1. Your work stays yours

Tatsulok is built for professional teams whose work is confidential by default. Each chat request you send is processed only by endpoints whose terms commit to dropping the content once the response returns, with no training and no provider human review; four narrower paths run elsewhere and are named below. Your workspace itself, threads, files, memory, stays with you across every surface. The sections below explain exactly what is sent, what is kept, and what is never sent.

2. What we collect, and why

Account information you provide: name, email, and OAuth identifiers from your sign-in provider. Workspace content you choose to keep: files, threads, memory, contacts you save, settings, and citations, needed to make the same Tatsu available on every surface. Approximate location: the city, region and country your IP address points to, which our hosting provider (Vercel) works out for us, and your device's timezone. We use them to give answers that fit where you are. We keep your current place, a list of your recent places, the place you are most often, and your timezone in a note in your memory, and your timezone in your settings. You can see and delete the note in Settings, Memory. Deleting it moves it to Trash and turns location off: Tatsu stops recording and using the place your IP address points to until you turn it back on there. Your device's timezone stays in your settings so times are right. While location is on, the note is updated when your location changes. We never collect your precise location. We also use your IP address for security, such as rate limits and bot checks; it is never added to your account or your memory. Operational data: request IDs, latency, error codes and error messages, which can include ids, file names and email addresses. Crash reports from our phone app, described under Sentry in section 4. Anonymous product analytics: only when you allow it. We do not sell your data.

Trying Tatsulok without an account. If you use Tatsulok before you sign in, we create a temporary guest session that lasts 7 days. Three cookies in your browser keep it working: one holds the session's key, one remembers your guest chat for up to 7 days after your last visit, and one lasts 15 minutes while you sign in. For the session we keep your messages, the one file you upload and the text we read from it, how you arrived (such as the campaign or website that sent you, the page you landed on, your language and your type of device), and counts and times of what you did, what it cost, and how you signed in. Your messages and the file's text are sent to models in the same way as a signed-in chat (sections 4 and 5).

We do not save your IP address with the session. To limit how many guest sessions one network can start in a day, we count them under a scrambled code made from it (a salted hash), never the address itself; the code is deleted within about an hour after that day ends (UTC). If you do not sign in from the guest chat within those 7 days, the session, its messages and its file are deleted within about an hour after that. We keep only the record of how you arrived and those counts and times, with no messages, no file or file text, and no link to the session. If you do sign in from the guest chat, your chats and file move into your account and the empty guest session is deleted. The record is then linked to your account, so we can count how visitors become members, and it is deleted when your account is deleted. Message text, file names and file content are never sent to our analytics.

3. Information about other people

Tatsulok keeps an address book of the people you work with, so Tatsu can help with your work. For each person it can hold a name, email address, phone number, organization, role, location, tags, how you know them, notes, and the date you were last in contact, plus a log of your emails and other contact with them and how they relate to your other contacts. Tatsu adds a person when you tell it about them or ask it to. When you have connected an email account, Tatsu also saves the name and address of the sender and of everyone on To and Cc of each email it reads for you, except your own addresses, including the aliases we know of, and no-reply and other automated addresses, and logs that email's subject and date against them, but not the message itself. This is on by default; you can turn it off in Settings, Preferences, under Auto-save contacts from email. Contacts are stored, indexed for search, and sent to models in the same way as the rest of your library. You can ask Tatsu to show or update a contact. On the web, you can see and delete contacts in Library: turn on system files and folders, then open .tatsu, then user, then contacts. A deleted contact goes to Trash and is deleted after at least 30 days, or at once if you delete it from Trash, together with its email log and its links to other contacts. Tatsu does not add a deleted contact again from email: we keep its email address on a list in your account until you restore the contact or add the person again yourself. When the list is full, at 5,000 addresses or fewer, the oldest drop off and those people may be added again. A contact deleted before October 8, 2026 may be added once more by a later email. All your contacts, and this list, are deleted with your account. To ask us to delete anything you cannot delete yourself, email support@tatsulok.com. We never sell your contacts or use them for advertising, and we never contact the people in them.

4. Processors and sharing

We share your data only with the processors that operate the service: OpenRouter for model routing under a zero-data-retention configuration, OpenRouter dispatches each request to an upstream inference provider (today: Microsoft Azure, Google Vertex AI, Amazon Bedrock, xAI's zero-retention endpoint, Groq, Cerebras, DeepInfra, Novita, Fireworks AI, Together AI, AtlasCloud, Inceptron, Relace, SiliconFlow, Inference.net, or Nebius, depending on the model) and our organization-level policy restricts dispatch to endpoints that do not retain content and do not train on it; these endpoints commit to dropping content after the request, and OpenRouter states it retains operational metadata such as token counts and latency for billing and abuse prevention but not prompts or completions; Cloudflare for file storage, embeddings, request handling, and bot protection (AES-256 at rest for R2; Cloudflare-managed encryption for Vectorize; Workers invocation metadata retained up to 7 days for operational logs); Vercel for hosting our website and its API routes, which turns your IP address into the approximate location described above; Convex for application state (AES-256 at rest); WorkOS for authentication (industry-standard encryption per WorkOS documentation); Resend for transactional email such as invitations, share notifications, and security notices; OpenAI for speech-to-text on voice input, a direct call that runs outside the OpenRouter routing described below and receives only the clip you record; Serper for web search, which receives your search query text and never your files or thread history, and, only as a last resort when our own fetchers cannot read a page Tatsu was asked to open, that page's web address so Serper can retrieve it; Modal, which runs our document text extraction service and receives a file's content for one extraction request, with derived artifacts such as a PDF rendering written to our own Cloudflare R2; Discord, where our team receives error alerts and demo requests (an alert that a server function failed carries the function's name, an error type and code, a request id, and one line of the error text with email addresses, links, file paths, quoted text, long ids and file names with a common file extension removed; a summary of new failures can include ids and the names of files that failed to upload; a demo request carries the name, email, company and message you submit); Sentry (Functional Software, Inc.) for crash reports from our phone app (a report carries the error type, where in the code it happened, the last steps before it such as requests made and controls tapped, the app version, and technical details of the phone such as model, operating system, memory, storage, battery, language and time zone, with no account attached; Sentry also receives the phone's IP address as part of the connection that sends the report; for errors in the app's own code, message text is removed unless it is a standard technical message; email addresses, file paths, file names with a common file extension and long numbers are removed; and web addresses are shortened; a crash in the native parts of the app or in the phone's system is sent as the phone reports it and also carries an identifier for the app on that phone, random per installation on Android and derived from the identifier Apple gives our app on iPhone); and PostHog for anonymous analytics, only when you allow it, with workspace content never sent and on-screen content masked in any session recording. We do not sell or rent your data, and we share it with law enforcement only when legally required.

5. How AI requests are routed

Every chat, embedding, and spoken-audio request runs through provider endpoints whose published data policies commit that they do not retain your prompts, attachments, or responses after processing; do not use your inputs to train, fine-tune, or improve any model; do not allow human review of your content by the provider; and do not publish your prompts or completions to public datasets. We enforce our side of this at the routing layer rather than relying on trust; the retention behavior itself runs on provider infrastructure, so what we control is that a request is never sent to an endpoint outside the program. We disable every non-compliant endpoint at the organization level, paid endpoints that may train, free endpoints that may train, free endpoints that may publish prompts, and any provider-side product-improvement program based on user inputs. The current provider path is OpenRouter with a zero-data-retention (ZDR) policy enforced on every request: our organization-level setting denies data collection and restricts serving to OpenRouter's ZDR-certified endpoints, and models are additionally pinned to vetted provider routes (today: Microsoft Azure, Google Vertex AI, Amazon Bedrock, xAI's zero-retention endpoint, Groq, Cerebras, DeepInfra, Novita, Fireworks AI, Together AI, AtlasCloud, Inceptron, Relace, SiliconFlow, Inference.net, or Nebius, depending on the model); we update this list when it changes. Text embeddings for search are generated the same way, under the same zero-data-retention restriction (currently served by Nebius or DeepInfra). Spoken audio is generated the same way, under the same zero-data-retention restriction (currently served by Google Vertex AI). Search reranking runs on Cloudflare Workers AI, so passage text stays with a processor already listed above. Open-weight models run on the same OpenRouter ZDR inference providers listed above, under the same commitments. This section describes requests routed through OpenRouter. Four content-bearing paths run outside that routing and are listed in the processors section: voice input is transcribed by a direct call to OpenAI, web search sends your query text to Serper (and, only when our own fetchers cannot read a page, that page's web address), document text extraction runs on Modal, and search reranking runs on Cloudflare Workers AI, a processor already listed above rather than an OpenRouter ZDR endpoint.

6. Google user data and Limited Use

When you connect a Google account, Tatsulok requests only the access needed for the features you turn on, per product. Gmail: read access (gmail.readonly) so Tatsu can reference and search your messages when you ask it to; draft and send access (gmail.compose) so Tatsu can draft email and Tatsulok can send a draft when you press Send or at a send time you set (through this access, Tatsu itself has no send action); and, only if you separately grant it, mailbox actions (gmail.modify) to archive, star, mark as read, or change labels on your instruction. Share notifications never use your mail account: they come from Tatsulok's own address, with you as the reply-to. Google Drive: read access (drive.readonly) so Tatsu can answer questions about, summarize, and cite your existing files, and per-file access (drive.file) so Tatsu can create or update only the files it creates with you. Google Calendar: access to the list of your calendars (calendar.calendarlist.readonly) so Tatsu knows which calendars you have, and event access (calendar.events) to read your events to answer scheduling questions and to create or update events you ask for. Google Forms: the per-file Drive access above (drive.file) to create, update, and publish forms you ask for and to read their responses; Tatsu works only on forms it created with you. We also read your basic Google profile (name and email) to identify the connected account. Tatsulok's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements. In plain terms: we use Google user data only to provide and improve the user-facing features described here; we never use it for advertising; we never sell it or transfer it to third parties except as needed to provide a feature you requested, to comply with applicable law, or as part of a merger or acquisition you are notified of. We affirm explicitly that we do not retain or use data obtained through Google Workspace APIs to develop, improve, or train non-personalized AI and/or ML models. Google user data is never used to train, fine-tune, or improve any AI or ML model (ours or any third party's); when Google-derived content is processed by a model to serve a request you make, that processing happens under the zero-data-retention terms described in section 5, for the duration of that one request, after which it is dropped. Two narrower paths, also described in section 5, apply to Google-derived content: search reranking runs on Cloudflare Workers AI, and text extraction from Drive files and email attachments brought into your library runs on our extraction service on Modal. No human reads your Google data except with your explicit consent, where required for security or to comply with the law, or on data that has been aggregated and anonymized and used only for internal operations in accordance with applicable law. You can disconnect Google at any time from Extensions on the web, which revokes our access and deletes the stored tokens and the account's sync settings.

What we keep, and for how long. Tatsulok keeps Google data to provide the features you use, plus the limited records described below. In your library: the Drive files, emails and attachments that you or Tatsu add, and copies of the email and Drive folders you keep in sync. What you or Tatsu add stays until you delete it in Tatsulok, even if you delete it in Gmail or Drive. A copy from an email label or Drive folder you keep in sync moves to Trash in Tatsulok, and is deleted for good after at least 30 days, when our check finds the whole email conversation deleted in Gmail or the file in the Drive trash. A copy that was edited, moved, added to favorites or marked regulated stays. A copy may stay until you delete it in Tatsulok if it was synced from Drive before October 9, 2026, if it was one of many deleted at once, if it was deleted for good in Drive before our check, if you only lost access to it, such as a Drive folder no longer shared with you, or if we could not check the account at the time, such as while it was disconnected. Earlier versions of a file, such as a Drive file before a sync, are deleted about 30 days after they were made, even if you delete the file. In conversations: what Tatsu read for you, such as emails, calendar events, Forms responses and Sheets content, the summaries that keep a long conversation going, and the automatic summary note of a longer conversation. They are deleted with the conversation, though the summary note of a conversation deleted before October 9, 2026 may stay until your account is deleted. Deleted conversations and library items go to Trash and are deleted, with their stored copies and search index, after at least 30 days, or at once with Delete Permanently. Email drafts Tatsu writes: deleted with the conversation that wrote them, together with their attachment copies, except a draft that is still scheduled or sending, which is kept so it goes out, and drafts from a conversation deleted before October 9, 2026, which may stay until your account is deleted. Deleting the conversation does not change a copy in your Gmail Drafts, which is yours. Within two days after a draft is sent or discarded, its text, the messages it quotes, your earlier version of it and the instruction it was written from are deleted; for a send we could not yet find in your Sent folder, they are kept until we find it, for up to about 30 days. A draft's recipients, sending address, subject, attachment names, status and ids stay until the conversation is deleted, or until your account is deleted for a draft kept to go out or written outside a conversation. A draft written outside a conversation that is never sent or discarded keeps its text until your account is deleted. Attachment copies are also deleted when a draft is sent or discarded or the attachment is removed, and a daily check deletes copies left behind by an interrupted save. Kept until you delete them or your account: facts and automatic notes Tatsu saves to your memory (a note records your question and the subject, sender, title or name of the emails, events and files used to answer it), and your contacts (section 3). Technical records: records of failed sends, broken citations and import attempts, and finished background tasks, which can hold ids, file names, error text, and task descriptions and results, are deleted about 90 days after they were last written. Kept until your account is deleted: for a disconnected Google account, its address and id, granted permissions, and your send-as names, addresses and aliases, which keep your own addresses from being saved as contacts (the tokens and sync settings are deleted when you disconnect); and other limited records of failed requests, such as ids and error codes. We delete your account no sooner than 30 days after you ask; see https://www.tatsulok.com/legal/data-deletion for details and exceptions. Logs and alerts: ids, file names, email addresses, subjects and error text can appear in our service logs (kept by our providers for a limited time). Error alerts to our team (kept until we delete them) carry the name of the failing function, an error type and code, a request id, and one line of the error text with email addresses, links, file paths, quoted text, long ids and file names with a common file extension removed; a summary of new failures can also carry ids and the names of files that failed to upload. Draft and send results are kept in a 24-hour cache that stops a retry from sending twice; it holds only the ids of the draft or sent email, never its content or a sign-in token. How often we check: every 30 minutes, Tatsulok checks your Gmail drafts, scheduled and sent mail, looks for changes in your Drive files and folders, and imports new email you keep in sync. While your Drive files or the email you keep in sync have no changes, those two checks slow to about 2.5 hours apart, and return to every 30 minutes once something changes. The use of information received from Google Workspace scopes will adhere to the Google Workspace API User Data and Developer Policy (https://developers.google.com/workspace/workspace-api-user-data-developer-policy), including the Limited Use requirements. The Google API Services User Data Policy named above is at https://developers.google.com/terms/api-services-user-data-policy.

7. Microsoft account data

When you connect a Microsoft account, personal or work or school, Tatsulok requests only the access needed for the features you turn on, per product. Outlook mail: Mail.ReadWrite so Tatsu can search and read your messages and attachments when you ask it to, and write, update, and discard the drafts it prepares with you; and Mail.Send so an email is sent when you send it, from the review screen or at a time you schedule. Tatsu cannot send email through this connection on its own: email goes out through it only when you send or schedule it. For meeting updates, see Outlook calendar below. We never delete email you received. OneDrive: Files.ReadWrite so Tatsu can find, read, summarize, and cite your files, create folders and new files you ask for without overwriting existing files, and move a file when you ask. Tatsu puts a file in the OneDrive recycle bin only after you confirm; on some work or school accounts, Microsoft settings can delete a file without using the recycle bin. When you open a library document in Office for the web, we put a working copy in your OneDrive, in a Tatsulok Office folder, inside a subfolder named after the library folder the document is in (if it is in a folder). While the copy is open, we check it about every 20 minutes and bring your edits back into your library after about an hour with no changes, when you open the document or Tatsu reads it, when you sync it, or when you finish. We then move the copy to the recycle bin when you finish, or 24 hours after you first opened it if you do not. If the library document changed elsewhere in the meantime, we do not bring your edits back automatically. If you finish, the copy stays in your OneDrive. If you do not, it moves to the recycle bin after 24 hours. In some cases, such as after you disconnect, a copy may stay in your OneDrive. Outlook calendar: Calendars.ReadWrite to answer scheduling questions, to create or change events when you ask, and to delete an event only after you confirm. Tatsu never adds attendees, but if you change or delete a meeting you organized, Microsoft may send an update or cancellation to its attendees. Microsoft Teams, for work or school accounts where it is offered: Chat.Read so Tatsu can list, read, and search your chats when you ask; it cannot post. To sign in to your Microsoft account and identify it, we also request openid, profile, email, and User.Read, which read your name and email, and offline_access so the connection keeps working. We do not copy your mailbox, calendar, or OneDrive in the background; a background check of your Drafts and Sent folders runs only to track the drafts Tatsu prepared. What Tatsu reads for you, the drafts it prepares, and the notes and summaries it saves are kept as section 6 describes for Google data. Attachments and OneDrive files that Tatsu needs to read, or that you ask to bring in, are saved to your library. Reading an email can save its sender and recipients to your contacts, as section 3 describes, and facts Tatsu learns may be saved to your memory. Your Microsoft tokens are stored encrypted with AES-256. We use Microsoft data only to provide the features described here; we never use it for advertising, never sell it, and never use it to train any model. A model processes it only to provide these features (answering your requests, indexing what you bring into your library, and keeping your memory), under the zero-data-retention terms described in section 5. Two narrower paths, also described in section 5, apply to Microsoft-derived content: search reranking runs on Cloudflare Workers AI, and text extraction from OneDrive files and email attachments brought into your library runs on our extraction service on Modal. You can disconnect a Microsoft account at any time from Extensions on the web. This deletes the stored tokens, so we can no longer reach the account, and cancels Tatsulok's unsent and scheduled drafts for it; drafts already in your Outlook Drafts folder stay there. Discarding a single draft in Tatsulok also removes it from your Outlook Drafts folder when we can reach the account. Microsoft does not let an app withdraw its own permission, so you can also remove Tatsulok from the apps that can access your account in your Microsoft account settings. Emails and files already saved in your library stay until you delete them or your account is deleted.

8. Security

TLS in transit on every connection. AES-256 at rest for files in Cloudflare R2 and application data in Convex; processors whose encryption algorithm is not publicly documented (Cloudflare Vectorize, WorkOS, OpenRouter, PostHog) use their own provider-managed encryption-at-rest. Authentication via WorkOS, with OAuth and SAML support for enterprise. Engineer access to production data is least-privilege, audit-logged, and limited to operational tasks, incident response, and investigation of feedback you have submitted, with only the context you chose to attach. Authorized staff may access account data for support and security; our support tools do not let them send or schedule your email drafts, disconnect your accounts, change your files or events through them, or chat with Tatsu as you. Data residency: today our application database (Convex) and authentication (WorkOS) are US-region only; customers in Japan, the EU, and other jurisdictions should know that data is processed outside their local region. Cloudflare and OpenRouter route through the closest edge point of presence. International transfers: where personal data leaves the EEA, the UK, or Switzerland, to our processors in the United States or to our operating company in the Philippines, those transfers are protected by appropriate safeguards, including the European Commission's Standard Contractual Clauses (with the UK International Data Transfer Addendum where applicable) and, for US processors certified under it, the EU-US Data Privacy Framework. Business customers can rely on our Data Processing Addendum at https://www.tatsulok.com/legal/dpa. No system is perfectly secure; we work to keep yours close.

9. Cookies and analytics

We use a small number of essential cookies for sign-in sessions and to remember your preferences (language, theme, sidebar state). When you arrive from an ad, we also set one first-party attribution cookie for up to 30 days so we can tell which campaign brought you; it holds a random token and no personal information. Anonymous product analytics run through PostHog (US Cloud today; we are migrating analytics to PostHog's EU Cloud in Frankfurt). Before you make a choice on the cookie banner, we record anonymous pageviews and a small number of product events with no analytics identifier stored on your device: identity is held in memory only and resets on every page load, so we cannot recognise you across visits. After you allow analytics, they persist on your device so we can measure returning visits. If you decline, we record nothing. No content from your workspace is ever included. PostHog session recording, when enabled, masks all input fields and on-screen text on the client before any data is sent (see https://posthog.com/docs/session-replay/privacy). You can change your analytics decision at any time from Settings, and you can manage all cookies through your browser's standard controls.

10. Your rights

You can export your full workspace from Settings → Data, delete specific items or your entire workspace at any time, change the model and provider for your requests, and revoke analytics consent. If you are in a jurisdiction with statutory privacy rights (EU GDPR, UK GDPR, CCPA, PIPEDA, APPI, and others), you can exercise them by contacting legal@tatsulok.com. We respond within applicable statutory windows. If you are in the EU or the UK, you also have the right to lodge a complaint with your supervisory authority (in the UK, the Information Commissioner's Office).

11. Children

Tatsulok is not directed at children under 13 and does not knowingly collect personal information from them. If you believe a child has provided us with personal information, contact us and we will delete it.

12. Changes to this policy

We update this policy as the platform evolves. Material changes are announced in-product before they take effect. The current version is always at https://www.tatsulok.com/legal/privacy and mirrored at docs/privacy.md in our repository.

13. Contact

For privacy questions, contact legal@tatsulok.com.

Privacy Policy