Privacy policy

Last updated 25 October 2026

Who we are

The Tiny Oak (“we”, “us”) provides the app at grow.thetinyoak.com and this website, thetinyoak.com. This policy explains what personal information we handle, why, and the choices you have.

Each organisation that uses The Tiny Oak (“your organisation”) has its own workspace. Your organisation decides who is in it and what is recorded there, and is responsible for that information. We process it on your organisation’s behalf and under our agreement with them. If you have a question about information your organisation keeps about you, you can ask them directly, or contact us and we will pass it on.

What we collect

When you sign in

We use Google Sign-In. Google shares your name and email address with us, and we use your email address to find your workspace. We never see your Google password.

What your organisation records in its workspace

• People details: name, work email, role, manager, team, location and start date.
• Work content: goals, progress updates, files attached as evidence, tasks, comments, self-assessments, reviews, 1:1 notes and ratings.
• Where your organisation uses these parts of the app: salary and incentive figures, payroll and attendance records, and client, contract and cost records.

When you use the app

• Usage information: the pages you open and errors you hit, so we can see what works and fix what doesn’t.
• A record of changes (who changed what, and when), which keeps your organisation’s data trustworthy and lets us investigate problems.
• Emails we send for your organisation, such as reminders and summaries, and whether they were delivered.

When you contact us

If you ask for a workspace or a walkthrough, we keep your name, email, company and message so we can reply.

Google Calendar and Gmail

Connecting Google Calendar or Gmail is optional, and you can disconnect at any time from the app or from your Google account permissions.

• Google Calendar: to show your upcoming events in the app and to add your tasks to your calendar as events, and keep those events up to date.
• Gmail (read-only): used only where your organisation turns on attendance syncing. We search the connected mailbox for the daily attendance report your attendance system emails, and read those messages to record attendance for payroll. We don’t read, store or use any other email.

The access tokens Google gives us are stored encrypted. The Tiny Oak’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. In particular, we use Google user data only to provide the features above; we don’t transfer it to others except as needed to provide those features, for security, or to comply with the law; we don’t use it for advertising; we don’t use it to train AI or machine-learning models; and no person at The Tiny Oak reads it unless you ask us to for support, it is needed for security or the law, or it has been aggregated and made anonymous.

How we use information

• To run the app for your organisation: sign-in, showing the right information to the right people, sending the emails your organisation sets up.
• To keep it secure, prevent misuse and fix problems.
• To improve the app, using usage information about how features are used.
• To reply when you contact us, and to tell administrators about important changes to the service.

Who can see what inside a workspace is set by your organisation’s roles and permissions. For example, pay figures are visible only to the people your organisation allows to see them.

Who we share it with

We don’t sell personal information. We share it only with the service providers who help us run The Tiny Oak, under agreements that require them to protect it and use it only for us:

We may also disclose information if the law requires it, to protect people’s safety or our rights, or as part of a sale or merger of our business, in which case this policy would continue to apply.

How long we keep it

We keep a workspace’s information for as long as your organisation uses The Tiny Oak. When an organisation’s workspace is deleted, its information is removed from our live systems, and from backups as they cycle out. Demo workspaces (“sandboxes”) contain sample data and are deleted when they are no longer needed. Usage information and the record of changes are kept with the workspace and deleted with it.

Security

Information is encrypted in transit, files are kept in private storage and opened only through short-lived links after a permission check, and Google tokens are encrypted at rest. Each organisation’s data is kept separate from every other organisation’s. No system is perfectly secure, but we work to protect your information and will tell affected organisations promptly if a breach affects their data.

Your choices and rights

Depending on where you live, you may have the right to see the personal information held about you, correct it, delete it, or object to how it is used. Because your organisation controls its workspace, many requests are best made to them; you can also write to hello@thetinyoak.com and we will help, or pass your request on.

Cookies and browser storage

We don’t use advertising or tracking cookies. The app keeps your sign-in and a few preferences (such as a guide you have hidden) in your browser’s storage so you stay signed in and the app remembers your choices.

Children

The Tiny Oak is a tool for workplaces and is not meant for anyone under 18.

Changes to this policy

If we change this policy we will update the date at the top, and tell workspace administrators about significant changes before they take effect.

Contact

Email hello@thetinyoak.com with any question about this policy or your information.