Tavix (“we”, “us”) gives each person their own private AI assistant, Tuti. This policy explains what we collect, why, and the choices you have.
What we collect
- Account data: your name, email address, password hash (never the password itself) and sign-in method.
- Device data: a name and platform for each signed-in device, its public device key, and when it was last seen.
- Your Tuti data: conversations, memory, files, schedules and settings stored inside your private instance.
- Connection tokens and saved credentials: stored encrypted in your vault (see below).
- Operational data: instance status, error logs and usage counts used to run, secure and bill the service.
How we use it
To provide the service you ask for: run your instance, carry out your requests, keep your devices in sync, prevent abuse, and fix problems. We do not sell your data and we do not use your conversations to train AI models.
AI model providers
To answer you, Tuti sends the relevant parts of your conversation to the AI model provider configured for your account (for example Anthropic via AWS Bedrock, or your own Claude Code / Codex account if you connect one). Those providers process the data under their own terms and do not train on it under our agreements.
Vault and secrets
Passwords, API keys and OAuth tokens you give Tuti go to an encrypted vault (AES-256-GCM with per-user data keys). They are decrypted only inside your own instance when needed, every use is audited, and they are never shown to the AI model. Payment cards are saved with our payment processor, Stripe; we keep only Stripe’s reference to the card and its brand, last four digits and expiry date.
Payments
Cards and wallets are saved and charged by our payment processor, Stripe. You type card details only into Stripe’s secure fields (or Apple Pay / Google Pay); they go straight to Stripe and never reach our servers, your instance, the AI model, our logs or analytics. We keep only what we need to show and use your saved methods: a Stripe reference, the brand, the last four digits, the expiry month and year, the wallet type and a card fingerprint used to spot duplicates.
Tuti can only pay after you approve that exact payment (merchant, items, amount, currency and card) on your device with a passkey, Face ID or fingerprint, within the per-payment and monthly limits you set. For each payment we keep the request, your approval (which device or passkey approved it, never your biometrics), its status, amounts, refunds, the receipt link and an audit trail. Stripe also processes this data under its own privacy policy, including for fraud prevention. Payment and audit records are kept for as long as financial record-keeping laws require (in Canada, generally six years), even if you delete your account; everything else follows the retention rules below.
While payments run in Stripe’s test mode, no real money moves.
Plans and billing
When you start a paid plan, Stripe charges the card you choose for each billing period; card details stay with Stripe as described above. We keep your plan, your subscription’s status and dates (trial, renewal, cancellation), Stripe references for your customer, subscription and invoices, and invoice amounts, so we can show your plan and invoices and apply what your plan includes. Invoices and their records are kept for as long as financial record-keeping laws require.
To offer one free trial per person, we record that your account used a trial and Stripe’s fingerprint of the card used (a reference that identifies a card without revealing its number). We keep this record even if you delete your account, only to prevent repeat free trials.
Usage. To run, price and protect the service, we record how much your Tuti uses the AI models: for each request, the number of tokens in and out (including cached tokens), which model served it, its cost to us and when it happened, never the content of your conversation. You can see your own activity (tokens and requests) in Plan & billing.
Retention and deletion
Your data is kept while your account is active. Instance backups are kept for up to 30 days. You can delete saved credentials and connections at any time in the app; to delete your account, contact us from your account email and we will erase your instance, vault and backups within 30 days.
Security
Instances are isolated from each other, accept no inbound connections, and are reached only through our authenticated edge. Devices are revocable at any time.
Your rights
Depending on where you live (for example under GDPR or PIPEDA) you may have the right to access, correct, export or delete your data, and to object to some processing. Contact us to exercise them.
Children
Tavix is not intended for anyone under 16.
Changes
We will post updates here and tell you in the app before material changes take effect.
Contact
Questions: contact the Tavix team through the email you receive our messages from.