Privacy Policy

This policy explains what personal data Tuti's hosted service at tuti.so (the "Service") handles, why, and your choices. It sits alongside our Terms of Service. It doesn't cover servers that others run with Tuti's open-source code.

Two roles

• Our customers' accounts. For the people who sign up and work in the app, we decide how their data is used, as described here.
• Our customers' portals and widgets. When you post feedback, vote, read docs or message a company through a portal or widget it runs on Tuti, that company decides what's collected and why. We process that data on its behalf and only to run the Service for it. Its own privacy policy applies; please contact it with requests about your data, and we'll help it answer them.

What we collect

• Account details: your name, email address, password (stored only as a hash) and, if you sign in with Google or GitHub, your name, email and picture from them.
• Content: what you and your teammates, customers and visitors put into the Service: posts, comments, votes, articles, changelog entries, messages, emails to support addresses and uploaded files.
• Connected services: if you connect a GitHub repository, the pull requests, releases and files the GitHub App can read.
• Billing: your plan and payment history. Card details go straight to Stripe; we never see or store them.
• Technical data: IP address, browser and device details, and logs of requests and errors, used to run, secure and debug the Service.

Why we use it

• to provide the Service: sign you in, show your projects, send the emails you ask for (sign-in links, invites, notifications, "it shipped" emails);
• to run AI features you use, such as duplicate detection, AI answers and Autopilot;
• to bill paid plans and AI credits;
• to keep the Service secure, prevent abuse and fix problems;
• to tell you about important changes to the Service or these policies.

Our legal bases are performing our contract with you, our legitimate interest in running a secure and reliable Service, and legal obligations such as keeping billing records. We don't sell personal data, show ads, or use your content to train AI models.

Cookies

We use only the cookies the Service needs to work, such as the one that keeps you signed in. tuti.so sets no advertising or analytics cookies. A company may add its own code, such as analytics, to its portal; its policy covers that.

Who we share it with

We share personal data only with providers that help run the Service, each bound to use it only for that:

• Hosting and infrastructure providers that run our servers, database, file storage and background jobs;
• Cloudflare for DNS, network protection and customers' own domains;
• Amazon Web Services (Amazon SES) to send and receive email;
• OpenRouter and the AI model providers it routes to, for AI features, only when they're used;
• Stripe for payments;
• Google and GitHub if you choose to sign in or connect with them.

We may also disclose data when the law requires it, or to a buyer if Tuti is sold, who must keep this policy.

Where it's processed

Our providers process data in the United States and other countries. Where data leaves the EU, the UK or Switzerland, we rely on safeguards such as the European Commission's standard contractual clauses.

How long we keep it

We keep account data and content while your account or project exists. Closed inbox and AI conversations are deleted after a year. When you ask us to delete your account or a project (email [email protected]), we delete its data within 30 days, apart from backups, which expire on their own schedule, and billing records we must keep by law.

Security

Data is encrypted in transit, passwords are hashed, uploaded files are stored privately and served through signed links, and access to production systems is restricted. No system is perfectly secure; if a breach affects your data, we'll tell you as the law requires.

Your rights

Depending on where you live, you can ask to access, correct, export or delete your personal data, object to or restrict how we use it, and complain to your data protection authority. Email [email protected]; we'll answer within 30 days. You can change most account details in the app, and get a project's data through the API, within its plan's history limits; for anything older, email us.

Children

The Service isn't meant for children under 16, and we don't knowingly collect their data.

Changes

We'll post changes here and update the date above; for material changes we'll also email account owners.

Contact

Questions or requests about your data: [email protected].