What tbf keeps, and where.

Your tbfs

Your tbfs and your photographs are kept by us, on Amazon Web Services in London, so that a new phone gets them back by signing in and so that the person you wrote to receives what you wrote. They are encrypted on the way to us and while they are stored, and a copy sits on each phone in the pair so the app works with no signal.

We can read them. That is the plain truth of keeping something on a server, and we would rather say it than imply otherwise. Nobody at tbf reads a tbf except at the written request of the person who wrote it, and there is no screen, tool or report inside the company that lists them. A court order could compel us to produce them; we would tell you if the law allowed it.

A card somebody shared

Either person in a pair can share a card its writer released. Sharing makes a page at its own link, and anybody who has the link can read it. The page shows the sentence, the date and, unless a paying person hid it, the writer's first name, and nothing else. It stays up until the person who shared it or the writer takes it down, or the pair ends.

A card sent to somebody new

You can send a card to somebody who does not have the app, by text, as a code to scan or as a link. Anybody who has that link can read the card. The page shows the sentence, the date and your first name, and nothing else. It stays readable until they join, you take it back, thirty days pass, or you delete everything. When they join, the card moves into your pair and the link stops showing it. We tell you the first time it is read, and the name of whoever joins.

Picking them from your contacts uses the iPhone's own picker. We never see your address book. The app is given only the contact you tap: the number goes to Messages and is not sent to us, and the first name, which you can change, is kept with the link until it ends.

Group cards

Somebody can start a group card for one person and send guests a link. Guests write in a browser, with no account. We keep what a guest writes, the name they sign with, and their email address if they give one, so their note can follow them into the app if they install it. A GIF a guest picks is loaded from GIPHY.

The finished card is read at its own link by whoever has it, which the person who started it passes on. A card set to open on the day cannot be read before it. The person it is for can remove or report any note on it.

Once a card has opened, pasting its link into a message shows the person's first name and how many wrote. The app you paste it into may keep that preview, and we cannot delete its copy.

Before a note lands on a group card bought on this website, one machine reads it. We send the note's words, the occasion, and whether the note holds a link or a phone number to TypeSafe, in the United States, which checks notes for us. Nothing about who wrote it or who the card is for goes with it. Their own terms govern what they keep. A note it keeps off the card is shown to the person who started it, with the writer's name, so a wrongly kept note can be put back.

A guest can add a video, a voice recording or a photo to a group card. It is kept with the card and made into a film of everybody who wrote. Amazon's picture check looks at frames of each one for anything explicit or violent, and Amazon's transcription service writes down what a video or a voice says, so the film can show the words; both run in our own Amazon account. A clip recorded in the tbf app is heard on your phone instead, and its words are sent with it; the place it was recorded is taken out before it leaves the phone. The app can also record both of its cameras at once, or put you in front of a photo you pick; either way only the finished clip leaves the phone. Photos you add to your note are redrawn on the phone first, which leaves out where and when they were taken. On a group card bought on this website, TypeSafe also reads those words and each typed note, to put the film in order; only scores and a choice of music come back, and only those are kept. The person the card is for can take a clip out of the film, or report it. While a recording is uploading it waits in the guest's own browser; it is deleted there once it is in, taken back or set aside, and one that could not be sent is deleted the next time the page opens after an hour. Everyone who writes on a card that allows it sees the others' notes and clips once they have sent their own. The person who started the card reads every note and clip as it arrives, and can hide one. A guest who asks to be told when the card has been seen gets one email, a day after it is opened. Clips and films go with the card, and a guest's removal code takes their clip back. While you make a group card on this website, what you have chosen so far is kept in your own browser, under tbf.draft, so you can come back to it. It is never sent to us until you pay, and it is deleted then, or after seven days.

Notes written to a card at work are checked the same way. A note it keeps off is shown to the company's managers and admins, with the writer's name, so they can put it on the card or delete it.

A tbf you put on your work group's board is read in the app by the people in that group until it comes down. The same machine checks it first, as it does a note to a card at work, and one it keeps off stays off the board.

A group card bought on this website is paid through Stripe, which holds the card details; we never see them. If you leave an email address on a card page to hear when the app is out, we keep it to send that one email, and delete it once it is sent, or after a year.

A gift on a group card is paid through Stripe too. We keep the amounts and Stripe's own references, and never card details. A guest who adds to a gift is sent one email with a link to what they gave; their address is not kept. To stop stolen cards being used, we keep codes made from the paying card, the address a payment came from and the browser, with a key only we hold, so nobody without it can turn them back into what they came from. They go 120 days after the card's day.

When the person it is for chooses a gift, Tremendous, in the United States, supplies the gift card. We send Tremendous an amount, a currency, a language, a random number and the first name on the card. What the person types on Tremendous's page, such as their email address, Tremendous holds as its own, under its own privacy notice.

If you add to a gift after writing, your browser keeps a note that you were asked, under tbf.gift in this site's storage, so you are not asked again, and holds the code of your own gift page for the trip to Stripe and back.

What we hold about you

If you use an assistant to make or find a group card, its maker, such as OpenAI or Anthropic, may keep the first names, occasion, day, card state and your cards left in that chat. A web card's manage code may also be there. That code opens the card's page, where the reading link appears after the day. We send no note, count or reading link to the assistant. You can disconnect it in Settings, but that does not erase an earlier chat held by its maker.

If you sign in with Apple: your Sign in with Apple identifier, and the name and email address Apple gave us when you first signed in, including a private relay address if you chose to hide your email. If you sign in with an email address: that address, and a password held by Amazon Cognito, the sign-in service we use, which we cannot read. Either way, the first name you choose, which is shown on what you write.

If you pick a username, it and your first name are public at tbfcards.com/@username. Your photo is too, but only if you switch on Show my photo on my link. Somebody you send a request to sees your photo in the app.

Your account holds no tbfs itself: it is what lets a new phone find your people and your tbfs again. Plans are paid through Apple, and we learn whether yours is active, not your payment details.

Each phone has an identifier and a notification token so we can send it a silent update or a line saying somebody wrote you one. We never send anybody anything they did not agree to.

Reports and messages

When you report a card, it is hidden on your phone and an email to us opens with the card's ids in it, never its words. A person reads every report. Blocking somebody ends your pair, and nothing more from them reaches you.

What you send from Tell us something, in Settings, is read by a person and kept without your account on it. If you ask for a reply, it keeps the email address you give.

What we count

A few kinds of event, under a random identifier that is not your account and cannot be joined to it: a tbf written, how many you are keeping, and the widget shown. No text, no names, no length of anything you wrote. Crash reports carry a separate random identifier and are scrubbed of content before they leave the phone.

Counting visits to this website

On this website and on the tbf work website we count visits with Amplitude. A random id is kept in your browser, and Amplitude is sent the pages you open, how far down each you scroll, how long it is on screen and how fast it loads, the links and buttons you press, the questions you open, which boxes in a form you fill in but never what you put in them, how many characters you copy but never which, when a page fails to work, the site that sent you, whether you are on a phone, a tablet or a computer and its system, and your IP address, which gives a rough location. No name and nothing you type. On a group card's own pages, where you write in, open it or look after it, the private link is never sent and nor are any words on the page: only that the page was opened, that a note went in and what it carried, such as a photo, how many notes the card had when it opened, that its link was copied or shared, and which tools were used, such as an AI photo edit, the kind of edit and how it ended, but never what was asked for. When you pay on this website, Amplitude is told whether it went through, by card or by Apple Pay or Google Pay, and the payment company's code when it did not. In the tbf work dashboard, Amplitude is sent the screens a member opens and the changes they make, by the kind of change and never what was in it, the member's role and language, and requests that fail. The company is counted under a scrambled form of its own id, never its name. The tbf app counts nothing here.

If you sign a company up, we keep the random id with the company's campaign tag, such as linkedin, and Amplitude is told when the company is made and when it first makes, sends and delivers a card and first pays. If you buy a group card here, Amplitude is told it was paid for, with its occasion and price. Never the company's name, the card's words or who it is for.

Amplitude keeps this in the United States. If your browser sends Global Privacy Control, nothing is counted. When a company or a card is deleted, the id goes with it from our side, so nothing we hold ties what Amplitude has to anybody. To have Amplitude delete what it holds for your browser, write to privacy@tobefair.app with the id, which your browser keeps under tbf.count.device. A setting such as night mode is kept in your own browser and never sent. If you choose a language on a card's page, your browser keeps it for a year in a cookie called tbf_lang, which holds the language's two letters and nothing else, so the page opens in it.

Deleting

Delete account, on the Settings screen, deletes your account, every tbf and photograph of yours on our servers, the pages of any cards shared from your pairs, and everything in the app on your phone, immediately. The person you wrote to keeps what is on their phone. If you signed in with Apple, we ask Apple to revoke your Sign in with Apple authorisation at the same time. Signing out deletes nothing.

Who we are

tbf is made by Comtev Ltd in the United Kingdom. Write to privacy@tobefair.app, or see support.