Privacy policy.
Effective October 13, 2026
This is how Tofu handles information. Tofu processes what it hears, sees, writes and does on your own Mac. This website and your account hold almost nothing, and everything they do hold is listed below.
It runs on your Mac
What Tofu captures from your day, the to-do list it writes, your conversations with it, recordings, transcripts and notes, are kept on your device, encrypted, and are not sent to us. There is no cloud copy of your day. We cannot read your screen, your audio, your mail or your tasks, because they never reach us.
What it connects to, all started by you
- Your own accounts, such as Google or Microsoft, if you connect one, for mail and calendar. Tofu talks to them directly, the way an app does. You sign in on their own page; we never see your password, and nothing from those accounts is copied to us. Connecting an account is optional and can be removed in Settings.
- Apple, for syncing your notes between your own devices if you turn on iCloud sync, through your own iCloud account with a key that stays on your devices.
- A model provider, once per model, to download the files the on-device models are made of. It is a plain file download and carries nothing about you.
- When you ask Tofu to buy something, the merchant and our one-time-card provider, to place that order. We see the order, not your day.
How the AI runs
Tofu does its thinking on your Mac wherever it can: it transcribes what it hears, writes your list, and drafts replies on your own device. When a task needs a larger model than runs locally, the request goes through a private relay that strips out who you are before it reaches the model, and no provider trains on your data. Nothing you say, record or type is stored by us for processing.
What we collect, and how
This is about your account and this website. The app itself, as above, keeps your content on your device.
- Account information — your email address and the account it belongs to, collected when you join the waitlist or sign in, plus your membership status. We use it to let you in, keep you signed in, and know what your membership includes.
- A daily usage count, only if you leave it on — once a day, how many times each feature was used and how the on-device models performed. It never contains your messages, subjects, addresses, names, searches, file names, calendar titles, audio, transcripts or prompts, and no hardware identifier. You can switch it off in Settings, which also drops whatever has been counted.
- Ordinary server records — like any website, our servers log the requests they receive, including IP address, time and browser, to operate and secure the service. We do not turn them into location data.
That is the whole list. Our app has no advertising SDK and no third-party analytics SDK. We do not sell or rent information about you.
Sharing
We do not sell your information. Services you connect to Tofu yourself, such as your Google, Microsoft or iCloud account, receive what you direct to them and are governed by their own policies. The providers that help us run the service (hosting, our database, the service that sends our email, and the one-time-card provider) handle information only on our instructions, under terms that require them to protect it and use it for nothing else. Tofu's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
Your choices
You can switch off usage sharing in the app, remove any connected account, and delete the app and its data from your device. Deleting the app removes everything it held, since none of it was anywhere else. To delete your account, email lal00020@umn.edu and we will delete it. You may also ask for access to, or correction of, the information we hold about you, subject to applicable law.
Keeping it
We keep account information for as long as you have an account, and delete it with the account. Daily usage counts are kept per account and deleted with it. Server records are kept for a limited period for security and operations.
Security
Content kept on your device is encrypted with a key created on that device. Connections to providers and to our servers use TLS. We take reasonable measures to protect information, though no method of storage or transmission is completely secure.
Children
Tofu is not intended for children under 16, and we do not knowingly collect their data.
Changes and contact
We may update this policy from time to time. The current version is always posted here. Questions and requests can be sent to lal00020@umn.edu.