Security

tideline.sh is an analytics and Data API service. This page summarizes the controls we use to protect accounts, API keys, Google Sign-In data, and service infrastructure.

Users can sign in with Google. We receive only the basic profile data needed to create and maintain an account, such as email address, display name, profile image, and a stable Google account identifier. We do not request Gmail, Drive, Calendar, contacts, or Workspace content scopes.

Sessions use secure cookies and are checked before private dashboard, account, and API key actions are available.

We use TLS for traffic to tideline.sh, protect credentials and API keys at rest, and limit internal access to production systems. Application secrets are kept out of source control and rotated when needed.

API keys are scoped to your account and can be revoked from the dashboard. We log request metadata such as endpoint, method, status code, timestamp, and aggregate usage so users can review activity and so we can investigate abuse.

Production access follows least-privilege principles. Administrative access is limited to people who need it to operate the service, respond to incidents, or support users.

We monitor service errors, abnormal request patterns, and abuse signals. If we confirm a security incident that affects personal data, we will investigate, mitigate the issue, and notify affected users as required by applicable law.

Our use and transfer of information received from Google APIs follows the Google API Services User Data Policy, including Limited Use requirements. Google Sign-In data is used only for authentication, account security, support, and legal compliance.

To report a security issue or ask about our security practices, contact [email protected].