TaleArt docsPrivacy policy
What TaleArt collects, why, for how long, who is responsible, and how to ask for your data to be corrected or deleted. Version of 31 October 2026.
The owner wrote this text personally, from what the code does. It is not legal advice, and the owner may have it reviewed by a lawyer later. Where something is not automated, this page says so and says what the owner does by hand on request.
1. Who is responsible
The controller of the data described here is Ido Lempert, an individual developer in Israel ("the owner", "we"), for the documentation site and for the TaleArt workspaces and accounts the owner runs. Contact: GitHub issues (see Your rights for how to ask privately).
There are three situations, and the roles differ:
- You read the documentation (section 3). The owner is the controller.
- You have an account in a workspace the owner runs (section 4). The owner is the controller of your account data. TaleArt is self-hosted: if you have an account in a workspace run by someone else, that operator is the controller and the owner has no access to the data.
- You see a TaleArt zone on someone's site or in someone's app (section 5). The site or app owner (the "customer") is the controller of its end-users' data. When the customer uses an API run by the owner, the owner is only a processor: the owner handles that data on the customer's behalf and for the purpose of delivering the zone, and not for the owner's own purposes. When the customer runs the API itself, the owner never receives that data.
2. In short
- No advertising, no tracking pixels, no analytics trackers on the documentation site, no profiling.
- No sale of personal data, and no sharing with data brokers or advertisers.
- The SDKs send a random visitor id and anonymous counts. Viewer properties, tags and the seen-and-frequency state stay on the device. The optional external user ID is used only to match a list and is not stored.
- The API stores no IP address, no user agent and no access log.
3. The documentation site
The documentation site is static pages hosted on GitHub Pages at taleart.lempert.site. The site's own code sets no cookie, loads no analytics, advertising or social-media script, and loads no web font or other resource from another company's server. Its two settings stay in your browser's local storage (see Cookies and local storage): your light or dark theme choice, and, if you change it, the API address typed on the API reference page. The API reference calls only the address you typed there, and only when you press "Execute".
GitHub, which hosts the pages, receives your IP address and the request details when you load a page, and keeps its own logs under its privacy statement. The owner does not see those logs. The same applies to GitHub issues you open: they are public, and GitHub processes your GitHub account data.
4. Accounts in a workspace (dashboard and API)
The dashboard and the Management API store the following about the people who use them:
| Data | Why | Notes |
|---|---|---|
| Name, e-mail address, role (admin or content manager), time created | To run your account and show who did what in a project | Stored as typed. An invitation is needed to register; there is no open sign-up. |
| Passkey: credential id, public key, counter, transports, times created and last used | To sign you in | Only the public key is stored. The private key stays on your device or in your password manager. |
| Username and password hash (when the password method is on) | To sign you in | The password itself is never stored. The hash is salted scrypt. Passwords found in a list of common passwords are refused. |
| Provider identity: provider (Google, Apple or another OpenID Connect provider), the provider's subject id, the e-mail the provider gave, times created and last used | To sign you in with an external provider, when an admin turned one on | The provider receives a sign-in request and tells us who you are; see its own policy. The e-mail is shown and is not used to sign in. |
| Session: a hash of a random token, time created, expiry | To keep you signed in | The token itself is only in your cookie. A session lasts 7 days. |
| Short-lived sign-in challenges (passkey or provider steps) | To finish a sign-in safely | Valid 5 minutes (passkey) or 10 minutes (provider) and used once. |
| Invitations and password reset links: hash of the token, who made it, times, when and by whom used | To let you join or recover access | Invitations last 7 days and reset links 24 hours. Each works once. |
| API tokens you create: a hash of the token, name, projects, times | For scripts and the command-line tool | The token is shown to you once. |
| Project membership, and the projects, zones, tales, fonts, media, theme and targeting settings you create | To provide the service you use | This is your content. Tale media is served from public addresses so viewers can see it. Uploads are images up to 10 MB and video up to 100 MB each. |
| User lists you upload: the external user IDs, stored only as a keyed hash (HMAC-SHA-256) with a secret of the project | To show tale groups to the viewers on a list | The original IDs are not kept, and the hashes go with the list when you delete it. |
The API writes errors to its standard output as structured lines (the error name, message and stack). It keeps no per-request access log and no audit log of its own. A host that runs an API (for example a reverse proxy or a hosting provider) may keep its own logs, which the operator controls.
Legal bases. For account data: it is necessary to give you the service you asked for (the contract in the Terms) and to keep it secure, which is also a legitimate interest of the owner and of the operator. For the Israeli Protection of Privacy Law, 5741-1981: you give the data to us knowingly and for these purposes when you accept an invitation and sign in, and we use it only for them. Where the law requires your consent for something, we ask for it first.
5. What the SDKs and the Delivery API process (end-users)
This section is for the customers who use the SDKs and for the end-users who see a zone. The customer decides to use TaleArt and is the controller (section 1); a customer must cover these points in its own privacy notice and ask for consent where the law or the platform requires it (for example before storing a visitor id or sending analytics). See the Analytics reference and the Web guide for the details.
| Data | Where it goes | Why and notes |
|---|---|---|
| Zone key | Sent to the Delivery API in the Authorization header (never in a URL) | Says which zone to deliver. It is a credential for reading the zone, not a personal identifier. |
| Visitor id: a random UUID the SDK makes once per browser or app install | Kept on the device. Sent in the X-TaleArt-Visitor header (in the body of a beacon) with analytics events and answers, and when reading a zone. | Limits requests per visitor and counts each visitor once. It contains no personal data and is tied to no account, but it is a stable identifier of a browser or an install, so the customer should treat it like other local identifiers. |
| Analytics events: type (impression, open, view, click), tale group id, tale id (views and clicks), time | Sent to the Delivery API, which stores them with a hash of the project id and visitor id | Gives the customer counts in the dashboard. The stored hash is SHA-256 of the project id and the visitor id, so a visitor cannot be linked across projects. No IP address, user agent, external user ID, tags or viewer properties are stored with an event. Can be turned off with analytics: false in the SDK. |
| Answers to a poll, quiz, rating or reaction: the chosen value, tale, element, time and the visitor id | Sent to the Delivery API and stored in the project's database | Gives the customer its results and lets each visitor answer once. The visitor id is stored as received here, not hashed. The data is the customer's. |
| External user ID (optional, set by the customer's code) | Sent only as a request header (X-TaleArt-External-User-Id) when reading a zone; held in memory in the page or app, not in storage or a cookie | The API hashes it as soon as it reads it, checks it against the project's user lists, and does not log or store it. It is not sent with analytics events and is never combined with the visitor id. The customer must use an opaque ID, not an e-mail address or phone number. |
| Viewer properties, targeting tags, locale, theme | Stay on the device. Never sent to the server | The API sends every group with its audience rule, and the SDK evaluates the rule in the page or app. |
| Seen tale groups, frequency-cap views, the answers given | Stay on the device, in local storage or native preferences | Used to show a group once or a limited number of times, and to show an answer already given. |
| IP address | Seen by the API for each request; used in memory only | Used to rate limit abuse (a request without a visitor id is limited by its address; every request also counts against an address allowance). Never written to the database or to a log by the API. A host in front of the API may log it. |
The customer's tale content (text, images, video, links) is shown to every viewer who has the zone key. It should not contain personal data.
6. Cookies and local storage
Cookies. The documentation site, the dashboard's pages and the Delivery API (which serves the SDKs) set no cookie. Only the Management API sets these three, all HttpOnly, all strictly for signing in, and no consent is needed for them under most laws because they are strictly necessary:
| Name | Purpose | Duration |
|---|---|---|
taleart_session | Keeps you signed in. SameSite=Strict, and Secure when the workspace is served over HTTPS. | Up to 7 days, or until you sign out |
taleart_challenge | Links a passkey sign-in or sign-up step to your browser. SameSite=Strict. | 5 minutes |
taleart_oauth | Links a Google, Apple or other provider sign-in to your browser. SameSite=Lax. | 10 minutes |
Local storage and similar. These stay on your device. The owner never receives them, except the visitor id as described above.
| Key | Where | Purpose | Duration |
|---|---|---|---|
taleart-docs-theme | This documentation site | Your light or dark theme choice | Until you clear site data |
taleart-docs:api-reference:api-url | This documentation site | The API address you typed on the API reference page (kept only when it is not the default) | Until you clear site data |
taleart.selectedProjectId | The dashboard | The project you picked in the top bar | Until you clear site data |
taleart.visitor | Web SDK, on the customer's site | The random visitor id | Until cleared by the visitor (Safari may clear it after 7 days without a visit) |
taleart.seen | Web SDK, on the customer's site | The ids of the tale groups viewed (up to 500) | Until cleared |
taleart.views | Web SDK, on the customer's site | Times of recent views for the frequency cap (up to 50 per group, 500 groups) | Until cleared |
taleart.responses | Web SDK, on the customer's site | The answers the visitor gave, so they are shown again (up to 200) | Until cleared |
taleart-banner-dismissed:<group ids> | Web SDK, on the customer's site (session storage) | Remembers that a sticky banner was closed | The browser session |
taleart.visitor, taleart.seen, taleart.views, taleart.responses | Android SDK (the taleart-sdk SharedPreferences) and iOS SDK (the taleart-sdk NSUserDefaults suite) | The same four uses as above | Until the app's data is cleared or the app is removed; a device backup may restore them |
If the storage is missing or blocked, the SDK still works: the visitor id then lasts only for the page load, and the seen and frequency state is not kept.
7. Sharing, sale and advertising
The owner does not sell personal data, does not use it for advertising or marketing, and does not build profiles. He shares data only with:
- GitHub (hosting of the documentation pages, the source code, the issues and the build and release automation);
- npm and Maven Central, where the SDK packages are published (they see the usual package download data; the owner receives no personal data from them);
- sign-in providers (Google, Apple or another provider), only if an admin turned one on and you choose it;
- the hosting provider of a workspace the owner runs, which stores the database and the uploaded media for the owner;
- authorities, when the law requires it, or to protect the owner's legal rights.
8. International transfers
The owner is in Israel. GitHub, npm and some providers process data in the United States and elsewhere. A workspace stores its data wherever its operator hosts it. When data of people in the European Economic Area is moved out of it, the owner relies on the transfer tools that apply to the provider (such as an adequacy decision or standard contractual clauses in the provider's own terms). Israel has an adequacy decision from the European Commission.
9. How long data is kept, and what can be deleted
| Data | Kept | Deletion |
|---|---|---|
| Analytics events | 400 days, then deleted by a job that runs once a day | Automatic |
| Sessions | Stop working after 7 days or when you sign out | Sign-out deletes the session. Expired rows are cleared the next time the same user signs in, and all of a user's sessions end when a password reset link is used. |
| Sign-in challenges | Minutes | Used once; expired ones are cleared by later sign-ins |
| Passkeys, the password, linked provider identities | Until you remove them | Self-service in your account's sign-in methods (the dashboard stops you removing your last method) |
| API tokens, zone keys, site keys | Until revoked | Self-service, in the dashboard or the API |
| Tales, tale groups, user lists, fonts | Until you delete them | Self-service. Deleting a tale deletes its answers. Deleting a user list deletes its hashes. |
| Account (name, e-mail, role, membership), projects, uploaded media files, answers of a deleted zone, used invitations and reset links | Until the owner or operator deletes them | Not automated. There is no self-service account deletion, project deletion or data export in the dashboard today. On request, the owner (or the operator) deletes or exports the data by hand in the database and the media storage. |
| Data on your device (local storage, preferences) | Until cleared | You clear the site's data or the app's data. The SDKs have no remote way to do that. |
Backups made by an operator are the operator's own and may keep deleted data until they expire.
10. Security
These measures exist in the code. No system is perfectly secure, and the owner cannot promise it.
- Passwords are hashed with scrypt and a random salt, never stored in clear. Session, invitation and reset tokens are random and only their SHA-256 hash is stored.
- The session cookie is
HttpOnlyandSameSite=Strict, andSecurewhen the workspace is served over HTTPS (HTTPS is the operator's responsibility). - Passkeys keep their private key on your device; the server holds only the public key.
- Sign-in attempts with a password are throttled. The Delivery API is rate limited per visitor and per address.
- Secrets of external sign-in providers are stored encrypted with AES-256-GCM.
- Users reach only the projects they belong to; user list IDs are kept only as keyed hashes; analytics visitor ids are stored only as hashes that differ per project.
If a breach of personal data in a workspace the owner runs puts people at risk, the owner will notify them and the authorities as the law requires.
11. Children
TaleArt is not meant for children. The dashboard is for adults who run campaigns, and the owner does not knowingly collect data from children. A customer whose site or app is directed at children is responsible for meeting the rules that apply to them, including whether to use the SDK's visitor id and analytics at all.
12. Your rights and how to use them
Depending on where you live, you may have the right to ask whether we hold data about you and to get a copy; to correct it; to have it deleted; to restrict or object to its use; to take it with you (portability); and to withdraw a consent you gave. Under the Israeli Protection of Privacy Law you may inspect information held about you and ask for it to be corrected or deleted. You may also complain to your data protection authority (in Israel, the Privacy Protection Authority).
To use a right:
- Open an issue at GitHub issues with the title "Privacy request" and no personal details, asking for a private way to talk. The owner will answer there and agree with you how to confirm that you are who you say you are, before the owner gives out or deletes anything.
- The owner aims to answer within 30 days. Deletion and export are done by hand (see section 9).
- If you are an end-user of a site or app that uses TaleArt, ask that site or app first; it is the controller. The owner can then help it, as its processor. Because the visitor id is random and tied to no name, the owner can find a visitor's records only if you give the visitor id from your device (the value of
taleart.visitor). Clearing your browser's or app's data gives you a new id.
13. Changes
The owner may update this policy when the software or the law changes. The date at the top shows the current version, and the repository's history on GitHub keeps earlier ones. A change that matters to account holders will be announced on this site or the dashboard sign-in page before it applies.
Read also the Terms of service and the Accessibility statement.