Privacy Policy

What this covers

This covers the Tofu website, the Tofu dashboard, the Tofu builder, the Tofu agent connection, the visits Tofu counts for an app you host and the traffic counter Tofu can also run for it, and Tofu's Stripe app, which connects your own Stripe account to your apps. It does not cover the app you deploy through Tofu: that app is yours, and whatever else it collects from its own users is your responsibility, not ours.

You can reach us about anything on this page at hello@trytofu.ai.

What we collect

• Your account: the email address you sign in with, whether you used email, Google or GitHub, and, for Google or GitHub, the name and profile image that provider shares with us. Tofu never sets or stores a password for you.
• Your phone number, if you sign in with it: the mobile number you verify, which identifies your account and receives the one-time sign-in codes you ask for. A phone account needs no email address, and we send no marketing texts.
• How you found Tofu: if you answer or skip the optional question when you create your account, your answer (or that you skipped it) and anything you type under Other, kept with your account and deleted with it.
• The dashboard pages you open: from October 31, 2026, while you are signed in, which pages of the Tofu dashboard you open and when (the page's address with nothing after a ? or #, never what the page shows), so we can see how people find their way around Tofu and help you when you write to us; nothing is recorded if your browser sends Do Not Track or a Global Privacy Control signal, and what is recorded is deleted with your account.
• Visitors to an app set so only certain people can open it: if someone who builds an app on Tofu adds your email so you can open their app, Tofu keeps that address to let you in and to send you the codes you ask for. It is deleted when they remove you, when they delete the app, or when you ask us at hello@trytofu.ai. A small cookie on open.ontofu.app remembers, for 30 days, that you confirmed your email for that app.
• AI requests made through Tofu AI: when an app calls Tofu's AI gateway with its key, we record the app and the account it belongs to, the model, the number of input, output and cached tokens, what the request cost and what it was charged, the time, and whether it succeeded. We do not keep the prompt or the answer: they pass through the gateway to the model provider while the request runs. A key is never stored; Tofu derives it again to check it. We also keep your AI balance, a receipt for each top-up (the Stripe session, the amount and the time) and the fact that your account took the one-time free credit.
• Your conversations in the Tofu builder: for each app or draft you work on in the Tofu builder, your messages, the builder's replies and a line for each step taken for you, such as putting the app online, kept in the Tofu builder's own database and shown only to your account. What you write before the builder first saves your app is kept with the session in the builder you wrote it in, not with the app. The builder usually moves it to the app at your next message after that save; when it does not — you leave right after the save, or no app is ever saved — it stays with that session. Answers from Tofu that can carry personal data about the people who use your app, or words its visitors wrote, are asked for only in a turn that has no workspace open — the temporary machine on which the builder writes your app's code. An answer like that stays in the conversation like any other reply.
• The code the Tofu builder saves: after each turn that changed it, the Tofu builder saves the code of the app or draft you are working on, with its history of earlier turns, in the builder's own private storage, so you can come back to it. The builder names each step it saves by its turn number, never by your messages; a step the coding agent committed itself keeps the agent's own description. The builder never saves the app's dependencies, its build output, its .env files (other than an example such as .env.example) or its credential files, and it leaves out any single file over 5 MB and tells you. An account can keep up to 250 MB of saved code and up to 50 saved drafts: past 250 MB the builder stops saving, and it does not save a new draft past the 50th; it tells you when either happens.
• Your projects: project names, the framework we detect, uploads, deployment history and status, and the settings you save.
• Your source code: the folder, ZIP or repository you hand over, kept in private storage so it can be built and deployed.
• Environment variables: names, scopes and whether a value is a secret, as metadata in our control database. Secret values go straight to the hosting provider as write-only values — neither the dashboard nor Tofu can read them back, and you see a masked preview instead.
• Build and request logs: the build output and recent request logs our hosting provider returns. Request logs cover roughly the last day; they are not a complete archive.
• A record of Tofu's own failures and plan refusals: when something fails on Tofu's side while it works for your account, or Tofu refuses a step because your plan doesn't include it, Tofu records which step it was, whether it came through the dashboard or a coding agent or AI app you connected, a status code and a fixed code for what happened, when, your account's id and the id of the app involved — never the error's own text, what you sent, or anything your app holds. A failure Tofu answered with a reference (T- and eight letters and digits) is recorded under it, so we can find it when you quote it.
• Problem reports you send us: when you report a problem with Tofu itself — from the dashboard, or from the Tofu builder or a coding agent or AI app you connected, once you approved its exact words — Tofu keeps the words of the report, the kind of problem you chose, how it reached us (the dashboard, the Tofu builder, or which coding agent or AI app, and the version of Tofu's installed client if it came through that), the step that failed with its status code and the reference Tofu gave, the code of the error the dashboard showed if you reported it from that error, the app it is about, your account's id and, unless you leave them out, that app's status as Tofu read it: its live version and how that version went, how many problems blocked its newest blocked update, and its uptime check. Before keeping the words, Tofu takes out email addresses, phone numbers written with a country code (such as +1 415 555 0100) and characters that show nothing on the page, and writes every line break the same way; it refuses words that look like a password or a key, encoded data, or a block of code marked off with three backticks or three tildes. Anything else in the words is kept as you wrote it. A person at Tofu reads every report. If you or Tofu's team answers a report, Tofu keeps the conversation with the report, shows it to you in the dashboard under Support, and deletes it with the report, 180 days after we received the report.
• Domains: the domains you connect and the DNS records needed to point them at your app.
• Domains you buy through Tofu: if you buy one on the Domains page, the order (the name, the number of years, the prices you were shown, and which agreements you accepted, and when); the registration (its dates, whether it renews, whether it is locked, and whether its owner has confirmed their email with the registrar); each payment's Stripe references, its amount and whether your bank confirmed it; the country your request came from, worked out from your IP address, which Tofu does not keep, and the owner's country; copies of the domain's DNS records; and a record of the emails Tofu sent you about it. The owner's name, postal address, email address and phone number go to the registrar and are not stored by Tofu: when you open a domain's owner details, Tofu reads them from the registrar to show them to you. If a payment for a domain is reversed, Tofu also records your account, a one-way fingerprint of your sign-in email and Stripe's fingerprint of the card, so none of them can buy another domain until the case is settled — the bank decides it for Tofu, or the amount is paid again.
• Coding agent connections: for each coding agent or AI app you connect to your account, the name it gave itself, when you approved it, when the connection ends and whether you disconnected it. The keys a connection uses are stored only as one-way fingerprints, never in a form that could be used again. For email confirmation, we also keep the request and account identifiers, one-way fingerprints used to check the email and confirmation, and the request's recorded outcome and closure time, so we can investigate failed connections and prevent abuse.
• Payments: your plan and subscription status from Stripe. Card details are entered on Stripe's own checkout page — or, for a domain, in Stripe's own payment fields on the Domains page — and never reach Tofu. If you start a free trial, Tofu records when it ends and whether you cancelled it, beside your plan — for a trial with a card, as Stripe reports them — and, for a trial without a card, when it started and which version of its terms you confirmed.
• Payments in your app: each time you start connecting your own Stripe account to an app, Tofu records when, for which app, and how it ended. Once the app is connected, Tofu keeps the account's Stripe id, whether it takes real or test payments, and the Stripe id of the person who installed Tofu's app there; the products, prices and payment links Tofu created in it for the app, with their ids, names, amounts, currencies and billing periods; the path in your app that receives its payment events, and, where Stripe sends them to the app directly, the Stripe id of the endpoint Tofu created for it; a record of each event Tofu passed on to the app: the event's id and type, when it arrived and when Tofu passed it on, and the status code your app answered or why it could not be delivered; and a record of each change to the connection: what was done, who or what did it, when, and the Stripe account and object it concerned. Tofu sends Stripe only the products, prices and payment links you confirm, yourself or through a coding agent you connected, each marked with ids that tie it to your app, and, where Stripe sends an app its payment events directly, the address in the app they go to. To show you that a payment went through, Tofu reads that checkout from Stripe and keeps from it only whether it was completed. It keeps no API key of your Stripe account, and never a card number: a buyer enters it on Stripe's own payment page, and Stripe does not send it to Tofu.
• Installations of Tofu's Stripe app: when a Stripe account installs Tofu's app, changes it or removes it, Stripe tells Tofu, and Tofu keeps the installation's id, the account's id, whether it is the live account, its test mode or a sandbox, how it was installed, the permissions it granted and its status — whether or not the account is connected to an app.
• Payment events on their way to your app: Stripe sends Tofu the payment events of every Stripe account that installed Tofu's app — a completed checkout, or a subscription's renewal and its invoice, for example — with the buyer details Stripe includes in them, such as the buyer's name, email address and billing address. Tofu passes each event on, for you, to the app it belongs to, holding it encrypted only until your app accepts it, and for at most 3 days. An event Tofu does not pass on — one from an account that connected no app through Tofu, for example — is dropped as it arrives, and Tofu keeps no copy of it. Tofu never writes an event's contents to a log, and reads in it only what it needs to deliver it: its id and type, and the account and app it belongs to.
• Getting-started emails: if none of your apps is online yet, Tofu may send you up to three short emails in your first week to help you put one online. It records which it sent or decided not to send, when and why, whether each reached the email provider, a one-way fingerprint of each email's stop link, and whether and why they stopped (you used the link, or one of your apps went online) and when.
• Early-access requests: if you joined the Free plan's waitlist before it opened to everyone, the name, email, organization and comment you sent us. While the Free plan is open to everyone, we collect no new requests.
• Calls you book with us: if you book a call on the booking page our emails link to, what you enter there, such as your name, your email address, the time you pick and any note you add.
• Page views of our own website, counted by Tofu: which page was opened, when, and the site the visit came from — nothing else. This counter sets no cookie and is not a third-party script: it reports to Tofu's own endpoint. We store no IP address, and we never store a full URL: the query string and fragment are dropped, and the referrer is reduced to its hostname. A visit is only counted if your browser has not sent Do Not Track or a Global Privacy Control signal.
• Page views of an app Tofu hosts, counted by its traffic counter — only if that app's owner turns Tofu's traffic counter on: the same fields as Tofu's own counter, filed against the project it belongs to. The counter's rules are identical: no cookie, no third-party analytics script, no IP address, no full URL, and Do Not Track or Global Privacy Control ends it. The traffic belongs to the app's owner, not to us: it is shown in their dashboard, and it is not used by Tofu for anything of its own.
• Visits to an app Tofu hosts, counted by Tofu's hosting: for every app Tofu hosts, Tofu counts how many visits the app gets from browsers, as one number per app per day. Nothing is added to an app Tofu hosts, and the count sets no cookie. For an app on Tofu's static hosting, Tofu reads the number from Cloudflare, which serves the app: a count per address, and nothing about a visitor. For an app on Tofu's Vercel hosting, Vercel sends Tofu the app's request logs — the page that was asked for, the browser's identifier, the page the visit came from and whether the request succeeded; Vercel hides visitors' IP addresses in these logs at Tofu's request. Tofu reads each entry once, in memory, to decide whether it is a visit from a browser, adds it to the app's number for the day, and keeps nothing else: no address, page, browser identifier or referrer is stored. Because the hosting makes this count, and not code in your browser, a Do Not Track or Global Privacy Control signal does not stop it. The number belongs to the app's owner: it is shown in their dashboard, to their coding agent and in their weekly email. Tofu's founders also read the numbers added up across apps, to see how many apps are in use.
• Google Analytics on our own website and dashboard: the live site and dashboard (trytofu.ai and app.trytofu.ai) also load Google Analytics, a third-party script run by Google, except on the pages where you sign in or confirm an action, and in the Tofu builder. Unlike Tofu's own counter, it sets its own cookies, it receives the address of each page you open and of the page you came from, and what it collects is sent to Google. Before either address is sent, Tofu removes the part after a # and every query parameter except the campaign tags that begin with utm_, so the codes and ids our addresses carry are not sent to Google. It also receives a few events that mark a step you completed: signing up, signing in, creating a project, a deployment finishing, approving a coding agent's connection, sending an early-access request, opening a paid plan's checkout, a paid plan's payment being confirmed, and starting a free trial of the Pro plan. On our website it receives three more, about what you chose on a page: pressing one of its buttons (which one, and where on the page), copying the setup prompt, and a chapter of the homepage's demo coming on screen. Those events carry no email address, no account id and none of your code. Tofu loads it whether or not your browser sends Do Not Track or a Global Privacy Control signal.
• Vercel Web Analytics on our own website and dashboard: the page-view counter built into our hosting provider also runs on our pages. Vercel's counter sets no cookie; it receives the address of each page you open, with the same parts removed, and the address of the other website that sent you here, if one did, and what it collects is kept by Vercel.
• Vercel Speed Insights on our own website and dashboard: our hosting provider's page-speed measurement also runs on our pages. Like Vercel's counter, Speed Insights sets no cookie; for each page you open it receives how long the page took to load, draw and respond to you, the type of connection your browser reports, the part of the page a measurement concerns, and the page's address with the same parts removed, and what it collects is kept by Vercel.

Signing in with Google gives us your email address, your name, your profile image and a Google account identifier, and nothing more: we do not ask for Gmail, Drive, Calendar or any other Google data, and we never see your Google password. Your email address and account identifier run your account — they tell us whose projects to show and where to write. Your name and profile image are stored with your sign-in record, and the dashboard does not use them. All of it is held by Supabase, which handles sign-in and holds our account records, for as long as your account exists. It is not used for advertising, it is not sold, and it is not shared with anyone beyond the processors named below and the coding agent or AI app you connect yourself, which receives your email address (described next). Signing in with GitHub gives us the same kind of profile data from GitHub.

A coding agent or AI app you connect to Tofu — by adding Tofu's address to it as a connector, or by approving an agent's sign-in — receives the answers of the Tofu tools it uses for you: for example your apps' names and addresses, their status, versions, build and request logs and traffic counts, the names of their settings (never a secret value), their domains, and the accounts of the people who sign in to your app. An app you connect by address is also told your Tofu account's id and the email address you sign in with, which it uses to label the connection. What that app does with what it receives is governed by its own terms and privacy policy, not by this page: you choose it, and Tofu sends it nothing you did not connect it to. A connection by address holds access for at most eight hours at a time and renews it on its own until the connection ends, 30 days after you approved it; a new agent's sign-in ends after 30 days. Existing connections keep their original expiry. Disconnect on the Coding agent page of your dashboard ends any connection at once.

Tofu's Stripe app works in your Stripe account only with the permissions you approve on Stripe's own page: reading the account's name and whether it can take payments, its events, its checkouts, its subscriptions and its invoices; creating and changing products, prices and payment links; and, where Stripe allows it and you approve it, creating and removing a webhook endpoint for an app. Tofu is an independent controller of what it keeps about your Stripe account, its installation of Tofu's app and its connection to your apps, as this page describes: Stripe does not process it for Tofu, and Tofu does not process it for Stripe. Tofu uses it only to connect your Stripe account to your apps, to keep that connection working and to keep it from being abused, and never sells it. The buyer details in your account's payment events are different: Tofu carries them to your app for you, as it carries your app's own traffic, and uses them for nothing of its own. Like everything else your app collects, they are yours to answer for to your buyers. Disconnecting an app from Stripe, or uninstalling Tofu's app in your Stripe account, deletes what Tofu kept for that connection apart from the record of its changes, as How long we keep it says.

Tofu's two page-view counters are first-party: the collector is our own endpoint, and they involve no advertising network, no cross-site tracker and no data sold or shared. The app traffic the second one counts is the app owner's to read and to switch off from their dashboard. There is no export for it yet — ask us and we will produce one by hand. The hosting's own count of an app's visits is first-party in the same way: Tofu reads it from the hosting it already runs for the app, stores one number per app per day, and sells and shares nothing of it. Tofu adds no third-party analytics service to the apps it hosts. Tofu's own website and dashboard are different: besides Tofu's counter they load Vercel Web Analytics, Vercel Speed Insights and, on the live site, Google Analytics, all described above.

Why we keep it

To build and host the apps you ask for, to register, renew and protect the domains you buy through Tofu, to show you their state, to connect your Stripe account to your apps and pass their payment events on to them, to run your account and bill it, to help you put your first app online, to answer you when you write to us, report a problem or book a call with us, to find and fix what fails on Tofu's side and to see where your plan stops what you set out to do, to see which pages of our own site people open and where those visits come from, to count the visits an app we host gets and to see how many apps are in use, to see how people find Tofu and their way around it, to let the Tofu builder pick up an app's conversation where you left it, and keep its code so you can come back to it, and to keep Tofu and other people's apps safe from abuse. That is the whole list.

Who else processes it

• Vercel — builds, hosting and running your app, the only place a secret environment value is kept, the request logs it sends Tofu for an app on Tofu's Vercel hosting (with visitors' IP addresses hidden at Tofu's request), and Vercel Web Analytics and Speed Insights on Tofu's own website and dashboard.
• Cloudflare — hosting for apps on Tofu's static hosting, in Tofu's own Cloudflare account: Cloudflare R2 stores the files such an app publishes, and Cloudflare Workers serve it at its ontofu.app address and process each visitor's request to it, including the visitor's IP address and request headers. Cloudflare also counts the visits such an app gets and gives Tofu that count per address, which is where the hosting's number for the app comes from. A private R2 bucket in the same account holds the copies Tofu keeps of managed databases: archives, and copies made by hand. Cloudflare Workers also run Tofu's AI gateway at ai.tofu.site: they pass each request to Tofu's API and to the model provider, and read the token counts in the answer so the request can be billed. The only thing logged there is a short operational record (a request id, a status, an error type), never the prompt, the answer or a key.
• A third-party AI model provider — runs the model that answers an app's requests made through Tofu AI. It receives each request's messages, tools and images and returns the answer. Tofu calls it under Tofu's own account, not yours.
• Supabase — sign-in with Google or GitHub, sign-in codes by email and by phone, the control database that holds your account and project records, private storage for source archives and access requests, and managed databases you ask for, with the daily backups Supabase keeps of each one. It also holds the Tofu builder's own database, with the conversations described above, and the private storage where the builder saves your apps' code.
• Twilio — our SMS provider. When you sign in with a phone number, Supabase passes Twilio the number and the one-time code, and Twilio texts the code to you. It receives nothing else about your account.
• Amazon Web Services — the machines the copy job runs on, in Tofu's own account there: the job that makes Tofu's copy of a managed database, and checks that the copy restores, runs on Tofu's own runners at AWS. The copy itself is stored in the private R2 bucket above and only passes through such a machine: each job gets a machine of its own, which is erased when the job ends.
• GitHub — where that job's report is kept: GitHub Actions starts the job and keeps its log and the report uploaded beside it — a description of the copy that can name its tables and stored files.
• Stripe — payments and subscription management, including the payments for domains you buy through Tofu. If your bank disputes a domain payment, Tofu sends Stripe the record of the purchase as evidence — the order and the agreements accepted, the registration's dates, whether the domain answered online, and the emails Tofu sent about it — with no contact details and no IP address. If you connect your own Stripe account to an app, Tofu creates in that account the products, prices and payment links you confirm — and, where Stripe allows it, an endpoint that sends the app its payment events directly — and Stripe sends Tofu that account's details and payment events, as described above; your Stripe account itself, and your buyers' payments, are governed by your own agreement with Stripe.
• name.com — the registrar of the domains you buy through Tofu. It receives the domain owner's name, postal address, email address and phone number to register the domain, emails the owner the confirmation ICANN requires, and runs the domain's DNS, under its own Domain Name Registration Agreement and privacy policy. Where the rules for a domain's ending require it, the registry for that ending and ICANN's data escrow provider receive the registration details too. Privacy protection is on by default, so public lookups of the domain show a privacy service instead of the owner's details.
• Resend — the emails Tofu sends you, such as the welcome when you first sign in and the notices about your plan, trial, domains, databases and site checks, and the weekly email about your apps' visits, checks and outages. It also sends the emails about a problem report: a notice to Tofu's team, which carries none of the report's words, a receipt to you when the Tofu builder, a coding agent or an AI app sent one in your name, one email to you when Tofu's team marks it fixed, an email to you when Tofu's team answers, and a notice to Tofu's team when you answer, neither carrying the answer's words.
• Amazon SES — Amazon Web Services' email service, which sends the emails Tofu sends for the apps you host: the account emails an app sends its own users, such as sign-up confirmations, sign-in links and codes, and password resets; the codes a person on an app's list asks for to open it; and the messages you send your app's users from the dashboard or through your coding agent. It receives the address each email goes to and the email itself.
• Google Workspace — Tofu's team mailbox: the email you send to hello@trytofu.ai, the notice about a problem report you send, and your replies to its receipt or to its “fixed” email.
• Cal.com — the booking page our emails link to. If you book a call with us, Cal.com receives what you enter there, such as your name, your email address and the time you pick, and keeps the booking for us.
• Google Calendar and Google Meet — a call you book with us goes into our Google calendar, with what you entered on the booking page, and takes place on Google Meet.
• Google — Google Analytics on the live Tofu website and dashboard, which sets its own cookies and receives the page addresses and events described above.
• Our model provider — when you work in the Tofu builder. Each turn sends what you write, the conversation so far, the code of the app it works on and the answers from Tofu it asks for — including the answers described under What we collect that can carry personal data or visitors' words — to the models the Tofu builder uses: a mix of different models, which can change over time.
• Your own registrar — for a domain you bought elsewhere, registration, renewal and DNS stay with the registrar you chose.

These providers run their own infrastructure under their own terms, and we use them instead of running servers ourselves. We will name a new processor here before we start sending it the data described above.

How long we keep it

• Your account and projects: for as long as your account exists.
• Visitors to an app set so only certain people can open it: the address stays while the app's owner keeps you on its list, and is deleted when they remove you, when the app is deleted, or when you ask us. The cookie on open.ontofu.app lasts 30 days.
• Notifications, an area of the dashboard marked Soon, store nothing today.
• Payments in your app: what Tofu keeps about a connected Stripe account stays for as long as the app is connected to it, except the record of each event Tofu passed on, which is deleted automatically after 30 days. An event waiting to be delivered is deleted once your app accepts it, or after 3 days if it never does. The record of each time you started connecting an app is deleted after 7 days. When you disconnect an app from Stripe, or uninstall Tofu's app in your Stripe account, Tofu deletes what it kept for that connection, except the record of its changes, which holds no buyer's details and is deleted 400 days after each change. What Stripe told Tofu about an installation is deleted 7 days after Stripe reports it removed.
• Page views of our own website: 90 days by default and never more than 365, then the rows are deleted automatically. Ask us and we will remove yours sooner.
• Page views of an app Tofu hosts, counted by its traffic counter: the same window — 90 days by default, never more than 365 — then the rows are deleted automatically. Deleting the app deletes its traffic with it. Ask us and we will remove a project's traffic sooner.
• Visits to an app Tofu hosts, counted by Tofu's hosting: 35 days, then the numbers are deleted automatically. Deleting the app does not delete its numbers at once: they go with that daily clean-up, within 35 days. Ask us and we will remove a project's numbers sooner.
• The dashboard pages you open: the same window — 90 days by default, never more than 365 — then the rows are deleted automatically, and they go with your account if it is deleted first. Ask us and we will remove them sooner.
• Google Analytics, Vercel Web Analytics and Vercel Speed Insights: held by Google and by Vercel for the period each service keeps it, not in Tofu's own database.
• A managed database on a Starter or Pro plan you have paid for: if a later payment fails or you cancel, Tofu keeps the database and covers its cost during manual follow-up, also after the account goes back to the Free plan. It is not automatically paused, transferred or deleted, and paying again restores normal operation. We coordinate any export or transfer with you by hand.
• Daily backups of a managed database: while a managed database runs, Supabase backs it up once a day and keeps the last seven days of backups. A backup holds the database's data, including the accounts of the people who sign in to your app, but not the files the app stores.
• A managed database made during a free trial: if the trial ends without a paid plan started, Tofu archives it — a copy of its data, including the accounts of the people who sign in to your app, and its stored files in Tofu's own storage — and deletes the database. Tofu keeps the archive for 90 days, then deletes it; until then you can download it, or restore it once you start a paid plan. Once you start a paid plan, the archive is kept for as long as the account stays on it, and after a restore it stays in Tofu's storage until you ask us to erase it, or until a later archive of the same app is deleted, which deletes this copy too.
• A managed database on the Free plan: Tofu keeps it while its app is in your account. Tofu does not archive it for being unused.
• A copy of a managed database made by hand: a person at Tofu can also export a managed database — for example when you ask for a copy of it before you delete it. That copy holds what an archive holds, and it stays in the same private storage until you ask us to erase it, or until a later archive of the same app is deleted, which deletes it too.
• The record of Tofu's own failures and plan refusals: 90 days, then deleted automatically. Deleting the app it names does not delete it before then. Ask us and we will remove yours sooner.
• Problem reports: 180 days from when we receive one, then deleted automatically. Deleting the app a report names does not delete the report before then. Reply to its receipt, or write to hello@trytofu.ai with its reference (R- and eight letters and digits), and we will delete it sooner. The email that tells Tofu's team about a report carries the facts Tofu attached and none of its words, and it stays in the team mailbox.
• After you delete a project: its records and the cloud project are removed and the app goes offline, but the source archive you uploaded stays in Tofu's private storage until you ask us to erase it. A copy of its managed database made by hand, or an archive its database was restored from, can stay there too, until you ask us to erase it. The record of a failure or refusal that named the app stays for the rest of its 90 days, and a problem report about it for the rest of its 180 days.
• Access requests: kept in private storage until your request has been handled. Ask us and we will remove yours.
• Calls you book with us: the booking, with what you entered, stays with Cal.com and in our Google calendar until you ask us to erase it.
• Getting-started emails: the record of which were sent, and of when and why they stopped, stays with your account.
• How you found Tofu: your answer, or your skip, stays for as long as your account exists, and is deleted with it.
• Your conversations in the Tofu builder: an app's conversation stays for as long as the app or draft stays in the builder, and is deleted with it: deleting an app or a draft in the builder deletes its conversation, while an app you put online stays online. Deleting the app's project in the dashboard does not delete it: the builder keeps the app, as a draft, until it is deleted there. A draft nobody works on is deleted on a schedule, with its conversation (see Drafts in the Tofu builder below). What is still kept with a session in the builder rather than with an app (see What we collect) is not deleted with an app or a draft, and no schedule deletes it: it stays until you ask us to delete it, or to remove your account, at hello@trytofu.ai.
• The code the Tofu builder saves: the latest save of an app or a draft stays for as long as the app or draft stays in the builder, unless the account goes unused (see Drafts in the Tofu builder below); an older save that a newer one replaced is deleted within about a day. Deleting an app or a draft in the builder deletes its saved code too, while an app you put online stays online.
• Drafts in the Tofu builder: a draft is an app in the builder that is not tied to a project in your Tofu account: one never put online, an earlier copy that a later Put it online replaced, or one whose project was deleted in the Tofu dashboard. From October 19, 2026, a draft that nobody has opened, saved or worked on in the builder for 90 days is deleted, with its saved code and its conversation. If nobody has used your account in the Tofu builder for 180 days — no session started, and no app saved, opened or put online there — all of its drafts are deleted the same way, and its apps tied to a project in Tofu keep their conversations, and those online stay online, but the builder deletes the saves it made of them.
• Coding agent connections: the record of each connection stays with your account, so the Coding agent page can list past connections; it stops working when it ends or when you disconnect it. A separate email-confirmation request record becomes eligible for deletion 30 days after the request closes. Keeping that record does not keep a connection active or let it reconnect.
• A domain you bought through Tofu: its order, registration, payment and email records stay with your account — also after the domain moves away, expires or its app is deleted — as the record of what was bought and paid for. Tofu keeps the newest 30 copies of each such domain's DNS records, dropping the oldest when it saves a new one. The owner's contact details are kept by the registrar, not by Tofu.
• Logs: a recent window only — this is not a long-term archive.

There is no scheduled job that quietly erases everything: besides what this list says is removed on a schedule — page views, the dashboard pages you open, a managed database's daily backups, the record of Tofu's failures and plan refusals, problem reports, a free trial's database and its archive, the records Tofu keeps of payments in your app, the older saves the Tofu builder replaced, and, from October 19, 2026, drafts in the Tofu builder nobody has worked on for 90 days and the saved code of a builder account nobody has used for 180 days — and the oldest copies of a bought domain's DNS records, things are removed when you ask, when you delete a project or an app in the Tofu builder, or when you disconnect Stripe.

AI records — the app and account a request belongs to, the model, the token counts, what it cost and was charged, and whether it succeeded — your AI balance and your top-up receipts stay while your account exists and are deleted with it. We do not keep the prompt or the answer.

Security

Sign-in is handled by Supabase Auth with Google or GitHub, and Tofu stores no password of yours. Secret environment values live only with the hosting provider as write-only values. Tofu's Stripe app reaches a Stripe account only with the permissions approved on Stripe's own page; a payment event waiting for your app is stored encrypted, and each one Tofu passes on is signed with a secret for that app alone, which the app uses to check that it came from Tofu. Source archives, copies of managed databases, repair candidates and access requests live in private storage that is never served publicly. Every read of a project, deployment or log is scoped to the account that owns it.

We do not claim a certification and do not publish an audit report. Tofu is not SOC 2 or ISO 27001 certified, and we do not claim GDPR compliance for the service. What we can do is tell you exactly what is stored where — ask us and we will.

Your choices

Write to hello@trytofu.ai to ask what we hold about you, to have a source archive or a copy of a managed database erased, or to have your account and its data removed. There is no self-serve account deletion button yet, so these requests are handled by hand, and we will tell you what was removed and what could not be.

You can delete individual projects yourself from the dashboard, disconnect a domain, change a bought domain's owner details, turn its renewal off or move it to another registrar from the Domains page, disconnect a coding agent or AI app from the Coding agent page, disconnect Stripe from an app or uninstall Tofu's app in your Stripe account, and cancel the subscription from the billing portal. Each getting-started email has a link that stops the rest of them, with no sign-in, or you can reply to one and ask us to; emails about your plan, trial, domains, databases and site checks still come.

A browser extension that blocks analytics scripts stops Google Analytics, Vercel Web Analytics and Vercel Speed Insights on our pages, and nothing on them depends on any of them. Tofu's own counter, and the record of the dashboard pages you open, stop when your browser sends Do Not Track or Global Privacy Control. The hosting's count of an app's visits is the one exception: it is made by the hosting that serves the app, not by code in a browser, so those signals do not reach it. An app's owner can switch off the traffic counter Tofu runs in the app's pages; the hosting's count cannot be switched off while Tofu hosts the app.

Children

Tofu, its Stripe app included, is not meant for children: it is not for anyone under 13, or under the age at which the law where they live lets them use it without a parent's consent, if that is higher. We do not knowingly collect personal information from anyone that young. If you believe a child has given us personal information, write to hello@trytofu.ai and we will delete it.

Changes to this page

The date above changes when this page changes. We post the new version here, and from time to time we email account holders to say this policy has been updated, with a link to the current version; we do not list every change.