Privacy Policy

Account info, only if you sign in. Getting an API key requires signing in with Google. We receive your name, email address, and avatar URL from Google via our authentication provider, Supabase — nothing else from your Google account. You never need to sign in just to view the site or read the docs.

API key data. We store a one-way SHA-256 hash of your API key (what every image request is actually checked against), a masked preview (e.g. ttk_ab12…9f3d), its status, and when it was created — tied to your account. We also store an AES-256-GCM encrypted copy of the full key so you can reveal it again later from the account menu instead of only ever seeing it once; the secret used to decrypt it is kept separately and is never stored in the same database, so a database leak on its own wouldn't expose usable keys. Regenerating your key replaces the hash and the encrypted copy and immediately invalidates the old one.

IP address, briefly. Every request to the image API is checked against a rate limit keyed to your IP address (or your API key, once authorized). This check happens in server memory and resets on every deploy — it is never written to a database or a persistent log.

The word/text you render. Whatever text and style parameters you send to the API (word, font, flowerSize, and so on) is used only to generate that one image, in memory, for that one response. We don't log, store, or review the words people render.

A theme preference. Whether you're using light or dark mode is saved in your browser's localStorage. It never leaves your device.

Cookies. Signing in sets a Supabase session cookie so you stay signed in between visits. We don't use advertising or third-party tracking cookies, and there is currently no analytics script on this site.

• To create and authenticate your account when you sign in.
• To issue, validate, and let you regenerate your API key.
• To enforce rate limits and prevent abuse of the free-tier API.
• To render the images your requests ask for — a one-time, in-memory operation.

TaamToom runs on two third-party services that process data on our behalf:

• Google — the sign-in provider. See Google's Privacy Policy.
• Supabase — hosts authentication and the api_keys table. See Supabase's Privacy Policy.

We don't sell data, and we don't share it with anyone else.

Your account and API key hash are kept until you ask us to delete them or you stop signing in. Regenerating your key immediately invalidates the old one, but the account row itself just gets a new hash — nothing lingers under the old key. Rate-limit counters live in memory and are gone the moment the server restarts. Rendered images are never written to disk or a database — each request produces a fresh image and nothing is retained afterward.

• Sign out at any time from the account menu — this clears your session cookie.
• Reveal your API key again anytime from the account menu.
• Regenerate your API key to invalidate the old one immediately.
• Email suryanagare23@gmail.com to request that your account and key be deleted entirely.

API keys are never stored in plaintext. A one-way SHA-256 hash is what every image request is checked against, and a separate AES-256-GCM encrypted copy is what lets you reveal your key again later — its decryption secret lives outside the database, so a database leak alone doesn't hand out usable keys. The underlying database table has row-level security enabled, and all reads/writes go through server-side code using a service-role connection, never directly from a browser.

TaamToom is not directed at children, and we don't knowingly collect data from anyone under 13.

TaamToom is an actively evolving, closed-beta product — this policy will change as the product does. We'll update the “Last updated” date above whenever it does; material changes will be called out on this page.

Questions about this policy or your data? Email suryanagare23@gmail.com.