Privacy Policy | Tamanas

1. Introduction

Tamanas ("we", "us", or "our") is owned and operated by Data Genome d.o.o., a company registered in Serbia (tax ID / PIB: 113389225; datageno.me). This Privacy Policy explains how we collect, use, share, and protect personal information when you use the Tamanas website, iOS app, Android app, and related services (together, the "Service").

For the purposes of the EU General Data Protection Regulation (GDPR) and similar laws, Data Genome d.o.o. is the data controller of personal data processed through Tamanas. Questions about this policy or your data rights can be sent to privacy@tamanas.com.

2. Information We Collect

Account Information

Email address (required)
Username (required)
First and last name
Password (stored only as a secure hash; never in plain text)
Phone number (optional, used for account verification)
Profile photo (optional)
Date of birth (optional; used for age-related safeguards)
Address information (optional): country, state, city, street, postal code
Language and other account preferences

Wishlist and Social Data

Wishlist titles, descriptions, privacy settings, due dates, and cover images
Wish items (titles, descriptions, product links, prices, currencies, images, notes)
Fulfillment and reservation status (including who reserved or fulfilled a wish, subject to surprise-mode rules)
Sharing settings, share links, invitations, access requests, and follow relationships
Support tickets and messages you send us

Product Link Enrichment Data

When you paste a product URL to create or enrich a wish, we may fetch publicly available page content to suggest a title, description, price, currency, and image. That process may involve:

The URL you submit and metadata derived from the page
Temporary page HTML or extracted text processed by our systems and subprocessors
Cached suggestion results associated with the URL (and language/region context) for a limited period

We do not intend to scrape private, authenticated, or non-public pages. Do not submit URLs that require a login or that you are not allowed to share.

Technical and Device Data

IP address, browser type, operating system, and device information
App version, crash/diagnostic information, and performance metrics
Login timestamps and security-related events
Approximate location (country level, derived from IP address) for currency and localization preferences
Push-notification device tokens (mobile), used only to deliver notifications you enable
Essential cookies and local storage used for authentication, preferences, and security

Analytics Data (with consent)

If you opt in via our cookie banner (web) or analytics consent prompt (mobile), we may collect product-analytics events such as feature usage, onboarding progress, and conversion funnel steps. When you are signed in and have consented, we may associate those events with your account identifiers (for example user ID, username, and email) so we can understand how the Service is used over time. You can decline or withdraw consent at any time; declining does not block core Service functionality.

Payment and Subscription Data

If you subscribe to Tamanas Plus, payment is processed by third-party merchants (see Section 5). We receive subscription status, entitlement, and billing-period information needed to provide Plus features. We do not store full payment card numbers on our servers.

OAuth Data

If you sign in with Google or Facebook, we receive your email address and basic profile information (such as name and profile picture) from those providers. We do not access your contacts or friends unless you explicitly grant permission for friend-discovery features.

3. How We Use Your Information

To provide, operate, secure, and maintain the Service
To authenticate your account and prevent fraud or unauthorized access
To send transactional emails and push notifications (verification, security alerts, sharing activity, support replies)
To enable wishlist creation, sharing, reservations, and fulfillment
To enrich product links you submit (title, price, image suggestions)
To process subscriptions and manage Plus entitlements
To diagnose errors, improve reliability, and monitor performance
To understand product usage and improve features when you have consented to analytics
To respond to support requests and enforce our Terms of Service
To comply with legal obligations

4. Legal Bases for Processing (GDPR)

Where the GDPR or similar laws apply, we process personal data on one or more of the following bases:

Contract: to create and manage your account, provide the Service you request, and process subscriptions.
Legitimate interests: to secure the Service, prevent abuse, diagnose crashes and errors, improve reliability, and understand aggregate product needs in a privacy-respecting way.
Consent: for non-essential analytics cookies/SDKs (for example Google Analytics and PostHog) and any other processing where we ask for consent. You may withdraw consent at any time.
Legal obligation: where we must retain or disclose information to comply with law.

5. Data Sharing and Third-Party Services

We do not sell your personal information. We share data only as needed to operate the Service, with your direction, or when required by law:

With your consent or at your direction: when you share wishlists, create public or shared links, or connect third-party accounts.
Service providers / processors: companies that help us host, send email, analyze usage (with consent), process payments, scrape public product pages you submit, run AI extraction, deliver push notifications, and monitor errors.
Legal requirements: if required by law, regulation, legal process, or to protect the rights, safety, or property of Tamanas, our users, or others.

We currently use the following categories of third-party services:

Amazon Web Services (AWS): cloud hosting, database storage (RDS), file storage (S3), queues, secrets management, and AI model inference via Amazon Bedrock for product-link enrichment. Primary application data is hosted in the EU (AWS eu-central-1).
Purelymail: transactional email (verification, notifications, security alerts, support).
Google & Facebook: OAuth sign-in if you choose those providers. Friend discovery uses provider APIs only when you explicitly grant permission.
Firebase Cloud Messaging (Google): delivery of push notifications on mobile devices when you enable them.
MaxMind: GeoLite2 geolocation data to estimate country-level location from IP address for currency and localization. This product includes GeoLite2 Data created by MaxMind, available from https://www.maxmind.com.
Scrappey: fetching publicly available product-page content when you submit a difficult or JavaScript-heavy URL for link suggestions. Scrappey processes the URL and page content needed to return extractable HTML/text to us; we use that output to suggest wish details.
PostHog (EU cloud): product analytics and feature-usage events, only after you grant analytics consent. Event data is configured for EU data residency. PostHog may receive account identifiers you consent to associate (such as user ID, username, and email) plus event properties about how you use the Service. Learn more at posthog.com/privacy.
Google Analytics: web analytics cookies and usage metrics, only if you accept analytics cookies on the website. Learn more at policies.google.com/privacy.
Sentry: error monitoring, performance diagnostics, and limited session replay to keep the Service reliable. We configure Sentry not to send default PII, scrub sensitive fields (such as tokens, passwords, emails, and authorization headers) where feasible, and mask text/media in session replays. Crash and error diagnostics may run as part of operating the Service; they are separate from optional marketing/product analytics consent. Learn more at sentry.io/privacy.
Paddle: Merchant of Record for web purchases of Tamanas Plus (payment collection, invoices, and applicable taxes). Your payment details are handled by Paddle under its own privacy terms.
RevenueCat: subscription entitlement management across web and (when available) mobile store purchases. RevenueCat receives the identifiers and subscription events needed to keep Plus access in sync.
Apple App Store / Google Play: when you buy or manage a subscription through a mobile store, Apple or Google processes the payment as the store merchant and shares subscription status needed to unlock Plus features.

6. International Data Transfers

We host primary application data in the European Union (AWS eu-central-1) and configure PostHog for EU residency. Some subprocessors (for example authentication providers, payment processors, push delivery, error monitoring, or scraping providers) may process data in other countries, including the United States. Where required, we rely on appropriate transfer safeguards such as the European Commission's Standard Contractual Clauses and vendor commitments under applicable data-protection law.

7. Data Storage and Security

Primary application data is stored on servers located in the EU (AWS eu-central-1)
We use encryption for data in transit (HTTPS/TLS) and encryption at rest for hosted infrastructure
Passwords are securely hashed and never stored in plain text
Access to production systems is restricted and authenticated
No security measure is perfect; please use a strong unique password and protect your devices

8. Data Retention

Account data: retained while your account is active and deleted when you delete your account, subject to limited backups and legal retention needs.
Notifications: read notifications are automatically deleted after approximately 30 days.
Uploaded files: files tied to deleted wishes, wishlists, or accounts are removed from active storage; cleanup of associated objects is typically completed within about 30 days.
Link-suggestion cache / scrape telemetry: retained for a limited operational period to improve reliability and reduce repeat scraping costs, then expired or aggregated.
Analytics: retained according to our analytics providers' settings and our need to understand product trends; stop new collection anytime by withdrawing consent.
Billing records: subscription and invoice records may be retained as required for tax, accounting, and fraud prevention.
Account deletion: deleting your account permanently removes associated personal data from our active databases. See our Data Deletion Instructions.

9. Your Rights

Depending on where you live, you may have rights to access, correct, delete, restrict, or object to certain processing of your personal data, and to data portability. You may also withdraw consent where processing is consent-based, and lodge a complaint with your local supervisory authority.

Access & correction: view and update profile and wishlist data in the app settings.
Deletion: delete your account in Settings, or email privacy@tamanas.com. Details: Data Deletion Instructions.
Portability: request a machine-readable copy of your data by contacting privacy@tamanas.com.
Withdraw analytics consent: on web, clear or change your cookie choice (or contact us to help reset it); on mobile, use the analytics toggle in Settings. You can also decline the initial consent prompt.
OAuth connections: disconnect Google/Facebook in account settings and revoke access in the provider's security settings.
Push notifications: disable in device settings and/or in-app notification preferences.

Privacy controls in the app. You can set whether your profile is public or private, whether a public profile may be indexed by search engines (when your profile is public), your notification preferences, and whether your own wishlists use surprise mode (hiding other people's reservations and gifts from your view until you choose to see them). We do not display your email address on your public profile. Optional address fields are for your use (for example delivery context) and are not exposed as a separate "show location on profile" toggle.

10. Cookies, Local Storage, and Analytics

We use essential cookies and local/secure storage to keep you signed in, remember language and preferences, protect security (including refresh-token handling on web), and operate core features. These are necessary for the Service to function and are not used for advertising.

With your explicit consent, we also use Google Analytics (web) and PostHog (web and mobile) to understand how features are used so we can improve Tamanas. Analytics SDKs start in an opted-out state and only begin capturing after you accept. We do not use third-party tracking for targeted advertising.

Error-monitoring tools such as Sentry may set technical identifiers needed to diagnose failures. Session replays, when captured, are configured to mask on-screen text and block media.

11. Children's Privacy

Tamanas is not directed to children under 13, and we do not knowingly collect personal information from children under 13. Where local law sets a higher digital-consent age (for example between 13 and 16 in parts of the EU/EEA), you must meet that age or use the Service only with a parent or guardian as required by law. If you believe a child has provided us personal information, contact privacy@tamanas.com and we will take appropriate steps to delete it.

12. Mobile App Platform Disclosures

Our iOS and Android apps may access device capabilities needed for core features, such as:

Camera and photo library — to upload profile, wishlist, or wish images (only when you choose to)
Network access — to sync your account and content with our servers
Notifications — to send push alerts you enable
Biometric unlock (optional) — processed on-device by the operating system; we do not receive your biometric templates

Apple and Google also require privacy nutrition labels / data-safety declarations in their stores. Those disclosures are intended to summarize the practices described in this policy.

13. Changes to This Policy

We may update this Privacy Policy from time to time. We will revise the "Last updated" date above and, for significant changes, provide additional notice (for example by email or in-app notice). Continued use of the Service after an update becomes effective means you acknowledge the revised policy.

14. Contact Us

If you have questions about this Privacy Policy or wish to exercise your data rights, contact us at: privacy@tamanas.com

Controller: Data Genome d.o.o., Serbia (tax ID / PIB: 113389225).