DRAFT FOR ATTORNEY REVIEW. Written for the twenty-state comprehensive privacy law landscape of 2026 (CA, CO, CT, DE, IN, IA, KY, MD, MN, MT, NE, NH, NJ, OR, RI, TN, TX, UT, VA, WA), with the Colorado Privacy Act and CCPA/CPRA as the reference points. Bracketed items are placeholders.
Last updated: [DATE]
[TABLINE ENTITY NAME] ("Tabline," "we") runs a service that lets readers buy access to individual articles and passes on participating publishers' websites. This policy explains what we collect, why, who we share it with, and the choices you have.
When you create an account: your email address.
When you save a card: a token from our payment processor, Stripe, that lets us charge the card, plus the card's last four digits, brand, and expiration for display. Stripe collects the full card details directly; we never receive them. Stripe's privacy policy is at stripe.com/privacy.
When you unlock or buy a pass: the publisher, the article identifier, the kind of purchase, the price, and the time. This is the ledger of your tab.
Automatically: your IP address, browser type, and the pages on which the Tabline unlock box appears, for security, fraud prevention, and to make the unlock box work. The Tabline snippet on a publisher's page loads a hidden frame from our domain to check whether you already have access; it does not track your reading on pages where you have not interacted with Tabline, and we do not use it to build profiles for advertising.
From publishers: when you become a subscriber of a publisher you have used Tabline with, the publisher tells us so that we stop charging you for passes there. We record that a conversion happened; we do not receive your subscription details.
We do not collect precise location, biometric, health, or other sensitive data, and we do not knowingly collect data from anyone under [18].
To provide the service: issue unlock tokens, keep your tab, charge your card, process refunds, and show your history. To prevent fraud and abuse, including velocity limits and dispute handling. To send transactional email: sign-in links, receipts, charge notices, failed-payment notices, and changes to terms. We do not send marketing email unless you opt in. To report to publishers (see below) and to produce aggregate, de-identified statistics such as average conversion rates.
Publishers, at your direction. When you unlock a publisher's content, we give that publisher your email address and the details of that purchase so they can provide access and contact you about their publication. You direct this disclosure by choosing to unlock. Each publisher's own privacy policy governs what they do with it, and they have agreed with us not to sell it or use it for cross-context behavioral advertising. We do not share your activity on one publisher's site with another publisher.
Service providers. Stripe (payments), [Resend] (email delivery), [hosting provider] (servers and database). They process data only on our instructions.
Legal. When required by law, to protect rights and safety, or in a merger or sale of the business, with notice to you.
We do not sell your personal information and we do not share it for cross-context behavioral advertising. We do not use third-party advertising or analytics trackers.
Your account and ledger for as long as you have an account, and for [7] years after for tax, accounting, and dispute records, which the law requires us to keep. Sign-in links expire in 15 minutes and are deleted when used. Server logs are kept for [90] days.
Depending on where you live you may have the right to access, correct, delete, or obtain a copy of your personal information, to opt out of sale, sharing, targeted advertising, or profiling (we do none of these), and to appeal a decision we make about a request. To exercise a right, email [privacy email] from the address on your account or use the controls at [tab.example/account]. We will respond within [45] days and will not treat you differently for exercising a right. If you have an authorized agent, we will ask them to show your permission.
We respond to Global Privacy Control signals as an opt-out of sale or sharing, which does not change anything because we do neither.
Residents of California can find the categories of information we collect and their sources, purposes, and recipients in this policy; we have not sold or shared personal information in the preceding 12 months.
We store passwords for no one (sign-in is by one-time link), hash session and link tokens, encrypt data in transit, and limit access to people who need it. No system is perfectly secure; if we learn of a breach affecting you we will notify you as the law requires.
Tabline is not for anyone under [18]. If we learn we have collected data from a minor we will delete it.
We will email you about material changes at least [30] days before they take effect. Questions: [privacy email], [postal address].