Privacy policy

Effective November 1, 2026

This policy explains what happens to personal information when you visit tondo.page, create an account, build a page or look at someone else's page. Tondo doesn't use advertising pixels or analytics cookies, and it doesn't sell personal information.

Tondo is in early development and hasn't opened to the public. This policy describes the service as it's built to run in production, and it says so where something is planned.

Who we are

Tondo is operated by GalleoApp, Inc., a Delaware corporation, referred to here as "we" or "us". Our founder works from Vancouver, British Columbia. For the information described in this policy, GalleoApp, Inc. is the organization responsible, which is called the controller or business in some privacy laws.

The content of a Tondo page is chosen by the person who publishes it. If you've been named or pictured on a page, you can ask that person to change it or report the page to us.

What we collect

Account information

Sign-in runs on Neon Auth, a service from our database provider, Neon. If you sign up with an email address, Neon Auth keeps your email address, your sign-in records and your password, and we use the part of your email before the @ as your starting name. Your password passes through our server on its way to Neon Auth. We don't write it to our own tables or to our logs.

If you continue with Google, Google tells Neon Auth who you are. That includes your email address and name, and it can include your profile picture. We use your email address and name to run your account.

Your page

We store the address you claim, such as tondo.page/maya, along with your draft and your published page. A page holds whatever you add to it, such as your name, a description, links and contact details. Don't add anything you wouldn't want to be public to a page you plan to publish.

Photos

When you upload a photo, our server resizes it and converts it to a WebP file. The conversion drops data embedded in the original, such as location data, and only the converted file is stored. Each file is stored in a folder named after a hash of your user ID.

Help me

Help me is an optional assistant in the builder. If you use it, we send your message, the text of your draft page and anything you paste or ask it to read to Google, which runs the AI model through its Gemini API. We don't send your email address or your statistics. If you ask it to read your website, our server fetches that page and sends its text to Google. If you ask for a generated image, your description goes to Google. If you ask for a stock photo, your search words go to Pexels or Openverse, and the photo you pick is copied to your account. If you don't use Help me, none of this happens.

Your conversation stays in that browser tab and is gone when you close it. We keep no copy of it on our servers. We count how many credits you've used each month, and not what you asked. Visitors to your page are never involved.

Messages you send us

If you email us, report a page or send a copyright complaint, we keep your email address and whatever you wrote, including the details of the page involved. The report link on a page opens your own email app, with that page's address in the subject line. Our application doesn't record that you pressed it.

Email we send you

We use your email address to send account messages, such as verification codes and password reset codes. We don't send marketing email today, and there's no mailing list in the product.

Page visits and counts

Tondo counts views of each live page and clicks on its links, so its owner can see how the page is doing. Our counts table holds only the page, the link, the day and a running total. It doesn't store IP addresses, user agents, referrers, locations, cookies or anything else that could tell one visitor from another. The owner sees totals, and can't see who visited.

To leave crawlers and link previews out of the totals, our server reads the browser's user agent as each request arrives, and doesn't keep it. A click on a counted link goes through tondo.page, is added to the total and is then sent to its destination. The site you land on sees your IP address as it would with any visit, and it usually sees that you came from tondo.page.

IP addresses and rate limits

Your IP address reaches our server with every request. We use it to limit how many requests one address can make, which protects the service against abuse. We use email addresses the same way on sign-in, sign-up and code requests, to slow down password guessing and to stop anyone flooding an inbox.

These limits are held in the server's memory and aren't written to our database. Each count applies for a window of one minute or, for some sign-in actions, 15 minutes. An expired entry stays in memory until the list fills up and it's pushed out, or until the server restarts, which also happens at every deploy.

Logs

Our application doesn't write a log line for each visit. It writes error messages to the logs that Render keeps. Our hosting and network providers may keep their own connection and security logs, including IP addresses, under their own terms.

Cookies and browser storage

Tondo sets cookies only for signing in. These are first-party session cookies from Neon Auth, set on our own domain and marked Secure. Someone who only visits a Tondo page isn't given a cookie by us, and we use no tracking or advertising cookies. Live pages tell the browser to run no scripts at all.

The editor and sign-in pages also keep a few things in your browser:

• A copy of unsaved work. The editor keeps a copy of your page in local storage until the server has it, so a lost connection or a closed tab doesn't lose your changes. The copy normally clears after a successful save.
• A tab ID. A random ID in session storage keeps each tab's unsaved work apart.
• Your email address, briefly. During verification or a password reset, session storage holds your email address and the address you asked for, for that tab only.

This data stays in your browser and isn't sent to anyone unless it's saved to your account. Logging out or deleting your account doesn't clear an unsaved copy from local storage. If you use a shared computer, clear this site's data in your browser settings.

Google Fonts

Our website, the editor and every live Tondo page load their typefaces from Google Fonts. When a page opens, the visitor's browser connects to fonts.googleapis.com and fonts.gstatic.com. That sends Google the visitor's IP address and browser details, along with the fonts requested and usually the site they were requested from. This happens before anyone can make a choice about it, and it applies to people who only visit a page.

Google handles that information under its own terms and privacy policy, and we don't receive it. If you block these requests in your browser, text appears in another typeface.

What is public

When you publish, your page is available to anyone at its address, without signing in. We don't ask search engines to skip live pages, so they can be indexed. Other people, search engines and archives can copy what they find, and we can't recall those copies.

A draft isn't public, but your uploaded photos are served from an address that needs no sign-in. The address is long and hard to guess, and anyone who has it can open the photo, whether or not the photo is on a live page. Please don't upload a photo you need to keep private.

Every live page has a "Report this page" link, which opens tondo.page/report. Anyone who is signed in can also check whether an address is taken.

Why we use information

We use information to run your account and page, keep the service secure, handle reports, answer you and meet legal duties. We don't build advertising profiles. Canadian privacy law asks us to rely on your consent, which you give when you create an account or send us a message, and you can withdraw it by deleting your account or contacting us, subject to legal limits. Under the GDPR and UK GDPR, we rely on these lawful bases:

• Performing our contract with you: creating and signing in to your account, storing your draft and photos, publishing your page, sending account codes, and carrying out what you ask Help me to do.
• Legitimate interests: rate limits and other security measures, abuse reports and takedowns, page view and click totals, error logs, and loading fonts so pages appear as designed. You can object to these as described below.
• Legal obligations: answering lawful requests, and keeping records the law requires.
• Consent: where we ask for it. We don't rely on it for anything today.

Who handles it for us

We share information with the following companies so they can run parts of the service:

• Neon hosts our Postgres database and Neon Auth, which handles sign-in, passwords and sessions.
• Render hosts the server that runs the website, editor and pages.
• Cloudflare is planned to store uploaded photos in its R2 storage in production. Photos are delivered through our server, so loading one doesn't connect a visitor to Cloudflare.
• Google provides Google sign-in if you choose it, and Google Fonts for everyone.
• Google's Gemini API runs Help me, if you use it. It receives your messages, your draft's text, text from a website you ask it to read, and image descriptions. Tondo uses the paid service, under which Google says it doesn't use prompts or responses to improve its products, and logs them for a limited period to detect and prevent policy violations and for legal reasons.
• Pexels and Openverse receive your search words if you ask Help me for a stock photo.
• Email delivery: Neon Auth sends account emails, through Neon's own sender or an email provider we connect to it. We'll name any separate provider here when we add one.

We may also disclose information when the law requires it, to protect people or the service from harm, or as part of a sale or reorganization of our business. We don't sell personal information or share it for cross-context behavioural advertising.

International transfers

Tondo's database is set up in Neon's AWS us-east-2 region, and its server in Render's Ohio region, both in the United States. Google and Cloudflare can process data in other countries, including what Help me sends to Google, and our founder can access it from Canada. If you use Tondo from elsewhere, your information will leave your country, and it can be available to courts and authorities in the countries where it's held.

Where the GDPR or UK GDPR requires a safeguard for a transfer, we rely on a mechanism recognized by that law, such as standard contractual clauses in a provider's data processing terms. You can ask us about these at privacy@tondo.page.

Retention and deletion

Unpublishing

Unpublishing takes your page off its address straight away. Your draft, address, photos, counts and account all stay, so you can publish again. Copies made by others, such as search engine results, aren't affected.

Deleting your account

You can delete your account from the Account page. That removes your uploaded photos, pages, counts and address from our live systems, and asks Neon Auth to delete your sign-in record. If Neon Auth can't complete that step, we tell you, and you can email privacy@tondo.page to have it removed.

Some things can remain after that:

• Backups. Neon keeps a rolling restore history for a limited period, and deleted data stays there until that period passes. Other providers may also take a short time to clear deleted data from their systems.
• Cached photos. Photos are sent with a one-year browser cache setting, so a browser that has already loaded one may keep showing its copy.
• Pages taken down for abuse. If your page was suspended, its address and the suspension date stay on record, without your user ID, so that the address stays out of use and the page can't return under a new account.
• Messages. Reports, complaints and other emails are kept as described below.
• Browser copies. Any unsaved copy stays in that browser until cleared.

How long we keep things

• Account information, your page, your photos and your counts stay until you delete them or your account. We don't currently delete inactive accounts automatically, and counts don't expire on a schedule.
• Rate limit entries stay only in server memory, as described above.
• We keep emails, reports and complaints for as long as we need them to handle the matter, keep a record of decisions about abuse, and meet legal duties.
• Credit counts stay until you delete your account. What Help me sends to Google stays with Google for the limited period described above, and we can't delete it there. Generated images you didn't pick are removed when you close their card, and ones you keep are stored like your other photos.

Your rights

You can see and change most of your information in your account, and delete it there. For anything else, email privacy@tondo.page. We may need to confirm your identity first, and we'll answer within the time the applicable law allows. We won't treat you differently for exercising a right. The rights you have depend on where you live.

Canada

Where PIPEDA or British Columbia's Personal Information Protection Act (PIPA) applies, you can ask for access to your personal information and how it has been used, ask for corrections, and withdraw consent, subject to legal limits. If you're not satisfied with our answer, you can complain to the Office of the Privacy Commissioner of Canada or the Office of the Information and Privacy Commissioner for British Columbia.

European Economic Area and United Kingdom

Under the GDPR and UK GDPR, you can ask for access, correction, deletion, restriction and portability of your personal data. You can object to processing based on legitimate interests, and withdraw consent where we rely on it. You can complain to your local data protection authority, or in the UK to the Information Commissioner's Office.

California

Where the CCPA applies, you can ask to know what personal information we collect, use and disclose, and ask us to correct or delete it. You can use an authorized agent, and we won't discriminate against you for making a request. In the categories that law uses, we handle identifiers (email address, IP address), account log-in details, internet activity (requests to our server), and the content you add. We use log-in details only to sign you in. We don't sell personal information or share it for cross-context behavioural advertising. Since we don't do either, there's nothing for a Global Privacy Control or Do Not Track signal to switch off, and those signals don't change how Tondo behaves.

Age limit

You must be at least 18 to create a Tondo account. We don't knowingly collect personal information from anyone younger. Sign-up doesn't verify age, so if you think someone under 18 has given us information, please email privacy@tondo.page and we'll look into it and remove it where appropriate.

Security

Tondo is served over HTTPS only. Each signed-in request acts only on your own page, sign-in attempts are rate limited, and live pages run no scripts. Uploaded images are checked and converted before they're stored. No service can promise complete security, so please use a strong, unique password. If a breach affects you and the law requires us to tell you, we will.

Changes to this policy

We'll update this page when what we do changes, and change the effective date at the top. If a change materially affects you, we'll also tell you by email or in the product before it takes effect. Features such as forms, payments, connected accounts or optional analytics aren't built. If we add them, we'll update this policy first.

Contact

For privacy questions and requests, including to reach the person responsible for privacy at GalleoApp, Inc., email privacy@tondo.page. To report a page, use report@tondo.page. For other legal matters, see our terms of service or email legal@tondo.page.