Privacy: what leaves your machine

Tatu has no telemetry: it sends no usage statistics and no crash reports to anyone. Everything that leaves your machine goes to a service you chose, or to one of the few services listed below. The table follows the destinations.

Destination	What goes there	When	Switch
Only your machine	Sessions, credentials, settings, logs, the output of background tasks and the pages `web_fetch` saves.	Always.	–
The provider you chose	Everything the model sees: your messages, the content of files it reads, the output of commands, images you attach, `AGENTS.md` and `CLAUDE.md`, and a git snapshot (branch, `git status --short` cut at 40 lines, and the last five commit titles).	Every model call.	Choose the provider with `/model` or `/login`.
Your LiteLLM proxy	A request for the list of models it serves, and for the budget of your key, with that key. Nothing else beyond the model calls above.	When you use `litellm`: at start, after `/login litellm`, on `/model refresh` and on `/usage`.	Do not use `litellm`.
Secondary model calls	The text for a small job a model does for you: a session name, a description of an image, a summary of the old conversation, an answer about a web page.	When the job runs.	`autoName`, `vision`, `web`.
Web services	The queries of `web_search` and the addresses of `web_fetch`.	When the model uses those tools.	`web.search`, `web.fetch`.
Your MCP servers	What the model puts in a call to one of their tools, and for a remote server your sign-in. A local server is a program of yours that may reach the network by itself.	When the model calls a tool of the server, and when a remote server starts.	Do not list the server in `mcp.json`, or `/mcp disable` it.
GitHub	Requests for the branch’s pull request, checks, reviews and requested details, using the computer’s GitHub CLI credentials; a title, description and branch references when creating a pull request.	When you open or refresh GitHub details, prepare publication or confirm pull-request creation in the app.	Do not use those GitHub actions.
Your Git remote	Commits and file contents reachable from the branch you push, using the computer’s Git credentials.	When you confirm a publication that includes push.	Choose Commit only, or do not publish.
The model catalog (`api.tatu.codes`)	A request for each provider’s list of models. No credentials, no session data.	At start, every 4 hours at most.	`modelCatalog.enabled`, `-no-model-refresh`.
The version check (`get.tatu.codes`)	A request for the file that names the newest version. Nothing about you.	In an interactive session, once a day at most.	`updateCheck`, `TATU_NO_UPDATE_CHECK`.
The relay (`relay.tatu.codes`)	Your machine’s identity, and encrypted messages, session summaries and preview traffic that it cannot read.	Only after `/remote setup`; preview traffic only while you open a published preview.	Do not run `/remote setup`; revoke previews to end their access.

Only your machine

These stay on your computer and Tatu never uploads them:

Sessions in ~/.tatu/sessions/, credentials in ~/.tatu/auth.json and settings in ~/.tatu/settings.json (under TATU_HOME if you set it). The sign-ins to remote MCP servers are in ~/.tatu/mcp-auth.json.
Logs in ~/.tatu/logs/. They record what happened (runs, errors, retries), not your messages. They do name the sessions Tatu titles for you and the commands of hooks and background tasks. With -debug they also hold the arguments of every tool call.
Background task output. Each task writes to a file in your temporary folder (mode 0600). Tatu removes the files when you quit.
Pages saved by web_fetch. A long page is saved to a file in your temporary folder, and the model reads parts of it from there.

The provider you chose

The model is a service, so it sees what you give it: the conversation, and whatever the model reads or runs while it works. If it reads a file, the file goes to your provider. The same holds for command output and images. /usage also asks each provider you are signed in to for your limits or balance, with your credential, and signing in talks to the provider’s login service.

Which provider you use is your choice. A project can pick one for itself in .tatu/settings.json, so check that file in a clone. See Security and trust.

Secondary model calls

Tatu makes a few extra model calls besides your conversation. They cost tokens and they send text:

The automatic session name. After your first message in a saved interactive session, a model names it. It receives that first message, cut at 2000 characters. It uses the model you are using, or the model you set in autoName (provider/model), which can be another provider. /name --auto sends the conversation as text instead (long ones are cut in the middle), without tool calls or results. autoName: "off" turns it off.
The vision model. If you set vision and your model takes no images, each image goes to the vision model’s provider to be described in text.
Compaction summaries. /compact, and the automatic compaction when the context fills, send the older conversation to the model in use, which writes a summary.
A question about a page. When web_fetch is given a prompt, the page and the prompt go to the small model of the provider you are using (or the model in use, if the provider has none).
The llm web backend. The last resort for web_search and web_fetch: the query, or the address, goes to the small model of the provider you are using, which has web access of its own. Other providers you are signed in to are asked only if web.otherProviders is on. It is off by default.

Side questions

/btw <question> makes an additional call to the session’s current provider and model. It sends the effective completed main context, already accumulated instructions, retained side exchanges and the new question. Existing images use already available text descriptions, not new image uploads or vision calls. It runs no tools or new hooks. Empty /btw only opens the panel and sends nothing to the provider.

Questions, answers, reasoning and errors stay in the running session’s temporary side history, shared with its attached clients; they are not written to the session file. Closing the panel or reconnecting does not erase that host memory. Host shutdown or conversation replacement does. Only call identity, model and usage metrics are saved, not side text. Those metrics survive resume and cover all branches; a fork copies only metrics on its copied history path. Before the first main message, a new session has no file and side metrics remain pending: quitting loses them, not the provider charge. See Context and cost.

From another terminal or the Tatu app, side questions and answers use the same end-to-end encrypted channel as main chat. The relay cannot read their payload; the metadata listed below is still visible to it.

Web services

web_search tries Firecrawl, Parallel and Exa, then the llm backend. web_fetch reads the page from your computer first (the site sees your request, as with a browser), then tries Jina Reader, Firecrawl, Parallel and Exa, then the llm backend. The query or the page address goes to the service that answers. A key for a service is optional and only raises its limits.

An address on your own machine or network is never sent to a service or a model. That covers localhost, private and loopback IP ranges, names that end in .local, .internal or .lan, and names with no dot. Only the local reader, on your computer, can open it.

See The web.

MCP servers

The tools of an MCP server are called with whatever the model chooses to send, and the answer goes to the model and so to your provider. A remote server receives those calls over the network, with the headers you set or the token of your sign-in. A local server is a program that runs on your computer: what it does with the network is up to the program. Tatu sends a server nothing beyond the calls, its own name and version, and the path of the folder you work in when the server asks which project it is serving.

Git and GitHub

The app’s GitHub views use gh on the computer running the session, with that computer’s GitHub CLI sign-in. They contact GitHub to read pull requests, checks, reviews and the details you open. Preparing publication also checks whether a pull request already exists. This is separate from GitHub Copilot model access.

Inspecting those views does not itself send their contents to your model provider. Fix this check and the review-thread actions put CI or reviewer text in your draft without sending it. If you send the draft, that text becomes part of the conversation sent to the provider. Review logs and comments before sending them.

A confirmed push sends the branch’s commits and their file contents to your configured Git remote. Creating a pull request sends its title, description and branch references to GitHub. Commit only does neither, though the repository’s Git hooks can run programs of their own. See Git and GitHub in the app and Security and trust.

Web previews

A published preview forwards traffic between a local server on your computer and a paired device, encrypted end to end through the relay. The relay cannot read the pages, requests or responses; it still sees the connection metadata described below. There is no public preview URL.

A page can make its own requests to external services, just as in a browser. Publishing it does not remove its analytics or change where its code sends data. Opening a preview does not itself send the page to your model provider; asking the model to inspect it with browser tools is a separate action. Closing the page ends its connections, not the publication or server. See Open a web preview for revocation and lifetime.

The model catalog

At start, in the background, Tatu asks api.tatu.codes for the list of models of each provider you have a credential for (and, right after /login, of the one you signed in to): context windows, prices, and whether they take images. It sends no credentials and no data from a session. For now, that service relays the catalog of a public source, without passing on your address. A provider is asked again after 4 hours at most. /model refresh asks right away. If the request fails, Tatu keeps the copy it stored before.

The one exception is litellm: the models of a proxy only its owner knows, so Tatu asks your own proxy (the address in LITELLM_BASE_URL or the one stored by /login), with your key, instead of api.tatu.codes. The answer is kept like the others. The same switches stop it.

The version check

An interactive session asks get.tatu.codes for the file named latest, which holds a version number, and shows a notice if yours is older. Tatu adds no version, identifier or session data to the request; as with any web request, the server sees your address. The answer is kept for a day, so Tatu asks once a day at most. Print mode (-p) does not check. tatu update and the install script download from the same site when you run them.

The relay

Tatu never contacts the relay until you run /remote setup. After that, each Tatu you start connects to it, until you set it otherwise (see below). The relay only routes messages. What your session says, your commands and your answers travel encrypted end to end between your computer and your paired devices, with keys the relay never has: whoever runs the relay cannot read them, change them, or send your computer a command.

What the relay handles:

Your computer: its name, its hostname, which devices are paired, and public keys of the machine and those devices.
A summary of each session, which it keeps for the lists, encrypted: the title, name, folder, model, branch, state and the rest are inside a block that only your computer and your paired devices can open. The relay sees only the session’s id, and when the session connects and leaves.
The conversation and preview traffic, without reading them. It forwards encrypted boxes between your session and your paired devices, and your commands back. It sees that a box was sent, when, to whom and how large it is, never what is in it.
Push notifications. They go through Firebase (Google), only for a device that registered for them. The relay sees the notification kind and the device’s registered push token. The text is fixed (Needs your answer, Done, Stopped with an error), with Tatu on and your computer’s name as the heading. The question, the options and the answer are not in it.

The Tatu app pairs with it. See Set up and pair.

Reducing what leaves your machine

Model catalog. Set "modelCatalog": {"enabled": false} in your settings, start with tatu -no-model-refresh, or export TATU_NO_MODEL_REFRESH=1. Tatu then uses the copy it stored before.
Version check. Set "updateCheck": false, or export TATU_NO_UPDATE_CHECK=1.
Web. Choose the services and their order with web.search and web.fetch, for example {"web": {"search": ["llm"], "fetch": ["local"]}}. This sends queries only to your provider and reads pages from your computer. Keep web.otherProviders off.
Session names. Set "autoName": "off", or name sessions yourself with /name.
Images. Do not set vision unless you want images sent to that provider.
Relay. Do not run /remote setup. If you did, /remote stop disconnects the session you are in, and TATU_REMOTE_AUTO_START=0 keeps new sessions from connecting.
MCP servers. List only servers you trust. /mcp disable <server> turns one off, and a project’s .mcp.json does nothing until you trust the project.
Projects. Read .tatu/settings.json in a clone before you run Tatu in it. A project’s settings can change the provider, the web services and the model catalog address.

Settings go in ~/.tatu/settings.json; see Settings and Environment variables.