01 · Who we are
Tapestry is a service of FINAL FAVOUR (PTY) LTD ("Final Favour", "we", "us"), registration number 2024/097778/07, of DURBAN, KWA-ZULU NATAL, SOUTH AFRICA. Under the Protection of Personal Information Act 4 of 2013 (POPIA), we are the responsible party for the personal information described here.
You can reach us, and our Information Officer, at help@finalfavour.com.
02 · What this policy covers
Tapestry is in a closed beta. This version covers what is live today:
- our public website,
tapestry.finalfavour.com; - accounts for invited founding members on our beta site,
dev.tapestry.finalfavour.com; - people who write to us.
What's coming. Tapestry is being built to hold your memories, photos, voice notes and the people in them. It will also let others contribute or view through links, let you export your archive, delete things on stated dates, receive messages on WhatsApp, and see your memories on maps. None of these is switched on yet. We will add each one to this policy before it is switched on, saying what it collects, why, who processes it, where, and for how long.
03 · Our public website
The public website shows information about Tapestry and our legal pages. Sign-in and sign-up there are closed during the beta.
- It sets no cookies and stores nothing in your browser.
- It has no analytics, advertising or tracking tools, and it loads no scripts from other companies.
- We don't keep logs of visits to it.
- Our pages tell your browser not to pass their address on to other websites you go to from them.
To deliver each page, our hosting provider necessarily receives your IP address and your browser's request.
04 · Beta accounts
Beta accounts are by invitation only. You join with a single-use invite code we give you.
What we collect:
- The way you sign in. This can be:
- your email address, if you use emailed codes;
- your mobile number, if you use text-message codes (South African +27 numbers only);
- your Google account, if you choose Google. Google sends us your account identifier, email address and name. Our sign-in service (Amazon Cognito) keeps the name and email address with your sign-in record. When your account is created, we copy the name into your Tapestry display name. You can change it at any time.
- Your display name, if you add one or keep the one from Google.
- Passkeys. For each passkey we keep:
- its credential ID and public key;
- its signature counter;
- how it connects (transports);
- its device type and backup state;
- the authenticator's model ID (AAGUID);
- when it was added and last used;
- a short label.
Your device's face, fingerprint or PIN unlocks the passkey on your device. Tapestry never receives it.
- Devices. We give each browser a random device key. For each device we keep a short label such as "Chrome on Windows", when it was last used, and whether you trust it. We never recognise a device by its IP address or browser details.
- Sessions. For each session we keep how you signed in, which device it's on, and when it started and was last used.
- Codes. We keep only a scrambled form (a keyed hash) of each one-time code, never the code itself. While a code is waiting to be used, we also keep the address it was sent to.
- Request counts. To stop sign-in being flooded, we count requests per network and per contact, under scrambled keys. We never store or log your IP address itself.
- Security records. We record important account events, with what happened and when:
- signing up and signing in;
- adding or removing a way to sign in;
- trusting or removing a device;
- account recovery.
Wrong codes, and sign-ins for accounts that don't exist, are only counted, not recorded against anyone.
Messages. We send sign-in codes and security notices by email and text message. No message from us contains a sign-in link. Our emails contain no tracking.
Cookies and browser storage on the beta site. Everything here is needed for sign-in to work.
| What | Purpose | How long |
|---|---|---|
Cookie __Host-tapestry_owner | Keeps you signed in. Hidden from page scripts and sent only over HTTPS to the beta site. | Until you sign out or the session ends |
Cookie __Host-tapestry-device | Your device key, so Tapestry can recognise a device you trust. Hidden from page scripts. | Up to 400 days |
| Tab storage | The Google sign-in step in progress, and an invite code | Until the tab closes |
| Browser database | A signing key your browser creates and can't export. It ties your session to that browser. | Until you sign in again or clear your browser's data |
| Browser storage | A note, under your account ID, that a prompt has been shown | Until you clear your browser's data |
05 · People who write to us
If you email us, we keep your name, email address, what you wrote and our reply, so we can help you and keep a record of what was agreed.
06 · Why we use your information
| Purpose | Lawful basis (POPIA s11) |
|---|---|
| Running your beta account: sign-in, sessions, devices, codes and security notices | Performance of our agreement with you |
| Preventing abuse, and keeping security records and operational logs | Our legitimate interest in a safe, reliable service |
| Answering your messages | Your request, and our legitimate interest |
| Meeting legal obligations | Compliance with law |
We don't sell your information, use it for advertising, or send marketing messages.
07 · Who processes your information
| Provider | What for |
|---|---|
| Amazon Web Services (AWS) | Hosting and delivering our websites (Amazon CloudFront), sign-in (Amazon Cognito), storage, encryption keys, logs, sign-in emails (Amazon SES) and text messages (AWS End User Messaging) |
| Sign-in, only if you choose it. Our email inbox (Google Workspace). | |
| Mobile networks | Delivering text messages |
WhatsApp (Meta): planned, not switched on. We plan to offer sign-in codes and account messages on WhatsApp, sent through AWS. WhatsApp isn't switched on, and we send no WhatsApp messages. Before we do, we will update this policy to say what is shared with Meta, why, where it's processed and how long it's kept, and we will tell existing members.
We disclose information to authorities only where the law requires it.
08 · Where your information is kept
- Stored: in AWS's Africa (Cape Town) Region. Our website's security certificate is managed in AWS's US East Region. It holds no personal information.
- Delivered: our websites reach you through Amazon CloudFront's global network. It serves each request from a nearby location, but may sometimes serve one from further away, so a visit may be handled outside South Africa. Only the websites' public files are kept there.
- Elsewhere: Google sign-in (if you choose it), our Google Workspace email, and mobile networks delivering text messages may process information outside South Africa.
We transfer personal information outside South Africa only as POPIA allows: to provide the service you've asked for, or to providers bound by data protection terms.
09 · How we protect it
Your information is encrypted in transit and at rest, and never sold, mined or used for training. We hold the encryption keys, and we say so: Tapestry is not end-to-end encrypted. Every website is HTTPS-only. Access is checked on every request. You can sign out, remove devices and end sessions at any time.
If a security compromise affects your personal information, we will tell you and the Information Regulator, as POPIA requires.
10 · How long we keep it
| Record | How long |
|---|---|
| Account details and ways to sign in | While your account is open |
| Sessions | A session stops working after 14 days unused, or 30 days at most. Signing out removes its record at once. Otherwise the record is removed within about a week of its 30-day limit, so it can remain for up to about 37 days after you sign in. |
| One-time codes, and the address a code was sent to | A code stops working after ten minutes. It's then scheduled for removal, usually within days. The address is removed as soon as the code is used. |
| Request counts | They stop counting after two hours to a day, and are then scheduled for removal, usually within days |
| Device records | Trust lapses after 90 days without use. A record is scheduled for removal 400 days after the device was last used. |
| Security records | While your account exists |
| Operational logs | One month |
| Emails to and from us | Up to a year after the last message, unless needed longer for a legal claim |
Our databases keep automatic backups for recovery, so a removed record can remain in a backup for up to 35 days.
11 · Your rights
Under POPIA you can:
- ask what we hold about you;
- ask us to correct it or delete it;
- object to processing based on our legitimate interest;
- complain to the Information Regulator.
Write to help@finalfavour.com. We'll confirm who you are before we act. If you ask us to delete your beta account, we will do it within 30 days.
You can complain to the Information Regulator (South Africa) at https://inforegulator.org.za.
12 · Age
Tapestry is for people aged 18 or older. We don't offer accounts for children. If we learn that a member is under 18, we will close the account.
13 · Changes
We will publish changes here with a new version number and date. Before any feature listed under "What's coming" is switched on, we will update this policy. We will tell beta members of any change that affects them.