Privacy policy

Last updated 6 November 2026

The short version

Tutti runs your AI agents on your own machines. Your source code, prompts, diffs and terminal output never reach our servers. We keep only what's needed for your account to work.

What we store

• Account: your email address and, if you use them, your Google or GitHub sign-in identity.
• Devices: the computers and browsers you sign in on: a name, the operating system, the app version and when they were last seen.
• Settings you choose to sync between your devices.
• Consents: which agreements you accepted and when, and your choice about usage metrics.
• Feedback you send us.
• Support requests from the contact form: your name, email address, message and, if you add them, your Tutti version and system, kept for up to two years to answer you. We keep a one-way hash of your IP address with each request only to limit abuse of the form, never the address itself.
• Activity days: the days you used Tutti, without any detail of what you did.
• Feature counts, only if you opt in: once a day the app sends how many times you used a few features the day before (sessions started, team chats, board cards created, started and approved, board syncs, tutti.toml edits). Only these numbers, never what the sessions, cards or chats were about.

Feature counts (opt-in)

The Tutti app counts a few feature uses per day on your machine. If you tick Send anonymous daily feature counts on your account page, it sends yesterday's numbers once a day; we only look at them as totals across everyone, to learn which features are used. If you don't, the counts never leave your machine and are deleted after 7 days. You can switch it off at any time; the app then stops sending. We keep the counts for 13 months, like activity days, and they're included in your data export.

What we never receive

Source code, file contents, prompts, agent conversations, diffs, terminal output, environment variables or secrets. Agents talk to their model providers (for example Anthropic or OpenAI) directly from your machine, under your own accounts with those providers.

Why we store it

To sign you in, keep your devices and settings in sync, confirm your licence, and improve Tutti. We don't sell your data or use it for advertising.

Who processes it

• Our servers at OVH in Poland (EU) host the account service and its database.
• Cloudflare serves tutti.build and protects it from abuse.
• Mailjet sends sign-in emails.
• Google or GitHub, only if you choose to sign in with them.
• Your company's identity provider (for example Okta or Microsoft Entra ID), if your company set up single sign-on for Tutti. We keep your company's sign-in settings and receive your email address and name from it.

Your rights

You can export all your data or delete your account at any time from your account page. Deleting your account removes your data from our systems within 30 days. You can also write to us to access, correct or delete your data, or to object to its processing.

Questions: hello@tutti.build