How the sea is kept
Three short documents, written to be read. What you may do here, what we keep and for how long, and what we will never do with it. Last revised 5 September 2026. Questions: harbour@tidelight.app.
1 · Usage Policy
Tidelight is a place to say one true thing you can't say out loud, and to stand beside a stranger for a minute. It is not a place to find people, sell things, or hurt anyone. If you keep to that, the sea is yours.
1.1 Who may use it
- You must be 16 or older. Where local law sets a higher age for services like this, that age applies.
- Tidelight is not a crisis service, a medical service, or therapy. If you are in danger, call your local emergency number. The Harbour screen lists free helplines for where you are.
1.2 What you may drop into the sea
- One true sentence about how you feel, or one small thing that helped you. Voice bottles are the same thing, spoken.
- Anything heavy is welcome: sadness, anger, grief, loneliness, dark humour, messy feelings. The sea is for exactly that.
1.3 What the sea will not carry
- Anything that identifies a real person: names, phone numbers, addresses, handles, links, workplaces, photos of others.
- Harassment, threats, hate, sexual content, spam, advertising, or content that targets a group or a person.
- Pressure to meet, move to another app, send money or pictures, inside a bottle, a note, a chain line or a pool.
- Contact with children. Any attempt to use pools or notes to reach or groom a minor closes the shore permanently and is reported to the authorities where we can.
- Impersonation of the Keeper, the harbour, or another keeper.
- Automation: scripts, bots, scraping, rate-limit evasion, or reverse-engineering the harbour.
1.4 How lines are checked
Every bottle, note, chain line, pool message, ask, username and avatar goes through the harbourmaster, which is Claude (an AI by Anthropic), before it reaches anyone. It classifies and either lets the line float, holds it with a gentle reason, or, when someone sounds in danger, shows them the Harbour instead of sending the bottle. Claude never decides to punish a person; it only decides whether one line sails.
1.5 Reports and consequences
- Anyone can report a bottle from the tide or a pool from inside it. Two reports from different keepers hide a bottle from the tide pending review.
- The harbour office (people, not the AI) reviews an abuse queue built from reports, held lines, reported pools and declined asks. Outcomes, from lightest to heaviest: watch (nothing changes for you), mute (new bottles stay hidden), ban (the shore is closed to your keeper id; bottles are hidden). A ban is logged with a reason and can be appealed by email.
- We may remove any content and close any keeper id or account for breaking this policy, for legal reasons, or to protect other people.
1.6 Pools, chains, accounts
- A pool can only be asked for by someone who lit your bottle, opens only if you say yes, and closes when either of you leaves. Both of you stay anonymous unless you choose to show an avatar or nickname.
- A chain line is public to everyone the tide brings that bottle to. It carries no name.
- Accounts are optional. A username must be 3 to 16 letters, numbers or underscores; names that impersonate the harbour or others are refused.
1.7 Your content, our licence
Your words stay yours. By dropping a bottle you let Tidelight show it anonymously to other keepers, read it with Claude for safety, and include it in aggregate (never quoted) descriptions of the sea, such as the nightly sea line. You can recall any bottle at any time from your lighthouse, which removes it and everything attached to it.
2 · Data Handling Policy
The rule the whole product is built around: nothing you drop is ever used against you. We collect the least we can, keep it as short as we can, and never sell it.
2.1 What we hold, and why
| Data | Why | Where | Kept |
|---|---|---|---|
| Keeper id (random UUID) | The only identity on the sea. Not linked to you unless you sign in. | Your phone; Supabase (Sydney region) | Until you delete the app, or recall everything |
| Bottles: text, mood, kind, region (country code from your phone's locale), time | The product. Region feeds the map of where bottles float. | Supabase | Until you recall them. Hidden bottles are kept 90 days for appeals, then deleted. |
| Voice bottles: the masked recording only | Playback on the tide. | Private Supabase bucket, served as one-hour signed links | With the bottle |
| Lights, notes, chain lines, pools and pool messages | The product. | Supabase | Lights and notes with the bottle. Pool messages until the pool closes, then deleted within 30 days. |
| Mood record: mood, sadness, happiness, sentiment scores per bottle. No text. | Your weekly letter; a gentle nudge to the Harbour if a fortnight ran heavy; anonymous aggregate stats. | Supabase | 12 months |
| Salted hash of your network address | Rate limits so one network can't flood the sea. | Supabase | Forgotten after 1 hour |
| Account: email, username, avatar (if you sign in) | Reserved name, picture, getting your lighthouse back. | Supabase Auth and a private bucket | Until you delete the account |
| On this phone only: lights sent, sea glass, driftwood, lamp nights, constellations, "then vs now" answers, dismissed announcements | Your progress and rituals. | UserDefaults on your device | Until you delete the app |
| Keeper chat with Claude | A minute with a listener. | Nowhere. Each turn is sent to Anthropic's API and not stored by us. | Not kept |
2.2 What we never collect
- Precise location, GPS, IP addresses in the clear, contacts, photos other than the avatar you choose, device identifiers, advertising identifiers.
- Your real voice: the recording is masked on the phone and the original is deleted before anything is uploaded.
- Analytics SDKs, ad trackers, fingerprinting. There are none in the app or on the web pages.
2.3 Who processes data for us
| Processor | What | Where |
|---|---|---|
| Supabase | Database, storage, authentication, edge functions | ap-southeast-2 (Sydney) |
| Anthropic (Claude) | Safety classification of every line, the sea line, the Keeper chat, weekly letters, avatar checks, captions, reports. Anthropic's API does not train on this data. | United States |
| Hostinger VPS (the pilot box) | Web pages, the sky worker, the harbour office | Malaysia region |
| Apple | Sign in with Apple; on-device speech recognition, or Apple's speech service when the phone cannot transcribe locally; push notifications when enabled | Per Apple |
| NASA and NOAA | Public space-weather and asteroid feeds. Nothing about you is sent to them. | United States |
2.4 Security
- Every table is behind row-level security with no public policies; phones and the web only ever talk to the edge function, which holds the service key.
- Rate limits per keeper and per network; secrets in Supabase's vault, never in the app.
- Storage buckets are private; media is served through short-lived signed links.
- The harbour office is an allow-listed set of emails with passwordless sign-in; every action there is written to a ledger with who, what and when.
- Webhooks to third parties carry ids, moods and counts only, never text, and are signed.
2.5 Retention and deletion
- Recall a bottle from your lighthouse and it is deleted immediately, with its lights, notes, chain lines and voice.
- Delete the app and everything on the phone is gone; the anonymous keeper id on the server can no longer be tied to you.
- Email harbour@tidelight.app with your keeper id to have everything under it erased; we do it within 30 days and confirm.
- Backups roll over within 30 days.
2.6 Breaches
If we learn of a breach affecting personal data we will tell affected keepers we can reach and the relevant authority within 72 hours, and publish a plain-language note on this page.
3 · Privacy Policy
Anonymous by default. Nothing sold. Nothing used for ads. Your words are never used to judge you, price you, or sell you a service.
3.1 Who we are
Tidelight is operated by its maker from Kuala Lumpur, Malaysia ("we"). For data-protection law we are the controller. Contact: harbour@tidelight.app.
3.2 What we use data for, and on what basis
- Running the sea (bottles, lights, tide, pools, chains, letters): performance of our agreement with you.
- Keeping people safe (Claude classification, reports, the abuse queue, rate limits): our legitimate interest in a safe service, and in some cases legal obligation.
- Your weekly letter and Harbour nudges from the score-only mood record: performance of the agreement; you can turn letters off in the harbour's switches or by not opening them.
- Accounts: consent, which you give by signing in and can withdraw by deleting the account.
- Aggregate statistics and reports for running the service: legitimate interest; they never contain text or anything that identifies you.
3.3 What we will never do
- Sell, rent or trade any data.
- Show advertising, or use your feelings, mood scores or bottles to target anything at you, upsell anything to you, or share them with brands, insurers, employers or anyone else.
- Train our own models on your bottles, or allow our processors to.
- Reveal to anyone who wrote a bottle, who asked for a pool, or who declined one.
3.4 Your rights
Wherever you are, you can: see what we hold under your keeper id; correct it; have it erased; take it with you in a plain file; object to a use; and complain to your data-protection authority (in Malaysia, the Personal Data Protection Department; in the EU, your national authority; in the UK, the ICO). Email us and quote your keeper id, shown at the bottom of your lighthouse screen. We answer within 30 days.
3.5 Children
Tidelight is for people 16 and older. We do not knowingly keep data about anyone younger; if we learn we have, we delete it. Pools between an adult and a minor are closed the moment we find them.
3.6 International transfers
Data is stored in Australia and processed for safety in the United States under Anthropic's data-processing terms and standard contractual clauses. Web pages are served from Malaysia.
3.7 Changes
If we change these documents in a way that matters, the lighthouse shows a notice for two weeks and this page carries the date. The previous version is available on request.
4 · Safety, in one place
- Any line that sounds like someone is in danger opens the Harbour: free helplines for the phone's country, verified against their official pages, and one tap to call.
- The Keeper is Claude, plainly labelled, not a person and not therapy, and it says so at the top of every chat.
- Report from any bottle or pool. Two reports hide a bottle. A human reviews the queue.
- No names, numbers, handles or links can travel through any part of the sea.
5 · Contact
The harbour office reads every email: harbour@tidelight.app. For urgent safety matters put the word Harbour in the subject line. For law-enforcement requests, write from an official address; we require a valid legal order for anything beyond what this page describes.
Tidelight · pilot build · these documents are provided in English; translations are for convenience and the English text governs.