1. Who handles your information
TuneSteps operates tunesteps.com from Roseburg, Oregon, United States. For privacy requests, contact tunelabservice@gmail.com. This policy describes the current service as of October 21, 2026.
2. Information used by the service
- Account: your email address, account identifier, sign-in and verification records, and authentication session.
- Purchases: account and payment identifiers, purchase time, test/live status, access status, refund or dispute records, and the policy version and agreement time supplied when checkout is created.
- Technical and security information: IP address, browser and request information, timestamps, and service/error logs processed by our hosting, authentication, email, and payment providers. Your IP is used for sign-in rate limiting.
- Support: messages and any files or details you choose to email us. Do not send passwords, sign-in codes, full payment-card details, or secret keys.
Payment-card details are entered on Stripe’s checkout page. TuneSteps does not receive or store your full card number or card security code.
3. CSV files, progress, and browser storage
The current CSV analyzer parses and analyzes files locally in your browser. Selecting a CSV does not upload its contents to TuneSteps, an AI service, or our payment provider. Generated practice logs are also processed locally. If you email a log or report to us, its contents become part of that support correspondence.
Vehicle profiles, lesson progress, notebook entries, and practice settings are saved in local browser storage. A note or exported report can contain log details you choose to include. These original lab records are not automatically synchronized to a server. Exported files are saved to your device under your control.
Optional private vehicle workspace
In Vehicle history & reports, you may choose Save privately after checking the saving notice. This stores vehicle details, modification notes and dates, owner-reported concerns and repair notes, your chosen log titles, log fingerprints, quality and channel-coverage information, and browser-computed analysis summaries in Supabase, linked to your account. Full CSV files, raw sample rows and original filenames are not uploaded by this feature. Avoid including sensitive personal information in free-text notes.
Your saved workspace loads when you open the feature while signed in with paid access. Changes are saved only when you choose Save privately again. Saved summaries cannot replace original sample data for detailed event analysis or independent verification. Limits are 20 vehicles, 100 summaries and 512 KB per account.
Use Export saved-data backup for a local copy, or Delete all saved workspace data to remove the active database copy. We retain these private workspace records until you delete them or your account is deleted. Provider backups may retain copies until their normal expiry. Workspace deletion does not remove your account, purchases, downloaded files or separate local lesson progress. Contact us if you lose access and need an export or deletion request.
Floating notebook and saved notes
The floating notebook keeps a draft and its window position in account-specific browser storage on your device. Minimizing it keeps the draft. Drafts can remain after sign-out; clear this site’s browser storage on a shared device when finished.
When you choose to save notebook notes privately, the note title, text, vehicle/context label, creation/update times and combined-note source identifiers are stored in Supabase linked to your account, separately from vehicle snapshots. Saved notes are available across signed-in devices. Notes are limited to 100 entries, 20,000 characters each and 256 KB per account. Only saved notes are synchronized; typing does not upload a draft. Avoid including passwords, financial information or other sensitive personal information.
You can edit, export, print or delete saved notes in Notebook & reports. Combining notes creates a new draft and keeps the originals. Deleting a saved note removes the active account copy; open browser drafts, exports and provider backups awaiting expiry may remain. Saved notes remain until you delete them or your account is deleted. Existing browser-only workshop notes are not automatically uploaded.
The site uses secure, HttpOnly cookies for short-lived access tokens and session renewal. If you choose Stay signed in, renewal cookies can remain for up to 30 days after use, subject to provider expiration or revocation. Otherwise renewal cookies are browser-session cookies; some browsers restore these when reopening tabs. Signing out clears this device’s authentication cookies. Short-lived encrypted cookies bind Google sign-in to your browser and confirm recent verification for password changes. Authentication tokens and passwords are not stored in browser local storage. Passwords are submitted over HTTPS to our server and verified or securely hashed by Supabase; TuneSteps does not keep plaintext passwords. When enabled, Google sign-in shares basic identity information such as your email and account identifier with Supabase and TuneSteps; we do not request access to Gmail, Drive or contacts. Local progress can remain after sign-out; on shared devices, remove the site’s stored data when finished. You can clear cookies and storage through your browser, but doing so can sign you out and delete progress. Account deletion does not automatically clear files or storage on your devices.
4. Why information is used
We use account and technical information to send requested sign-in codes, authenticate you, deliver purchased access, prevent misuse, diagnose service failures, and answer account questions. Purchase records support payment confirmation, refunds, dispute handling, reconciliation, and required business records. We use support messages to respond to your request. Optional private workspace data is used to restore your saved vehicle history, show historical summaries, recommend educational lessons and generate the reports you request. It is not used for public sharing, advertising, research or model training by this feature.
The current site has no advertising tags, behavioral advertising, or marketing analytics scripts installed. We do not sell your personal information or share it for targeted advertising. We do not automatically subscribe account holders to a marketing newsletter.
5. Service providers and external links
Providers process information needed to operate the service:
- Cloudflare: website hosting, network delivery, and security.
- Supabase: account authentication, account records, purchase/access storage, and optional private vehicle workspace storage.
- Resend: delivery of requested sign-in emails.
- Stripe: checkout, payment processing, refunds, and dispute handling.
- Google/Gmail: support correspondence sent to our contact email.
Providers may process information in the United States or other countries where they operate. Their own processing is described in their policies: Cloudflare, Supabase, Resend, Stripe, and Google.
We may also disclose information when required by law, to address fraud or security incidents, or to protect legal rights. External resource links take you to other websites with their own policies. No account details or CSV contents are intentionally included in those links.
6. Storage, retention, and security
We retain account records while they are needed to provide access, and purchase, support, security, or related records as needed for their purpose, applicable recordkeeping duties, fraud prevention, or resolving disputes. Provider logs and backups may have separate retention periods. Clearing browser data does not delete server-side account or payment records.
We use encrypted connections and restricted access controls. No internet service can guarantee absolute security. We avoid requesting sensitive material that is unnecessary for educational access or support.
7. Your choices and privacy requests
Email tunelabservice@gmail.com to request access to, correction of, or deletion of information associated with your account, or to ask how it is used. Send the request from your account email when possible. We may verify your identity before acting; never send us a sign-in code. We will explain any records we must retain and any impact on your paid access before completing an account-deletion request.
You can export your local progress and delete local storage yourself. Rights and response requirements vary by location; this policy does not limit rights you have under applicable law.
8. Age and policy changes
Accounts and purchases are intended for adults aged 18 or older. We do not knowingly collect children’s account information. Contact us if you believe a child has provided it so we can investigate and take appropriate action.
If we add advertising, analytics, cloud log uploads, or other material data uses, we will update this policy and implement any required notices or consent before introducing them. The date and version shown on this page identify the current notice.