Privacy

Last updated 16 October 2026

Timbus (timbus.si) helps founders find, screen and draft applications for grants, accelerators and fellowships. To do that it has to hold facts about your ventures, some of them sensitive. This page says what it holds, who else touches it, and how to get it back or deleted. Questions: hello@timbus.si.

What Timbus stores

• Your account: the email address, name and account id Google returns when you sign in.
• Your fact files: what you tell Timbus about each venture and about yourself, including figures such as revenue, runway or headcount, and the writing samples that set your voice.
• Your work: conversations, the application pipeline and its outcomes, saved answers, and which feed items you dismissed.
• What you screen: the text of programme pages you ask it to read, and the text extracted from forms you upload. For screening, the uploaded file itself is not kept, only its text.
• PDFs you open in the Forms tab: the file and the text read from it, because filling a form needs the form. The filled copy you download is made on request and not stored.
• Claude connection tokens: only a one-way hash of each token, with when it was made, last used or revoked. The token itself is shown to you once and never stored.

What it does not do

• No advertising, no analytics or tracking scripts, and no data sold or shared for marketing.
• The only cookies are the ones that keep you signed in. Your browser also remembers your last conversation and a few display settings locally; that never leaves your device.
• Your facts are never shown to another founder or used to answer for another venture.
• Timbus never submits an application. It hands drafts and filled files back to you.

Who else processes it

Timbus runs on a few providers. Each sees only what it needs to do its part:

• Supabase: the database and sign-in.
• Vercel: hosting, and file storage for screened page text, uploaded form text and PDFs.
• Google: Google sign-in, and the Gemini models that screen, draft and read scanned pages. The text of a request, which can include your facts, goes to Gemini to be answered. Questions about a programme (never about your venture) may be answered with Google Search.
• Groq: a second model provider, used when Gemini is unavailable. It receives the same kind of request.

These providers are based in the United States and may process data there. When Timbus reads a programme page for you, that website sees a request from Timbus, not from you.

Why

To run the service you asked for: finding programmes, screening them against your facts, drafting answers, filling forms, and keeping your work between visits. Nothing is used for any other purpose.

How long

Until you delete it. You can edit or remove facts at any time. Delete your account from the Connect page, or email hello@timbus.si, and your account and everything stored under it is removed. Copies in provider backups expire on those providers' own schedules.

Your rights

• Access and export: download any venture as markdown, or everything as a zip with JSON and CSV, from the app.
• Correction: edit your facts directly.
• Deletion: as above.
• Objection or questions: email hello@timbus.si.

If you are in the EU, the UK or another place with data-protection law, you can also complain to your local data-protection authority.

Security

Traffic is encrypted. Every database query is limited to the signed-in founder's own rows by the database itself, not only by the app, and each request's sign-in is checked with the auth server rather than trusted from the browser. No system is perfectly secure; tell us at hello@timbus.si if you find a problem.

Children

Timbus is for founders and is not meant for anyone under 18.

Changes

When this page changes, the date above changes with it. See also the Terms.