Privacy Policy
Last updated: October 20, 2026
1. Who we are
Tatu is made by João Alonso, an individual based in Brazil, who is the controller of the personal data described here (LGPD, Law 13.709/2018). For anything about your data, write to privacy@tatu.codes.
2. The short version
- The tatu program has no telemetry. It sends no usage statistics and no crash reports to anyone.
- Your sessions, settings and credentials stay on your computer, in
~/.tatu. - Your prompts and the files the model reads go only to the model providers and services you choose.
- The few services we run are listed in section 5, with what each one receives.
3. Tatu on your computer
Tatu stores sessions, credentials, settings, the sign-ins to remote MCP servers and logs in ~/.tatu(or the folder in TATU_HOME). Credentials are kept in a file readable only by you. The logs record what happened (runs, errors, retries), not your messages; they do contain the titles of automatically named sessions and the commands of hooks and background tasks, and, if you start tatu with -debug, the arguments of every tool call. None of this is uploaded to us. You delete it by deleting the files.
4. Services you choose
When you use tatu, you decide where your data goes. The model provider you pick receives everything the model sees: your messages, the content of files it reads, command output and images you attach. Tatu also makes a few extra model calls for a session name, an image description, a summary of an old conversation and answers about web pages. Web search and fetch may go through Firecrawl, Parallel, Exa or Jina Reader, and MCP servers and a LiteLLM proxy you configure receive what you send them.
These parties act under their own terms and privacy policies, and we are not responsible for how they handle your data. The page Privacy: what leaves your machine in the documentation lists each destination and the setting that turns it off.
5. Services we run
| Service | What it receives | What it keeps |
|---|---|---|
Model catalogapi.tatu.codes | A request for each provider's list of models, at most every 4 hours. No credentials and no session data. | A cached copy for 24 hours. No logs of our own. It does not pass your address to its public data source. |
Updates and installget.tatu.codes | A request for the file that names the newest version, once a day at most in an interactive session, and the downloads when you install or update. | Static files only. Our hosting provider (Cloudflare) sees the request, including your IP address, as any web host does. |
Relayrelay.tatu.codes | Only after you run /remote setup: your computer's name and hostname, the public keys of the computer and of the devices you paired, the id of each session, and the encrypted messages and session summaries (title, name, folder, model, status, git branch and similar fields) routed between your session and your devices, which it cannot read. | Pairings, one-time pairing tokens and the push notification tokens of your devices, until you unpair or revoke them. Tatu's relay only routes messages; what a session says travels encrypted end to end between your computer and your devices, and the relay cannot read it. It does not write message content to its log. |
| This website | Page views, counted with PostHog (United States) in cookieless mode: no cookies, nothing stored in your browser, no profile of you, no recording of what you do on the page. | Aggregate visit statistics. The Ko-fi donation widget loads only after you click it. |
6. The phone app
The app for iOS and Android works like this:
- The camera reads the pairing QR code and takes pictures you choose to attach to a message.
- The photo library is used only for pictures you choose to attach.
- The microphone and speech recognition turn your voice into text for a message. The transcription is done by your phone's speech service (Apple or Google), which may process the audio on its servers under its own policy.
- Notifications are sent through Firebase Cloud Messaging (Google) and, on iOS, Apple's push service. The text is fixed (
Needs your answer,Done,Stopped with an error), withTatu onand your computer's name as the heading. The session title is not in it. - The device's keys and the list of paired computers are kept in the phone's secure storage.
- The app has no analytics and no crash reporting.
7. Other companies that handle data
We use Cloudflare (hosting for the website, the catalog and updates), PostHog (website statistics, United States), Google Firebase and Apple (push notifications) and a virtual server provider (the relay). Some of them are outside Brazil, so data may be transferred abroad. We rely on providers that offer protection consistent with LGPD (art. 33) and, for visitors from the European Economic Area, on standard contractual clauses or equivalent safeguards.
8. Why we handle data
We handle data to provide the services you ask for (the relay and push notifications), and in our legitimate interest to keep those services secure and to understand, in aggregate, how the website is used. Where the law requires consent, we ask for it.
9. Your rights
Under LGPD (art. 18) and, if it applies to you, the GDPR, you may ask to confirm that we handle your data, to access it, correct it, delete it, port it, object to its handling and withdraw consent. Write to privacy@tatu.codes. We answer within 15 days. Most of your data is on your own computer, where you control it. For the relay, unpairing a device removes its pairing and push token. You may also complain to the Brazilian data protection authority (ANPD) or to your local authority.
10. Children
Tatu is not directed at people under 18, and we do not knowingly collect their data.
11. Changes
We may update this policy when tatu or its services change. The date at the top shows the latest version, and we will point out material changes on this page.