Privacy policy

Tamari handles two kinds of personal data, in two different roles.

• Account data is about the people who use Tamari: you and your teammates. Tamari DevRel decides how it is used, so we are its controller.
• Developer data is about the developers in your community: people who visit your docs, star your repositories, join your Discord or register for your events. You decide to collect it and send it to Tamari, so your company is its controller. We process it only on your instructions, to provide the service.

If you are a developer and want to know what a company holds about you, ask that company first. You can also write to us, and we will pass your request on and help them answer it.

• Your name, email address and profile picture, from GitHub or Google when you sign in with them, or your email address when you sign in with an emailed link.
• When your account was created and when you last signed in.
• The workspaces you belong to and your role in each, and invitations you send or receive.
• Your workspace's settings, such as its time zone, attribution window and data retention period.
• Your plan and subscription status. Lemon Squeezy, our payment provider, collects and keeps your payment details. We never see or store your card number.
• Visits to usetamari.com, without cookies: the page path (without query strings), the referring site, campaign tags in the address, your country, your device type, and a code made from your IP address and browser that changes every day, so we can count visitors without following anyone from one day to the next. We never store your IP address. When you are signed in, the visit is linked to your account, so we can see which parts of Tamari are used. We keep visits for 13 months. Do Not Track and Global Privacy Control turn this off.
• Error reports. When something fails, we record what failed, in which part of Tamari, and your browser type. These reports exclude email addresses, cookies, request bodies and query strings.

Depending on what you connect, Tamari receives:

• From the website snippet: a random visitor ID kept in a first-party cookie on your site, the address and title of each page viewed, the address of the page the visitor came from, campaign tags (utm_source, utm_medium, utm_campaign), and the time. Query strings and fragments are removed from addresses before storage. The snippet does not fingerprint browsers. It sends nothing for visitors with Do Not Track or Global Privacy Control turned on, or who opt out.
• From your backend, or Segment, RudderStack, PostHog or Mixpanel: the identifiers and events you send, such as an email address or user ID with a signup, a first API call or going live. From those tools, only the event names you map are recorded; other events are discarded. A Mixpanel service account you provide is stored encrypted.
• From GitHub: the public user ID and username of people who star, fork, open issues or pull requests, or start discussions in the repositories you connect, and when they did it.
• From Discord: the user IDs of members who join your server, and which channel they posted in on which day. Tamari never stores what anyone writes, and has no access to direct messages or voice. A member who runs /connect can link their verified email address and GitHub account.
• From Discourse: the forum user ID of members who join, start topics or reply, the email address a member signed up with, and which topics they posted in on which day, with each topic's title and address. Tamari never stores what anyone writes.
• From event lists you import, or Luma and Eventbrite when you connect them: attendees' email addresses, when they registered and whether they attended, and each event's name, date and city. Names of attendees are not imported. The Luma API key or Eventbrite token you provide is stored encrypted.

Every identifier is stored as a keyed hash unique to your workspace. Email addresses and GitHub usernames are also stored encrypted so they can be shown to you. The dashboard masks email addresses. It shows GitHub usernames in full, because they are public.

Do not send Tamari sensitive data, such as health, financial or government ID information. The service is not built for it.

We use account data to:

• sign you in and keep your account secure;
• run your workspaces, invitations and settings;
• send the emails the service needs: sign-in links and invitations;
• send monthly report emails and emails about your trial, which each email lets you stop;
• bill paid plans and apply plan limits;
• find and fix errors, and keep the service running.

We use developer data only to provide Tamari to the workspace that sent it: linking each developer's activity to their signup, crediting content and events, and building reports. Data is never shared between workspaces.

We do not sell personal data. We do not use it for advertising. We do not use your workspace's data to train machine learning models.

Our legal bases under the Nigeria Data Protection Act 2023 are the performance of our contract with you, our legitimate interest in running and securing the service, and compliance with legal obligations.

These providers process data for us, under their own security and data protection terms:

• Vercel: hosts the website and API.
• Supabase: hosts the database, in the United States (US East).
• Google Cloud: runs the background worker that processes events, in the United States (US East).
• Resend: sends sign-in, invitation, report and trial emails.
• Google: the YouTube Data API, for the public view counts of a channel you connect. No personal data is involved.
• Sentry: stores error reports, in the United States.
• Lemon Squeezy: processes payments as merchant of record, and handles invoices and tax.
• GitHub and Google: sign-in, when you choose them. GitHub, Discord, Discourse, Luma and Eventbrite: the integrations you connect.

We disclose data to authorities only when the law requires it, and we tell the affected customer unless the law forbids it.

Tamari's database and servers are in the United States, so data you send is transferred outside Nigeria. We rely on our providers' contractual commitments to protect it, as the Nigeria Data Protection Act 2023 requires for transfers.

• Developer activity and conversions are deleted when they pass your workspace's retention period: 12 months by default, adjustable between 3 and 36 months in Settings. Deletion runs every night.
• You can delete any developer at any time, with everything recorded about them, and stop recording them.
• Sign-in links expire after 15 minutes and invitations after 7 days.
• Account data is kept while your account is open. You can delete your account, or a workspace you own, in Settings. Your account is deleted at once, and a deleted workspace's data within 30 days, usually within a day, except records we must keep by law, such as billing records.
• Deleted data can remain in encrypted database backups until those backups expire.

• Data is encrypted in transit (TLS).
• Identifiers are hashed with a key unique to each workspace, and email addresses are encrypted with AES-256-GCM.
• Database tables are closed to direct public access. Every request is checked against your workspace membership.
• Sign-in methods must prove the email address: GitHub and Google addresses must be verified, and email links work once.
• If a breach affects your data, we will tell you without undue delay, and notify the regulator as the law requires.

On usetamari.com, Tamari sets only cookies the service needs:

• a session cookie that keeps you signed in, and short-lived cookies that protect sign-in from forgery;
• tamari_workspace, which remembers the workspace you last opened.

We use no analytics or advertising cookies on usetamari.com. Visits are counted without cookies, as described above.

On your websites, the snippet sets tamari_anon, a random visitor ID kept for up to a year, and tamari_optout for visitors who opt out. You are responsible for telling your visitors about it, and for any consent your law requires.

Under the Nigeria Data Protection Act 2023, you can ask to access, correct, delete or receive a copy of your personal data, to restrict or object to its use, and to withdraw consent where we rely on it. Workspace owners and admins can export their data as CSV files in Settings. For anything else, write to hello@usetamari.com. We answer within 30 days.

If you are not satisfied with our answer, you can complain to the Nigeria Data Protection Commission.

Tamari is a business service for people aged 18 and over. We do not knowingly collect data about children.

When we change this policy, we update the date at the top. For changes that affect how your data is used, we email account owners before they take effect.

Tamari DevRel operates Tamari. Questions and requests: hello@usetamari.com.