Privacy Policy

Last updated: September 5, 2026

Data controller:Tribal House LLC, a limited liability company registered in Ghana (“Tribal House”, “we”, “us”). Privacy questions or data requests: [email protected].

PortBay is a local-first desktop app. The short version: your projects, their configuration, and your secrets live on your own machine. We collect as little as possible, we never sell your data, and the data that does reach our servers — only when you turn on a hosted feature — is minimal and, for sync, encrypted in transit and at rest.

This website is the exception, and we want to be direct about it. The app is local-first; portbay.app, the marketing site you are reading, is not. It runs third-party analytics on every page, including a session-replay tool. That is described in full below and in the cookie notice. The two are separate systems — nothing the website measures touches your projects, and nothing the app holds is sent to the website’s analytics.

This website

• Google Tag Manager and Google Analytics 4. If — and only if — you accept the Analytics category in the cookie banner, every page loads Tag Manager (container GTM-5PHF9XPR), which serves Google Analytics 4. GA4 receives the page URL and title, the referrer, your browser, device, operating system and language, a coarse location derived from your IP address, and five custom events: cta_download_click, brew_copy, checkout_open, cta_secondary_click and outbound_github. Those events carry only coarse UI context (which section, which page path, what was clicked) and never personal data. Google is our processor.
• Microsoft Clarity — session replay. If — and only if — you accept the Session replay and behavioural category, which is a separate checkbox from Analytics and is never switched on by accepting Analytics, every page loads Clarity (project x2pgz93col), which records your session: pointer movement, scrolling, clicks and taps, page-to-page navigation and time on page, plus your browser, device and a coarse IP-derived location. Those interactions are reassembled into a replay of your visit that we can watch, and into aggregate heatmaps. This website has no forms, no input fields and no login, so there is nothing here for you to type into; payment happens inside Paddle’s own iframe, a separate origin Clarity cannot see into. Microsoft is an independent recipient of this data.
• Consent comes first.Clarity is not on the page until you choose. Tag Manager is, running in Google’s consent mode, which forbids it from storing anything on your device until you agree — so Analytics sets no cookie and keeps no identifier for you before that point. A banner appears on your first visit offering Accept all, Essential only and Configure, with a checkbox per category and nothing pre-ticked. Continuing to browse is not consent and we do not treat it as consent. Your answer is kept in your browser’s local storage (key portbay.consent.v1) and never sent to us.
• Changing your mind. The Cookie settings link in the footer of every page reopens the dialog — or open it now. Withdrawal takes the same number of clicks as granting: switching a category off reloads the page so the running script is actually gone, and clears the first-party cookies it set here.
• Global Privacy Control. If your browser sends the GPC signal we treat it as an opt-out request: analytics and session replay stay off, and no banner is shown, because you have already answered. This matters here beyond CCPA/CPRA, because Clarity syncs an advertising identifier with c.bing.com. The dialog tells you when the signal was detected, and you can still opt in deliberately if you want to.
• Lawful basis. Consent (GDPR Art. 6(1)(a), and ePrivacy Art. 5(3) for the storage itself) for analytics and for session replay — you give it in the banner, and you can withdraw it at any time from the footer without giving a reason and without losing access to anything on this site. Legitimate interest (Art. 6(1)(f)) still covers the server logs described below, which are needed to serve the page at all. Content blockers also stop both scripts and nothing on the site breaks; Microsoft and Google offer direct opt-outs too, listed in the cookie notice.
• Nothing else third-party.Fonts are self-hosted from our own origin. There are no advertising pixels, social embeds, chat widgets or A/B testing tools, and the site’s Content Security Policy permits scripts only from Google Tag Manager, Microsoft Clarity and Paddle.
• Server logs. Our hosting infrastructure (Cloudflare) transiently processes your IP address and request metadata to deliver the site and protect it from abuse (legitimate interest, GDPR Art. 6(1)(f)).
• Checkout. The checkout page loads Paddle, our payment provider — see “Payments” below.

The desktop app

By default, everything stays on your device. You can use PortBay anonymously, fully offline, without an account — in that mode we receive no personal data from you at all. Telemetry and crash reporting are off by default and opt-in; when enabled, they carry app and environment metadata, never your project contents, file paths, or secrets.

One detail worth stating plainly.While telemetry is off, the app still records usage events to a local queue on your own machine — capture is local and network-free, and nothing is sent. Only delivery is gated on your consent. That queue is capped at 500 events and older ones are dropped rather than allowed to grow. The consequence: if you turn telemetry on later, that queued backlog is delivered along with new events, so opting in is not purely forward-looking. If you would rather it were, delete the queue directory before enabling telemetry — and if you never opt in, the queue is never sent anywhere.

On-device dictation learning.When you use PortBay’s dictation, the app keeps a small “learned jargon” store on your device so it better recognises the names, brands, and terms you use often. This vocabulary stays on your machine, is never transmitted to us or any third party, and you can clear it at any time with Reset learned vocabulary in the dictation settings.

Clipboard during paste. To insert a dictated transcript into another application, PortBay briefly writes the text to your system clipboard, issues a paste, and then restores your previous clipboard contents immediately afterwards. The write is tagged as transient so clipboard-manager apps skip it, and it stays entirely on your machine — no clipboard data is collected or transmitted.

PortBay accounts

Creating an account is optional and only needed for hosted features. What we store, and the legal basis for it (GDPR Art. 6):

If you enable sync, your project registry is encrypted on your machine before it leaves it — only ciphertext reaches our servers, and we cannot read it.

Payments (Paddle)

Pro subscriptions are sold through Paddle, our Merchant of Record. Paddle collects your name, billing address, and payment details under its own privacy policy and is an independent controller for that data — your card details never reach our systems. We receive only a purchase reference, the account it belongs to, and the amount.

Sub-processors and international transfers

Tribal House LLC is registered in Ghana and our infrastructure runs on Cloudflare’s global network, so data may be processed outside your country. Transfers of EEA/UK data rely on the safeguards above; where we access account data from outside the EEA, the same contractual safeguards and encryption measures apply.

Your rights

Under the GDPR you may access, rectify, erase, restrict, or port your data and object to legitimate-interest processing; under the CCPA/CPRA you may know, delete, and correct. We do not sell personal information and we run no advertising. One caveat we would rather state than omit: Microsoft Clarity contacts Microsoft’s own advertising-infrastructure domains and synchronises an identifier with them, which we do not control and do not use. If you want no part of that, the Clarity opt-out in the cookie notice stops it.

• Delete your account: Settings → Account → Delete account in the app signs you out everywhere and schedules the erasure of your account, license, devices, sessions, and encrypted sync blob. The purge completes 30 days after the request; signing back in within those 30 days cancels it. You can also email [email protected].
• Export your data: Settings → Account → Export my datadownloads the account data we hold as JSON — or email us and we’ll send it.
• We respond within the statutory window (30 days GDPR / 45 days CCPA). For billing data, contact Paddle or ask us to pass the request along.

You may also complain to your local supervisory authority (GDPR) or the California Privacy Protection Agency.

Retention

Account, license, device, and sync records are kept while your account exists and deleted when you delete it. Sessions expire automatically. Magic-link and login-flow records live for minutes. Aggregated, anonymous telemetry may be retained for analysis.

Website analytics.We have not set custom retention windows for Google Analytics or Microsoft Clarity — each applies its own policy, configured in the vendor’s dashboard and changeable by the vendor. Rather than quote a figure we cannot verify from our own code, we will confirm the current window against the live dashboards for any data-protection request: email [email protected].

The full policy

The complete product privacy policy — including the app’s local data handling, certificate issuance, and email practices — lives in the docs: docs.portbay.app/legal/privacy. Material changes are noted there and surfaced in-app.

Contact

Privacy questions or data requests: [email protected]. Security reports: [email protected].