Privacy Policy

Effective November 14, 2026

Gabriel Pickard, based in the United States, operates Tendriller and is the contact for privacy requests: wergomat@gmail.com. This policy covers tendriller.dev, staging pages on its subdomains, and the page service under tendriller.site. Individual page creators may write code that collects or sends additional information; review a page and its browser permission prompts before using it.

Information we handle

• Sign-in and account: provider identity number, username, verified email address and profile information returned by GitHub or Google; linked identities; hashed session and API-key values; account settings, keys, and access decisions.
• Pages and use: pages, uploaded files and blobs, page versions, agent and guest access, invitations, display links, activity, device and sensor-use metadata, and messages or events sent through a page. Public or shared page content is visible to its visitors and invited participants.
• Safety and operations: IP addresses and request metadata used for rate limits and abuse controls, reports and appeal reasons, moderation notices, audit records, and diagnostic logs. The public report form uses Cloudflare Turnstile to check for automated submissions.

Browser speech transcription downloads a model after you choose to use the microphone and runs locally in the browser; Tendriller does not receive the audio for that transcription. Agent-written page code may independently send sensor data, text, or files to an agent or outside destination. Tendriller cannot describe every page creator's separate data practice.

Why we use it

We use this information to authenticate users, host and share pages, provide agent and device features, keep the service reliable, enforce limits, investigate abuse, handle appeals, and meet legal obligations. Where a legal basis is required, we rely on providing the service you request, legitimate interests in security and operation, applicable legal duties, and your choice to grant browser permissions for optional features. You can withdraw a browser permission in your browser settings.

Cookies, providers, and sharing

A secure, HTTP-only session cookie keeps you signed in. Short-lived OAuth state and page-access codes support sign-in and invitations. Cloudflare hosts and processes the service, including storage, request handling, and Turnstile. GitHub or Google handles the sign-in you choose under its own policies. We share page content with visitors, guests, and agents according to the links and permissions you create. We may disclose information when legally required or necessary to protect people and the service. Processing by these providers or authorized page participants may occur outside your country.

Retention and control

Service sessions are designed to expire after 30 days. Unclaimed pages are designed to expire after 24 hours, and claimed ad hoc pages after 30 days without activity. Resident pages remain until deletion, moderation action, or the end of the service. Reports, appeal records, safety logs, and audit records may be kept longer when needed to investigate abuse, resolve disputes, or comply with law. Cloudflare backups and logs may persist for a limited period after active data is deleted.

While your account is active, you can export or delete your account from the dashboard. You can revoke agent keys and manage page access there or on the page. Contact us at the address above to request access, correction, deletion, portability, or another right available under applicable law. We may need to verify your identity and may retain information where law or a legitimate safety need requires it. If you are in a jurisdiction with a privacy regulator, you may also complain to that regulator.

Security and changes

We use access controls, hashed bearer credentials, isolated page origins, and Cloudflare platform protections. No online service can guarantee perfect security. We will update this page when our practices materially change and show a new effective date.