Privacy policy

Contents

• 1. Introduction
• 2. What we collect and why
• 3. How we use your information
• 4. When we share your information
• 5. Your privacy rights
• 6. Data security
• 7. Data retention
• 8. Cookies and tracking
• 9. Children's privacy
• 10. International transfers
• 11. Changes to this policy
• 12. Contact us
• 13. Categories of personal information (CCPA/CPRA)
• 14. Automated decision-making
• 15. Privacy signals
• 16. Sub-processors
• 17. EU/UK representative
• 18. Supervisory authority
• 19. Controller and processor roles
• 20. AI processing and third-party models

1. Introduction

Welcome to TOVIO. We build version control systems for modern software teams and AI coding agents. Whether you are using our open-source client software (the tovio CLI, desktop app, extensions, or MCP server) on your local machine, or syncing your work to TOVIO Cloud (our hosted Forge and web dashboard), we believe you deserve clarity about how your data is handled.

Tovio, LLC ("we," "us," or "our") respects your privacy and is committed to protecting it. This Privacy Policy explains what information we collect, why we collect it, and how we keep it safe. It applies to our websites (tovio.dev and docs.tovio.dev), our hosted commercial services, and our client software when it communicates with our servers.

If you have any questions about this policy or how we handle your data, please contact us at privacy@tovio.dev.

2. What we collect and why

We only collect information that helps us deliver, secure, and improve our services. Here is what we collect, grouped by how we receive it, along with our legal basis for processing it under laws like the GDPR.

Information you give us directly

• Account and identity data: Your email address, account handle, and identity-provider account identifiers (from Google, Apple, or your enterprise SSO). Legal basis: Contract.
• Security credentials: Device public keys, device labels, and passkey (WebAuthn) public credentials used to secure your account. Legal basis: Legitimate interest (security).
• Repository content and history: When you sync to TOVIO Cloud, we store your repository content and history. Policy-protected paths are encrypted on your device, and we cannot decrypt or read them. Legal basis: Contract.
• AI session transcripts: By default, when you commit, the tovio CLI captures the transcript of the AI coding-agent session that produced the change (prompts, conversation turns, model name, token counts), reading it from the agent's local transcript files for that repository. It runs secret scanning over the transcript, stores it in the commit as provenance (encrypted for policy-protected paths), and syncs it to your configured remote, which may be TOVIO Cloud. You can turn this off with the provenance.observed_capture = off setting or the --no-session flag. Legal basis: Contract.
• Billing information: Billing identifiers and records of the agreements you accept. Payment card details, billing addresses, and tax IDs are collected and held by Stripe and never touch our servers. Legal basis: Contract / Legal obligation.
• Feedback and support: Information you submit through our feedback portal and help center. Legal basis: Legitimate interest.

Information collected automatically

• Network and device data: Your IP address, browser and device information, and approximate location. Legal basis: Legitimate interest.
• Usage data: Pages viewed, referrers, JavaScript errors, and server logs from our hosted services, used to understand how our platform is used and to fix bugs. Legal basis: Legitimate interest (and consent where required for website analytics).
• Session and token metadata: Metadata about your active sessions and access tokens, used to manage sign-in. Legal basis: Contract.

Information from third parties

• Identity providers: If you sign in with Google, Apple, or an enterprise single sign-on provider, we receive basic authentication identifiers. Legal basis: Contract.
• Payment processors: We receive subscription and payment status information from Stripe. Legal basis: Contract.

3. How we use your information

• Core service delivery: We use your account data, repository content, and AI session transcripts to provide our version control system, sync your work, and maintain commit provenance.
• Security and fraud prevention: We use your IP address, device public keys, passkeys, and session metadata to enforce rate limits, prevent unauthorized access, and maintain our tamper-evident security audit log.
• Service improvement: We analyze website and dashboard usage data, server logs, and analytics to fix bugs, improve performance, and design better features.
• Communication: We use your email address and notification preferences to send service, billing, and security notices.
• Legal compliance: We process billing identifiers and audit records to meet tax, financial, and other legal obligations.

4. When we share your information

We are a software company, not a data broker. We never sell your personal data. We share your information only in these limited circumstances:

• Service providers: We share data with vendors who provide infrastructure, payment processing, and analytics (listed in the Sub-processors section below). They may only use it to provide services to us.
• Legal requirements: We may disclose information if required by a valid subpoena, court order, or other legal process, or to protect the rights, property, or safety of TOVIO, our users, or the public.
• Business transitions: If Tovio, LLC is involved in a merger, acquisition, or sale of assets, your information may be transferred as part of that transaction. We will notify you before your personal data becomes subject to a different privacy policy.
• With your consent: We will share your information in any other way only if you ask or authorize us to.

5. Your privacy rights

Depending on where you live (including under the GDPR, UK GDPR, and CCPA/CPRA), you have rights over your personal data. We extend these rights to all users, regardless of location.

• Access: You can request a copy of the personal data we hold about you.
• Correction: You can ask us to correct inaccurate information by emailing privacy@tovio.dev.
• Deletion: You can ask us to erase your personal data. Closing your account ends access and revokes your sessions. To have your personal data deleted, email privacy@tovio.dev. We complete these requests within 30 days, subject to legal holds and records we must keep for billing, tax, security, or legal obligations.
• Portability: You can request your data in a structured, commonly used, machine-readable format. You can also retrieve your repositories at any time with the TOVIO client software.
• Withdraw consent: Where we rely on your consent, you can withdraw it at any time without affecting the lawfulness of earlier processing.

To exercise any of these rights, email privacy@tovio.dev. We will verify your identity before acting on your request.

6. Data security

We use technical and organizational measures to protect your code and personal data, including:

• Encryption: TLS encryption in transit with HTTP Strict Transport Security (HSTS), and client-side encryption for repository paths you designate as policy-protected, so that data is encrypted on your device before it reaches our servers and we cannot decrypt it.
• Authentication and access: Passkey (WebAuthn) confirmation for sensitive account and billing actions. Personal access tokens are stored only as hashes, and credentials on your devices are kept in your operating system's keychain.
• Monitoring and integrity: A signed, tamper-evident audit log; rate limiting and request size limits; signature verification of payment and directory webhooks; and secret scanning of captured AI session transcripts.

No internet service is completely secure, and we cannot guarantee absolute security. We will notify you of a data breach affecting your personal information as required by applicable law.

7. Data retention

We keep your data only as long as needed to provide our services and meet the purposes in this policy:

• Account data: Kept while your account is open.
• Unreachable repository history: Removed after 90 days (Free plan), 180 days (Personal plan), 365 days (Business plan), or 730 days (Enterprise plan).
• Unreferenced uploaded data: Removed after 1 hour.
• Security audit log entries: Retained and not automatically deleted (at least 5 years on Enterprise plans).
• Sessions and tokens: Sessions expire after 8 hours of inactivity and at most 30 days. Access tokens last at most 1 year.
• Cookie consent records: Kept for 180 days.

When you close your account, your access ends and your sessions are revoked. Personal data is deleted within 30 days of a valid deletion request, except data we must keep for tax, billing, security, or legal reasons.

8. Cookies and tracking

We use cookies and similar browser storage to make our websites work, remember your preferences, and understand how our platform is used. For full details, see our Cookie policy.

• Essential: A cookie that remembers your consent choice, and browser session storage and device keys that keep your dashboard sign-in secure. Our hosted service does not use cookies for sign-in.
• Analytics and monitoring: Cookieless Cloudflare Web Analytics and Google Analytics 4 on tovio.dev and docs.tovio.dev, and PostHog monitoring. On tovio.dev and docs.tovio.dev that means page views, page timings, and client-side error reports; on tovio.dev marketing and policy pages it also records a session replay, which never runs on the repository explorer. On the dashboard PostHog records the type of screen you are on, page-load timings, client-side error reports, and a named set of product events — which actions you complete, how sign-in and checkout go, and whether the Forge answers — plus how long the Forge takes to answer, as timings aggregated by type of request rather than a record of each one, with no automatic click capture. It also records a session replay of the dashboard: a reconstruction of how each screen was laid out and where you clicked, scrolled and typed. It is not a picture of your work. Before anything leaves your browser, every piece of text is replaced with asterisks unless it is one of our own interface labels, every link address, tooltip and form value is removed, and file contents, diffs, job logs, code editors and keys are cut out of the recording entirely. You can turn recording off for your browser in Settings, and what is already masked is never sent to us at all. Screens are recorded as templates, so a page address reaches us as a repository's proposals rather than as the repository's name, and query strings and fragments are removed before anything is sent. It runs without a separate consent prompt. When our hosted Forge fails while answering a dashboard request, the error report it sends to PostHog can carry the same random session identifier as your dashboard, so the failure and the session can be read together; that identifier is not tied to your name or account.
• Consent: We use Cloudflare's IP-based country lookup to apply the right consent rules for your location. Visitors in the EEA, UK, and Switzerland see a consent banner before analytics loads; elsewhere, analytics loads by default and you can opt out from our Cookie policy page.

9. Children's privacy

TOVIO is a professional tool for software developers and businesses. Our services are not directed at children under 16, and we do not knowingly collect personal information from them. If we learn that a child has provided us with personal data, we will delete it. If you believe a child has provided us with personal data, please contact privacy@tovio.dev.

10. International transfers

Tovio, LLC is based in the United States. Our hosted service runs on Cloudflare: repository data is stored with a location hint for eastern North America, and requests are handled at Cloudflare data centers on its global network. Our other service providers process data as described on our subprocessors page. If you use our services from outside the countries where your data is processed, your information will be transferred to those countries.

11. Changes to this policy

We may update this Privacy Policy to reflect changes in our technology, business practices, or legal requirements. If we make material changes, we will notify you by email or by a prominent notice in the TOVIO dashboard before the changes take effect.

The "Last updated" date at the top shows when this policy was last revised.

12. Contact us

If you have questions, concerns, or requests about this Privacy Policy or our data practices, contact us:

• Privacy: privacy@tovio.dev
• Security: security@tovio.dev
• Website: tovio.dev
• Mailing address: Tovio, LLC, 1300 South Boulevard STE 35425, Charlotte, NC 28203, United States

13. Categories of personal information (CCPA/CPRA)

California residents have the right to know the categories of personal information we have collected in the past 12 months and how long we keep them. We do not sell or share your personal information for cross-context behavioral advertising.

Note on sensitive personal information: We use passkeys and device public keys only for authentication and security, not to infer characteristics about you, so the CCPA right to limit the use of sensitive personal information does not apply.

14. Automated decision-making

We do not use your personal data for automated decision-making or profiling that produces legal or similarly significant effects (as defined in GDPR Article 22).

15. Privacy signals

Our public websites (tovio.dev and docs.tovio.dev) honor Global Privacy Control (GPC) signals. When your browser sends a GPC signal, we do not load Google Analytics or PostHog on those sites, unless you have explicitly accepted analytics there yourself. Our sites do not currently respond to Do Not Track signals.

16. Sub-processors

We rely on the following third-party service providers:

• Cloudflare: Hosting, content delivery, storage, security, access control, and cookieless web analytics.
• Google Analytics 4: Website analytics on tovio.dev and docs.tovio.dev.
• Google Workspace: Email for our privacy@ and security@ mailboxes.
• PostHog: Website and dashboard page-view, performance and error monitoring, and storage of server logs, error reports, performance metrics and request traces from our hosted services.
• Stripe: Payments, subscriptions, tax, and invoicing.
• Google and Apple: Sign-in identity providers.
• WorkOS: Enterprise directory sync, for enterprise customers who enable it. It processes directory records on the customer's behalf under our Data processing addendum.
• Featurebase (CORDNET OÜ, Estonia): The feedback portal, help center, and support form at feedback.tovio.dev, help.tovio.dev, and support.tovio.dev. Content you choose to submit there may be processed by Featurebase's own AI subprocessors to power the portal's AI features.
• Better Stack: Status page and incident monitoring, including contact details of people who subscribe to status updates.
• GitHub: Software release downloads.

We maintain the current list on our sub-processors page.

17. EU/UK representative

Tovio, LLC has not appointed an EU/UK representative at this time.

18. Supervisory authority

If you are in the UK or the European Economic Area and believe we have not adequately resolved a privacy concern, you have the right to lodge a complaint with your data protection supervisory authority.

• In the UK: The Information Commissioner's Office (ICO).
• In the EU: The data protection authority in your member state of residence.
• In the US: Your state's Attorney General.

19. Controller and processor roles

• Tovio, LLC as a processor (service provider): For repository content, code, and AI session transcripts that you or your organization upload to TOVIO Cloud, you (or your employer) are the controller, and we process that content only to provide the service. Our Data processing addendum, which forms part of the Terms of Service, governs that processing.
• Tovio, LLC as a controller (business): For account information, billing details, and usage analytics collected to run your account and improve our platform, Tovio, LLC is the controller.

20. AI processing and third-party models

Because TOVIO works with AI coding agents, we want to be clear about how AI models interact with your data.

AI session transcripts (provenance)

When the tovio CLI captures your AI coding-agent session transcripts (from Claude Code or Codex) and attaches them to your commits, TOVIO does not send this data to any AI provider. The CLI reads the transcript files already on your machine, runs secret scanning, and stores them as provenance in your repository, which syncs to your configured remote.

AI conflict resolution

If you choose to use our optional AI conflict resolution feature (tovio resolve --ai), your conflicting file contents are sent to a third-party AI provider.

• Bring your own key: TOVIO operates no AI model service. This feature works only if you configure it with your own API key from OpenAI or an OpenAI-compatible provider.
• Model training and retention: Because you use your own API key, data retention and model training are governed by your agreement with that AI provider. We recommend confirming that your provider tier excludes your data from model training.
• Accuracy: AI output can be inaccurate, incomplete, or insecure. You are responsible for reviewing and testing any code resolved by an AI provider before committing it.