Last changed 28 October 2026.
The controller of your data is [TO FILL: legal name and address of the controller].
Write to [email protected] about anything on this page, including the requests under “Your rights”. [TO FILL: confirm this address is a monitored mailbox]
The app does not work without an account, the free plan included. The account service stores only:
It stores nothing about your code, your plans, your prompts or your use of tulou.
We use this data to give you the account: to let you sign in, to show your plan, projects and seats, and to check that a paid feature is paid for. The legal basis is the contract you enter by using tulou (GDPR Article 6(1)(b)).
The app contacts the account service when you sign in and at least once every 30 days; after 30 days without a successful check it signs you out at its next start. So the service learns that you use tulou and when, but not what you do with it.
The service writes one log line per request: the route, the answer’s status, the time it took and, if it failed, the step that failed. No token, e-mail address or request content. Cloudflare keeps these logs for at most 7 days. Cloudflare sees your IP address to deliver each request; the service does not store it.
The sign-in page is Kinde’s. You confirm the sign-in at GitHub, and GitHub gives Kinde your GitHub identity, including your e-mail address. Kinde keeps your user record; tulou keeps no password.
On your computer the app keeps the sign-in’s refresh token in the Windows credential store and a copy of your account record, plan, projects and seats in its own database. Signing out removes both.
If you asked on tulou.dev to hear when the Windows build ships, we store your e-mail address and the time you asked, to send that one e-mail. The legal basis is your consent (GDPR Article 6(1)(a)); you can withdraw it at any time by writing to [email protected], and we delete the address.
If you asked on the brayd page to hear when brayd is ready to try, we keep your address on a separate list, with the time you asked, to send that one e-mail, on the same legal basis and with the same right to withdraw.
Claude Code, Codex, Grok and OpenCode run on your computer with your own sign-ins and providers. What they send goes between you and those providers, under their terms. tulou does not receive it.
These companies process personal data for tulou, under our instructions:
Cloudflare is based in the United States and Kinde in Australia. Where your data is processed outside the EU, [TO FILL: the safeguard for transfers outside the EU].
GitHub is not our processor: you sign in with your own GitHub account, and GitHub handles that, the downloads and the update checks under its own privacy statement.
Delete account in the app removes your account, your project memberships and your seat assignments from the account service, and your user from Kinde. It works without writing to anyone. Once paid plans exist, the seller keeps invoices for as long as the law requires.
You can ask for a copy of your data, have it corrected or deleted, restrict or object to its use, and receive it in a machine-readable form. Write to [email protected]. Where we rely on your consent, you can withdraw it at any time. You can also complain to a data protection authority, in particular in the EU country where you live or work.
When what we store or who processes it changes, this page changes first, and the date at the top says when.