Privacy Policy
This policy explains what AskTufti collects when you use asktufti.com, why, who helps us run the service, and the choices you have. We wrote it in plain language. If anything is unclear, write to privacy@asktufti.com.
1. Who we are
AskTufti is run by Transurfing Navigator ("we", "us"), operating in the United States. AskTufti is one of the Transurfing Navigator products. This policy covers AskTufti at asktufti.com; the Transurfing Navigator website has its own privacy policy. We decide how your information is used. You can reach us at privacy@asktufti.com.
2. The short version
- Tufti is an AI. Your messages are processed by AI models to write her replies.
- We keep your conversations so she can remember you. You can ask us to export or delete them at any time.
- We do not sell your information. We do not use it for advertising.
- We do not use your conversations to train AI models.
- Analytics run only if you accept them.
3. What we collect
Account information. Your email address, your name if you give it, and your password (stored only as a secure hash by our authentication provider). If you sign in with Google, we receive your name, email address and profile picture from Google.
Your first reading. The answers you give during onboarding: what to call you, your experience with Reality Transurfing, your current practice, your intention, focus area, life context, preferred language and vision.
Your conversations. Everything you write to Tufti and everything she writes back.
What Tufti remembers about you. To remember you across sessions, we create and store a written profile summary, a summary of your journey (themes, struggles, breakthroughs), notes, and numerical representations of your past messages ("embeddings") that let her recall related moments.
Usage and technical information. Message counts, usage for fair-use limits (per 5-hour session and per week), the AI model used, response times, cost of each reply, and the first 200 characters of each message in an internal log we use to find errors and improve quality. Our hosting providers also receive standard technical data such as IP address, browser type and device.
Error reports. When something breaks, our error tool records technical details of the error together with your account ID so we can fix it. Error reports never include the text of your messages.
Analytics, only with your consent. If you accept analytics, we record product events (for example, that a message was sent or a reply arrived, and its length) linked to your account ID, and Google Analytics records visit statistics such as pages viewed, approximate location from your IP address, device and browser. Until you accept, neither analytics tool is started and nothing is stored on your device for analytics; if you decline, they stay off.
Voice. If you use the microphone button, your browser records the audio and sends it to our server, which passes it to Microsoft Azure to turn it into text. We keep only the resulting text, not the audio. If you use read-aloud, the reply text is sent to Microsoft Azure to generate audio.
We do not knowingly collect information from children. See section 11.
4. Sensitive information
Conversations about inner life can include sensitive information, such as your beliefs, your health, your relationships or your sexual life. Under some laws this is "sensitive" or "special category" data. You decide what to share. We use it only to provide the conversation and Tufti's memory of you, never for advertising and never to make decisions about you that have legal or similar effects. Where the law requires it, we rely on your explicit consent to process it. You can withdraw that consent at any time by asking us to delete your account and data.
Consumer health data (Washington, Nevada, Connecticut and similar laws)
See our separate Consumer Health Data Privacy Policy.
If you mention your physical or mental health, that information may be "consumer health data" under some US state laws. We collect it only because you share it in conversation, use it only to provide the conversation and Tufti's memory of you, never sell it, and share it only with the service providers listed in section 7. You can ask us to access or delete it at any time, as described in section 10.
5. How we use your information
- To create and secure your account and let you sign in.
- To generate Tufti's replies, including looking up relevant passages from our book library.
- To let Tufti remember you across sessions.
- To enforce fair-use limits and keep costs under control.
- To find and fix errors, prevent abuse and keep the service safe.
- To understand how the product is used, if you accept analytics.
- To reply when you contact us, and to send essential service messages such as sign-in and password emails.
- To comply with the law.
6. Legal bases (EU, UK and similar laws)
| Purpose | Information used | Legal basis |
|---|---|---|
| Account and sign-in | Account information | Contract |
| Tufti's replies and memory | Conversations, first reading, memory | Contract; explicit consent for sensitive information |
| Fair-use limits | Usage records | Contract |
| Security, error fixing, abuse prevention | Technical data, error reports, internal message log | Legitimate interests (you can object) |
| Product analytics | Analytics events | Consent |
| Legal requests and record keeping | What the request requires | Legal obligation |
7. Who helps us run AskTufti
We share information only with service providers that process it on our behalf, under contract, to run the service:
- Supabase: database and sign-in. Your account, conversations and memory are stored in Zurich, Switzerland.
- Microsoft Azure: our server, the AI models that write Tufti's replies (including Anthropic's Claude models served through Azure), embeddings, search over our book library, and text-to-speech. United States.
- Anthropic: Claude AI models, when served directly by Anthropic. United States.
- Voyage AI and Cohere: search helpers that receive the text of your message to find relevant book passages. United States.
- Sentry: error monitoring. United States.
- PostHog: product analytics, only if you accept. United States.
- Google (Google Analytics 4): visit statistics, only if you accept. Advertising features and Google signals are switched off. United States.
- Netlify: hosting of the website. United States.
- Resend: delivery of our emails (sign-in emails, and an invitation if someone invites you). United States.
- Google: only if you choose Google sign-in.
We may also disclose information if the law requires it, to protect someone's safety, or as part of a merger or sale of the service, in which case this policy continues to apply.
We do not sell your personal information, and we do not share it for cross-context behavioral advertising.
8. International transfers
We operate from the United States, and our providers are located in Switzerland and the United States. If you live elsewhere, your information is transferred to these countries. Where the law requires it, we rely on safeguards such as the European Commission's Standard Contractual Clauses or the provider's certification under the EU-US Data Privacy Framework.
9. How long we keep it
- Account, onboarding answers, conversations and memory: for as long as your account exists. When you ask us to delete your account, we delete them within 30 days.
- Internal message log and usage records: for as long as your account exists, then deleted with it.
- Invitations: if someone invites you, the invitation keeps your address, and keeps their note until you accept or the invitation is withdrawn. Deleting your account deletes the invitation. Our admin security log records ids, not addresses.
- Error reports and analytics: kept by those providers under their standard retention periods, then deleted.
- Backups may hold deleted data for a short time until they expire.
10. Your rights
Depending on where you live, you can:
- access the information we hold about you and get a copy in a portable format;
- correct it;
- delete it, including your whole account;
- object to or restrict some processing;
- withdraw consent at any time, without affecting earlier processing;
- opt out of any sale or sharing of personal information (we do neither);
- limit the use of sensitive information (we use it only to provide the service);
- complain to your local data protection authority.
To use any of these rights, email privacy@asktufti.com from the address on your account. We reply within 30 days, or sooner where the law requires. We may need to verify your identity before acting. You may use an authorized agent; we may ask them for proof that they act for you. If we decline a request, we will tell you why, and you can appeal by replying to that email; we will answer the appeal within the time the law requires. We will not treat you differently for using your rights.
11. Age
AskTufti is for adults aged 18 and over, or the age of digital consent where you live if that is higher. We do not knowingly collect information from anyone under 18. If you believe a minor has an account, write to us and we will delete it.
12. Cookies and similar storage
We use your browser's storage to keep you signed in, to remember your settings, and to keep a local backup of recent messages on your device. These are necessary for the service. Analytics storage (PostHog and Google Analytics cookies) is used only after you accept it in the banner. You can change your choice any time with Cookie settings at the bottom of the home page. We do not use advertising cookies. Our site does not respond to "Do Not Track" signals; if your browser sends a Global Privacy Control signal, we treat it as a request to opt out of analytics.
13. Security
We use encryption in transit, access controls, server-side secrets and least-privilege database rules. No service is perfectly secure. If a breach affects your information, we will notify you and the authorities as the law requires.
14. AI and automated processing
Tufti's replies are generated by AI. They can be wrong. They are not medical, psychological, legal or financial advice. We do not use automated processing to make decisions that have legal or similarly significant effects on you.
15. Changes
If we change this policy, we will update the date above. If a change is significant, we will tell you in the app or by email before it takes effect.
16. Contact
Privacy questions and requests: privacy@asktufti.com
Everything else: support@asktufti.com