Safe by default

What TileSet stores, what it never stores, and what happens to your widgets when a platform has a bad day. Plain answers, so you can decide before you connect anything.

Your accounts

• We never see your passwords. Google signs you in on its own screen and hands us an access token.
• Tokens are encrypted. Every access token is stored encrypted, each with its own key. They never come back out: not in the dashboard, not to an AI agent, not in your data export.
• Sign-in is by Google or an emailed link. There is no TileSet password to leak. An emailed sign-in link works once and expires after 15 minutes, and we keep only a one-way hash of it. For app review, platform reviewers can be given a sign-in link to one dedicated test account; it works a limited number of times and expires. Session ids and API keys are stored as one-way hashes, so even our database cannot show them back.
• Agents get a key, never your tokens. When you connect Claude, Cursor or Lovable, it receives a TileSet key for your widgets and sources. It never reads your posts, reviews or testimonials: it gets counts, such as how many reviews a source holds, and a preview of the widget. Each one is listed under Agents & API, and revoking it there cuts that agent off.
• Sign-in needs a verified email. We refuse a Google account whose email address Google has not verified. An emailed link proves the address because only its owner can open it.
• Failed attempts are recorded. Failed sign-ins and refused API keys are logged with the reason, never with a key or your email address. Every week an automated review sums them up for our staff, so a pattern does not go unnoticed.
• Staff access is recorded too. Every staff action on an account, and every change to who on our team has access, is logged with who made it and why.
• Webhook URLs are secrets we cannot read back. A source’s webhook URL is shown to you once. We keep only a one-way hash of it, so it never appears again in the dashboard or an export. If one leaks, make a new one and the old URL stops working at once, or delete it.

Your visitors

• No cookies. The widget script sets no cookies and carries no visitor id.
• Anonymous counts only. The script tells us a widget loaded, a post was opened or a link was followed. We record the site’s domain, never the visitor’s IP address, and nothing that could link two visits to one person.
• Page paths are off by default. Paid plans can turn on page-level insights, which records the page path (never the query string). Turn it off and every collected path is deleted.
• Small and late. The script is under 10 KB compressed and loads after your page.
• The free badge loads nothing. Free widgets show a small “Shown with TileSet” link. The script draws it itself, so it fetches nothing until a visitor clicks it.

Your widgets

• No view caps. We never count page views against a limit, so a busy day cannot switch a feed off.
• Never an error box. If a platform is down or rate-limits us, the widget keeps showing the last posts it had. A deleted widget renders nothing rather than an error.

Your data

• Export any time. Settings has a button that downloads everything we hold about your account as one file, and says what it leaves out and why.
• Delete any time. Deleting your account revokes your sessions and keys at once and removes the rest within 7 days. Disconnecting a source removes its token immediately.
• Cached content expires. Each refresh overwrites the stored copy of your posts or reviews, and a copy nothing refreshes expires within 30 days.
• No selling, no ad tech. We do not sell or share your data, and we use no advertising or tracking vendors. Google Analytics counts visits to tileset.com only after a visitor allows it, and never runs in the dashboard, the API or your widgets.

Who runs it

TileSet runs on Cloudflare, which hosts and stores everything. Google provides sign-in. A business data provider turns a Maps link into a listing id and supplies the Google review content; it receives what you typed or pasted, and nothing about your account, your site or your visitors. YouTube content comes straight from YouTube. The details are in the privacy policy.

We do not hold a security certification of our own yet. Cloudflare, where everything lives, holds SOC 2 Type II and ISO 27001.