Your privacy
Tatspire is made by LenFi. This page is written in plain language from how Tatspire actually works, in the app and on the web. The full policy, alongside LenFi’s general privacy policy and imprint, is published at info.lenfi.uk.
The short version
Tatspire works fully as a guest, with everything stored only in your browser (on the web) or on your phone (in the app). Redeem codes, paid plans and Discover need an account — if you register, we also keep your name, age, browser or device and app version on our servers, for support emails and product analytics, and you are asked to explicitly agree to that first. As a guest nothing you save is ever uploaded. With Plus or Ultra you can optionally turn on sync (explicit consent, revocable at any time): your library is then kept in your account on servers in the EU, end-to-end encrypted with a key only you hold, so the app and the web share it. It is private to you and only ever shared if you publish something on Discover.
What is stored
Your tattoo references and photos, body studio placements, editor sketches, saved studios, and the profile details you choose to fill in (name, birth date, height, weight, body model, skin tone). Every profile field is optional. On the web, everything is encrypted with AES-256-GCM in your browser’s own storage (IndexedDB), using a key generated in your browser that can’t be read out of it. Tatspire never has a copy of that key. Signed in and with your consent (Profile → Account & data), your profile details and settings are also stored on your account so they follow you to other devices; they are not end-to-end encrypted. Clearing this site’s data in your browser deletes the local copy — export a backup first if you want to keep anything.
Sync (optional, Plus/Ultra)
Sync is off until you turn it on. Everything is encrypted in your browser or on your phone before it is uploaded (AES-256-GCM), with a data key that is itself protected by your sync passphrase and a recovery key only you have. Tatspire can’t read your synced library, and without your passphrase or recovery key it can’t be restored — unless you choose to switch on the optional “Let Tatspire help me get back in”: then a copy of your data key is kept, encrypted with a secret held apart from the database, and you can unlock your library again with your account password (and two-factor code). While it is on, Tatspire could technically read your synced library; every use is logged and switching it off deletes the copy. Earlier versions of your items are kept for your plan’s version history. Turning sync off, or “Erase cloud copy”, deletes the synced data from our servers.
If you register
An account is optional. Registering sends your email, your profile’s name and age, your browser/device and app version, and the time you agreed to this, to our backend (Supabase, EU). Your password is checked against known data breaches without sending it: only the first five characters of its SHA-1 hash go to the Have I Been Pwned service (k-anonymity). You can protect your account with two-factor login (an authenticator app). The sign-in session is kept in your browser’s local storage. With an account you also get service e-mails — a new appointment request, the studio’s answer, the answer to a plan request, a new review of a studio you manage, and a reminder the day before a confirmed appointment (with a calendar file). They are never advertising, are sent through an e-mail provider that only delivers them, and you can switch each kind off in Settings or with the link in the mail. The Tatspire team can also send messages inside the app to everyone or to chosen groups of accounts (for example a maintenance notice); e-mails of that kind go only to people who switched on “News from Tatspire” or, for important service notices, who have service e-mails on.
Discover and public profiles
Discover lets you browse, search and save tattoo designs from other users (free, account required) and publish your own finished sketches (Plus/Ultra). Publishing makes your public username, the rendered image, the photo of it tattooed if you add one, and its title, description and tags visible — your original layered sketch is never uploaded. Likes and saves only ever show as totals, never who liked or saved something. Your boards are private. A person’s public profile is off by default; turned on, it shows only your username and published designs. A studio account’s listing (address, contact details, opening hours) is public. Designs and profiles can be shared as links. Ultra’s private share links are encrypted in your browser with a key that only exists in the link. On Home, suggestions from Discover are picked in your browser from a random sample, so your library is never sent for it. Reports are reviewed by hand.
Studios and public profiles
The studio directory is shared: name, address, contact details and opening hours of tattoo studios, kept current by the Tatspire team and, for a studio with its own account, by its owner. A studio account’s listing is public by nature. A person’s profile is off by default; if you turn it on in your profile, it shows only your username and your published designs. Studios can be shown as “Tatspire Partner” or, when booked, “Sponsored” (always labelled; Ultra is ad-free). Promoted posts count only anonymous views and clicks — no user ids are stored. Your rating of a studio always counts in its average without anyone seeing who gave it; only if you choose to show your review is it published with your username, and the studio can answer it (see the section on reviews). When you open a studio page or tap its phone, e-mail, website, Instagram, WhatsApp or directions link, a per-day counter for that studio goes up by one; no user id, IP address or device is stored with it, and the studio sees only the totals. If you join an artist’s waiting list, the artist sees your username and your optional note until you leave the list; asking whether an artist is free returns only “free”, “partly” or “fully booked” for that day.
Studio accounts, artists and appointments
Studios using an account accept the terms for studios (see /studio-terms), which also make the studio responsible for the requests and Ink-Cards it receives. A studio account (linked to a studio by the Tatspire team after you ask for it) edits its public listing, adds managers and, if it has several locations, forms a company. To ask, you send your name, e-mail, optional phone, your role, links and a note on how to verify you; only you and the Tatspire team can read that request. A tattoo artist can create a public artist page (name, styles, city, about text, links) and lists themselves with a studio by giving it a one-time code; the artist can leave any time. If you send an appointment request, the studio — and the artist you choose — sees your name, e-mail, phone, what you wrote and, if you attach one, the published design; nobody else does, and your library and photos are never sent. A studio can publish its appointments as a secret calendar address (times, first names and artist, no e-mail or phone) and can let Tatspire read the busy times of its own calendar; nothing is stored from it. Studio reviews are one per person: only stars count unless you choose to show your review with your username; you can delete it any time, and any signed-in person can report a public review to the Tatspire team with a reason.
Ink-Cards and body measurements
You can send a studio an Ink-Card: the tattoos you want (a picture, a description, where it goes, how big, colour) and, only if you tick it, body information such as height, weight, skin tone or measurements like forearm length. Your body measurements live in your profile — in this browser and, if you use cloud sync, end-to-end encrypted in your account, so nobody but you can read them. They are saved as you type them so you never enter them twice. Only what you send on a card is copied to our servers where the studio (and the artist you address) can read it, together with your name and contact details; pictures are re-saved as small JPEGs without location or camera data. The card stays until you withdraw it — then it and its pictures are deleted — or delete your account. Studios can mark a card as seen and answer it.
Usernames
Your username is public and permanent. Offensive, hateful, extremist, sexual or misleading names (for example impersonating the Tatspire team) are refused, in several languages and with look-alike spellings, by a list the Tatspire team maintains. Checking a name compares it with that list only; nothing else is stored for it.
Studio reviews
You can rate a studio with stars and add a comment, once per studio. Whether the comment is shown publicly, with your username, is your choice and you can change or delete the review any time. The studio can answer a public review and can report it to us; a review that a studio reports is hidden for 14 days while we check it, and is then either removed or shown again. Anyone signed in can report a review. Reviews are not checked for whether the author was really a customer of the studio.
When something leaves your device
Importing an image from a link (our server fetches that page and picture for you and passes it straight back to your browser without keeping it); exporting a backup file or an image (you choose where it goes); signing in, registering and redeeming a code; sync, if you turned it on; loading the studio map (map tiles come from OpenStreetMap, studio data and ratings from our backend); rating a studio (stars only, account required, never shown to anyone), saving a studio as favorite while signed in, or reporting an issue with one; and using Discover. When you choose a password or a sync passphrase, the first five characters of its SHA-1 hash are sent to the Have I Been Pwned service (api.pwnedpasswords.com) to check whether it appeared in a known data breach; the password itself never leaves your device. If you allow location access on the Studios map, your position is used in your browser only to show what’s nearby — it isn’t sent to us.
Who processes your data, and why
Tatspire runs on Supabase (database, sign-in and file storage on servers in Frankfurt, EU) and is hosted on Vercel. When you pay on the web, Stripe processes your payment as its own controller for payments and fraud prevention (you are sent to a Stripe page). The studio map loads its picture tiles from OpenStreetMap, which then sees your IP address — so the map loads only after you click “Load the map” (you can take that back in Settings), and the studio search works without it. We process your data to provide the app and your account (contract), on your consent where the app asks for it (cloud sync, showing a review or profile publicly, sending body information on an Ink-Card, registration data for analytics) and, for security, abuse prevention and moderation, on our legitimate interest. A studio that receives your appointment request or Ink-Card processes that data itself, for answering you. Appointment requests and Ink-Cards stay until you withdraw or cancel them or delete your account.
Cookies and browser storage
Tatspire sets no cookies of its own and uses no tracking or advertising cookies. The website keeps your sign-in, your encrypted library and a few settings in your browser’s own storage, because the app needs them to work. Every item is listed in the cookie & storage policy at /cookies, where you can also switch the map on or off. Terms: /terms. Payments and withdrawal: /refunds.
Ads and sponsored content
The website shows no third-party ads and loads no ad or analytics trackers. Free and Plus see sponsored posts from studios in Discover, and studios can appear as “Sponsored” or “Tatspire Partner” on the map — always labelled and set by the Tatspire team. Only anonymous view and click totals are counted for them. Nothing from your library or account is shared with advertisers, and nothing is sold. Plans are paid on the web through Stripe and in the apps through the App Store or Google Play. Tatspire never sees your card details — Stripe and the stores process them — only that a subscription exists, which plan, and until when.
Diagnostics (optional)
Crash reports and performance data are off until you say yes (Settings → Diagnostics). They carry a random ID of this browser, the app version, browser and OS, the page and a cleaned error text — never your library, photos, name, email or account. They are kept 90 days and you can delete them any time. “Report a problem” only sends what you write and, if you allow it, recent error texts.
Your choices
Settings → Delete all data removes everything from this browser immediately (and, with sync on, from your account). Backup & restore exports everything as a file you control. Account & data lets you download what your account holds, and Settings → Delete account removes your account and all its server data yourself. You can sign out any time without losing anything in this browser.
Your rights
With an account, Settings → “Download my account data” gives you everything our servers hold about you as one JSON file (your encrypted library only as a count; use Backup for it decrypted). You can ask us at any time for access to, correction, deletion or a copy of the data we hold about you, restrict or object to its processing, and withdraw a consent with effect for the future. Most of it you can do yourself: edit your profile, withdraw Ink-Cards, delete reviews, turn sync off, export a backup, delete your account. For anything else write to support.lenfi@lenfi.uk. You also have the right to complain to a data protection supervisory authority.
Sensitive information
Body measurements and photos of your skin can be sensitive personal data. Providing them is always optional, encrypted like everything else, only ever synced end-to-end encrypted, never transmitted automatically, and deletable at any time. If you tick a note about your skin (for example scars) or measurements on an Ink-Card, you knowingly send this information to the studio, and you consent to that by sending the card.
Other people’s images
If you import a picture that isn’t yours, Tatspire keeps the source link so you can credit the artist. It stays private in your library and is never shown to anyone unless you share it yourself. Publishing someone else’s art to Discover is against the community guidelines and reportable as stolen art.
CONTACT
Questions about your data? Reach LenFi at support.lenfi@lenfi.uk.
Tatspire is not directed at children and is not intended for users under 16.