The short version: TCA Plus collects the minimum it needs to run your account, sync your bookmarks, and honor your subscription or lifetime access. There are no ads, no third-party analytics or tracking SDKs, and your data is never sold or shared for marketing.
What we collect
- Account information. An email address and password, or your name and email from Google if you choose "Continue with Google." Until you create an account, the app may use an anonymous account identifier so your data can sync without registration. Passwords are stored only in hashed form by our authentication provider.
- Your app data. Tags (bookmarks) and recently viewed sections, tied to your account so they sync across your devices.
- Usage signals. Which code sections are opened and which search results are clicked, and search terms that return no results or fail — recorded without any link to your account. We use this in aggregate to rank search results by what practitioners actually use and to improve search. It is not used to build advertising or marketing profiles.
- Daily platform counts. Once a day the app adds one to an anonymous counter for its platform (Android, iOS, or web) and access level (subscriber, lifetime, or free) so we know which platforms to invest in. The counter contains totals only — nothing about you or your device is stored with it.
- Diagnostics. If the app crashes or hits an error, it may send a technical report — the error message, a stack trace, the app version, and your device's operating system and version — to our own servers so we can fix the problem. These reports are not linked to your account and are deleted within 90 days.
- Subscription status. Purchases are made through Apple or Google; we never see your payment card. Our subscription processor reports only your entitlement status (active, expired) keyed to your account.
- Legacy verification. If you owned the original paid TCA Plus app, the app may store a random device identifier and a note of which on-device traces of the old app were found, used solely to grant and audit lifetime access. On iOS, verification may use Apple's cryptographically signed purchase records.
- Server logs. Like nearly every website, our servers keep standard access logs (IP address, request path, timestamp) for security and troubleshooting.
What we don't do
- No advertising, and no advertising identifiers.
- No third-party analytics or tracking SDKs.
- No selling, renting, or sharing of personal data for marketing.
- No tracking you across other apps or websites.
Who processes data for us
TCA Plus runs on a small set of service providers, each processing only what their role requires: Supabase (database and account authentication), RevenueCat (subscription status), Apple and Google (payments and sign-in, per their own policies), and Cloudflare (web application hosting).
Offline content on your device
Sections you read or tag are cached on your device so they work in the field without a connection. That cache never leaves your device and is removed when you uninstall the app.
Retention and deletion
Your account data is kept as long as your account exists. You can delete your account and its synced data at any time in the app (Account → Delete account), or by emailing support@mostlyharmless.dev from the address on the account — see Delete your account for details. Legacy-access and purchase audit records may be retained where required for fraud prevention or financial record-keeping.
Children
TCA Plus is a professional legal reference and is not directed at children under 13.
Changes
If this policy changes, the new version will be posted at this address with an updated effective date.
Contact
Questions about this policy or your data: support@mostlyharmless.dev.