pay writers.

What Gets Licensed

Article text, title, and metadata (category, tags, publish date)
Public engagement metrics (view counts, like counts)
Author display name (as published on the platform)

What NEVER Gets Licensed

Your email address or payment information
Private messages or unpublished drafts
IP addresses or device identifiers
Reader subscription data or personal preferences

Your Rights

You retain full copyright ownership. We only obtain a non-exclusive license to distribute and sublicense your content. You can delete articles anytime, but content already provided to AI partners cannot be retroactively removed from their training datasets (see Section 5).

Platform Operations: Display your content, process payments, manage subscriptions
Quest System: Match writers to assignments, track applications, process quest rewards
Level Progression: Calculate writer levels based on performance metrics
Revenue Generation: License content to AI companies (~$0.001 per article)
Writer Payments: Calculate impressions and quest rewards, distribute earnings ($0.01 per 2 impressions + quest bonuses)
Fraud Prevention: Detect bot traffic, multiple accounts, artificial engagement
Analytics: Improve content recommendations and platform performance
Communication: Send payment notifications, policy updates, security alerts

AI Company Partners

We license article content (text only) to verified AI labs and enterprises. Each partner signs a Data Processing Agreement (DPA) prohibiting misuse.

Payment Processors

PayPal processes writer payouts. Stripe processes reader subscriptions. We never store full credit card numbers.

Analytics Services

Google Analytics tracks anonymous usage patterns. No PII is shared.

We Never Sell

Personal identifiable information (emails, payment details, private messages) to anyone, ever.

Under EU AI Act and GDPR, you can request deletion of your data. However, AI training creates unique challenges.

What We Can Delete Immediately

Your account and all personal information
Unpublished drafts and private messages
Articles from our platform and future AI licensing packages

What We Cannot Delete

Already-Trained Models: If your content was used to train an AI model before your deletion request, it cannot be "unlearned" from that model
Archived Datasets: AI partners may retain historical training datasets for compliance/auditing
Legal Retention: Financial records (for tax purposes) must be kept for 7 years

We notify all active AI partners of deletion requests and require them to exclude your content from future training runs.

Access: Request a copy of all data we hold about you
Correction: Update inaccurate personal information
Deletion: Request account and content removal (see Section 5 for AI limitations)
Portability: Download your articles in JSON/CSV format
Opt-Out: Withdraw from AI licensing (requires account deletion, as licensing is core to our business model)
Object: Challenge automated decisions (e.g., content moderation)

Submit Data Request

SSL/TLS encryption for all data transmission
Passwords hashed with bcrypt (never stored in plain text)
Regular security audits and penetration testing
Access controls limiting employee data access
Automated breach detection and 72-hour notification policy

Essential: Login sessions, security tokens (cannot be disabled)
Analytics: Google Analytics for usage patterns (anonymized)
Preferences: Theme settings, reading preferences

We do not use advertising cookies or cross-site trackers.

TINNOTU is not intended for users under 16. We do not knowingly collect data from children. If you believe a child has created an account, contact us immediately for deletion.

TINNOTU operates globally. Data may be processed in the US, EU, or India. We use Standard Contractual Clauses (SCCs) for EU data transfers and comply with India's DPDP Act for cross-border transfers.

We'll notify you 30 days before major changes via email and platform banner. Continued use after changes constitutes acceptance. Material changes to AI licensing terms require explicit opt-in.

Data Protection Officer: privacy@tinnotu.com

EU Representative: [To be appointed]

Supervisory Authority: You can file complaints with your local data protection authority (e.g., ICO in UK, CNIL in France).