Tovu is free, open-source software, provided as is, with no warranty. Use it at your own risk. Our liability is limited as set out in sections 11 and 13 of the Terms of Service.
There are no ads, and we don’t sell your data. The Tovu app keeps your data on your own computer. This website collects a little: what you type into a form, with your IP address, and what you type into the chat, which goes to an AI provider. Section 3 has the detail.
Effective date: 2026-09-05 · Last updated: 2026-10-13
1. Two things are called Tovu
tovu.dev — this website. We run it, and we hold what it collects. Sections 2–13 describe it.
Tovu — software you download and run yourself. Your install collects data into your database, on your servers. It is never sent to us. Section 14 covers it. If that is why you are here, the short answer is: the software sends us nothing, but it does talk to a few third parties, such as GitHub for update checks and the AI provider you pick. Section 14 lists them.
2. Who we are
Tovu is a free, open-source project. The Tovu Team runs tovu.dev and is responsible, as data controller, for what it collects. You can reach us through the contact form.
Contact for anything in this Policy, including privacy requests: contact form. General, non-private questions can also go to github.com/AINSEP/Tovu/issues; issues are public, so leave personal details out.
This Policy is written with the UK GDPR, the EU GDPR, and the CCPA as amended by the CPRA in mind. Where a law gives you a right, you have it whether or not we list it here; where a law does not apply to us, describing it here is not a promise to follow it beyond what this Policy says.
We have not appointed a Data Protection Officer, and are not required to: a DPO is mandatory under GDPR Art. 37 only for public authorities, for large-scale systematic monitoring, or for large-scale special-category data. None applies here. We have no EU or UK Article 27 representative for the same reason — this site is a documentation site for free software, not an offering targeted at EU or UK residents, and its processing is occasional and low-risk. We would rather say that than name a representative we do not have.
3. What this site collects
Only forms and the site chat are in use today. Everything else below is a capability of the software that is switched off here; we describe it because we may switch it on, and we say so where we do.
3.1 Forms — active
When you submit a form we store the values you typed, the time, and your IP address in full, unhashed. That is the one place on this site a raw IP is written down; we use it to rate-limit and to identify abuse. IP addresses on form submissions are deleted after 90 days. The answers and timestamp remain until the submission is deleted. To request deletion of a submission, use the contact form.
A failed submission sets a tovu_form_flash cookie for 120 seconds so your answers survive the reload. It holds only what you just typed, is HttpOnly, and is same-origin. Forms also carry a hidden spam-trap field; if it comes back filled the submission is discarded.
3.2 Site chat — active, and it sends what you type to an AI provider
The chat widget on every page sends what you type to the AI model provider we have configured, to generate a reply. That provider handles it under its own terms and privacy policy. Today that provider is Google (Gemini API). The software can also use Anthropic, OpenAI, Azure OpenAI, OpenRouter, or any compatible endpoint; if we switch, we will update this section and the table in section 4.
Do not type anything into the chat you would not send to a third party. Its answers are generated by AI and can be wrong.
The key is ours, not yours — you supply nothing and see nothing. Requests are rate-limited using your IP address, which is read for that check and not stored. Your conversation is kept in your browser's sessionStorage: it is per-tab, it dies when you close the tab, and it never reaches us as a stored record.
3.3 Analytics — capability present, no events recorded
No page on this site loads an analytics script today, so nothing is recorded. If we enable analytics it is our own, first-party, and sets no cookie. It is not Google Analytics and not an advertising pixel.
It does not store your IP address or User-Agent. Before anything is written, your IP is truncated to a coarse network block, combined with a broad device class and a salt that rotates daily, and hashed one way. The structure that reaches storage has no field for an IP or a User-Agent, so neither can leak downstream by mistake. Because the salt rotates daily you cannot be followed from one day to the next; there is no persistent visitor ID and no cross-site identifier. Global Privacy Control and Do Not Track are honored. Property names and values that look like personal data are rejected before storage.
Stored: a page path, a coarse device class, browser and OS family, a referring hostname, campaign tags, an event name, and the daily hash. Country and region columns exist but are always empty — we do no geolocation.
3.4 Newsletter — capability present, no subscriptions
There is no signup box on this site, and no public route that creates a subscription. If we ever add you to a list, your subscription starts pending and becomes active only when you click a confirmation link. The subscription record holds a reference to your identity record, not your email. Confirmation tokens are stored only as hashes, with an expiry. Unsubscribing is a public, one-click, signed link that needs no login and sets no cookie — it changes the status, it does not erase the record.
3.5 Comments — capability present, not in use
No comment has ever been stored here. If we turn them on: comments are anonymous, we store the name you give plus optional email and website, and your IP is never stored — it is hashed with a secret salt as the request arrives. Spam filtering is entirely local; nothing is sent to a third-party scoring service. Comments can be permanently purged, and that purge is a real hard delete.
3.6 Member accounts — capability present, no accounts
Sign-in would be passwordless, by emailed one-time link. There is no password anywhere in this system. We would store your email, optionally a name, verification state, status, and an internal note. Sessions store a hash of the session token — never the token — plus, unlike the rest of the site, your IP and User-Agent in full, for session security. Consent would be recorded as a purpose-by-purpose ledger, with withdrawal recorded as its own entry rather than by erasing the original.
Member records cannot be deleted. They are designed to be disabled, never destroyed, because a member is an actor in the site's revision history. There is no code path anywhere that removes one. Section 10 explains what we do instead.
3.7 Media
Images here are uploaded by us; there is no public upload. Publicly served images are re-encoded, which does not carry EXIF or GPS metadata into what you download. Original files are stored as received, metadata intact. If you send us an image, assume it still carries whatever your camera put in it.
3.8 Payments — not operational
Nothing can be bought here. The only payment provider wired in is a non-functional reference implementation with no gateway behind it. There are zero order records. Card details could never reach our database in any case — the order record has no field for a card number, billing address, or cardholder name, only opaque processor references. One caveat if we ever enable it: processor notifications are stored verbatim as received, and some processors put a customer name or email in them.
3.9 Logs
We log errors, not request bodies, IPs, or email addresses. We have not audited every error path, so it is conceivable an error message could carry a fragment of something you typed. We do not use logs to build profiles and we do not share them.
4. Third parties
| Who | When | What they get |
|---|---|---|
| The AI provider we configure (today: Google, Gemini API) | Every message you send the site chat | Your message and the conversation context |
| GitHub | When you download Tovu, open an issue, or the desktop app checks for updates | Your IP address and request details; for update checks, the app version and platform |
| Hosting provider | Continuously, once deployed | Whatever passes through the server |
| An email provider | Only if we configure one | Recipient address and message content |
| A payment processor | Never — not enabled | Nothing |
| A spam-filtering service | Never — not enabled | Nothing |
No third-party script, font, pixel, or tracker loads on this site. We verified this against every published page: a page load fetches its resources exclusively from this site's own origin. No Google Fonts, no analytics SDK, no error-reporting SDK, no embedded widget. The typefaces you see are whatever your own device already has. Download links point to GitHub, so clicking one sends your request to GitHub.
Where this site is hosted is not yet settled, because it is not yet deployed. We will name the provider and region here before it is. The transfer we can already describe is the site chat: today's provider, Google, is a US company, so your chat messages leave the UK and EEA (section 11).
We may also disclose data to professional advisers under confidentiality, or to law enforcement, courts, or regulators where legally required. If we are ever compelled to hand over your data we will try to tell you, unless the law forbids it. If the project or its assets are transferred (for example, to a company we form), your data may move with it under this Policy.
There are no ads on this site. We have never sold personal data. We do not sell or share it today. Section 17 says what may change and what we will do first.
5. Cookies and browser storage
This is the complete list. All three are strictly necessary, and there are no analytics, advertising, or third-party cookies.
| Name | Purpose | Lifetime | Flags |
|---|---|---|---|
tovu_session | Keeps our own administrators signed in. Never set for visitors. | Session expiry | HttpOnly, Secure, SameSite=Strict |
tovu_member_session | Keeps a signed-in member signed in. Only if accounts are enabled. | Session expiry | HttpOnly, Secure, SameSite=Lax |
tovu_form_flash | Returns your own just-typed answers after a form validation error | 120 seconds | HttpOnly, SameSite=Lax |
The site chat also uses sessionStorage to keep your conversation within the tab you are using. It is not a cookie, it is not sent to us, and it is discarded when you close the tab.
You see no cookie banner because there is nothing non-essential to consent to.
6. Legal bases (UK and EU GDPR)
| Processing | Basis |
|---|---|
| Form submissions, to reply to you | Legitimate interests, Art. 6(1)(f) — answering someone who deliberately contacted us |
| Site chat messages | Legitimate interests, Art. 6(1)(f) — answering a question you chose to ask |
| IP for rate-limiting and abuse prevention | Legitimate interests, Art. 6(1)(f) |
| Newsletter, if enabled | Consent, Art. 6(1)(a), withdrawable at any time |
| Member accounts, if enabled | Contract, Art. 6(1)(b) |
| Non-identifying analytics, if enabled | Legitimate interests, Art. 6(1)(f) — no cookie, no retained IP, no cross-day identifier |
| Consent records | Legal obligation, Art. 6(1)(c) — the GDPR requires us to be able to demonstrate consent |
| Security logging | Legitimate interests, Art. 6(1)(f) |
We do not knowingly process special category data. If you type something like that into a free-text field or the chat, you are doing so on your own initiative and can ask us to delete it. You may object to anything we base on legitimate interests.
7. How long we keep things
| Data | How long |
|---|---|
| Form submissions | IP addresses on form submissions are deleted after 90 days. The answers and timestamp remain until the submission is deleted. Request deletion using the contact form. |
| Site chat conversations | Not retained by us. They live in your tab and end with it. The AI provider's retention is set by its own terms. |
| Comments, if enabled | Indefinitely once approved. Permanently destroyable. |
| Newsletter subscriptions and send records | Indefinitely, including after you unsubscribe — the status changes, the record stays |
| Member accounts | Indefinitely. These cannot be destroyed — see section 10. |
| Consent records | Indefinitely by design — they are the evidence that consent was obtained |
| Analytics events | Indefinitely, as non-identifying aggregate data |
Form submission IP addresses are cleared automatically after 90 days; this does not delete the submission. Where another record is only marked as removed rather than destroyed, the row still exists; the table above says which is which.
8. What we do with it
Answer you. Prevent spam and abuse. Answer chat questions. Send email you asked for. Understand aggregate readership. Prove consent was obtained. Meet legal obligations. Investigate security incidents.
Today we do not advertise, sell your data, share it for cross-context behavioral advertising, or build profiles. We do not make automated decisions with legal or similarly significant effects. If any of that changes, section 17 applies.
9. Your rights
Under the UK and EU GDPR you may: access what we hold and get a copy; correct it; erase it (read section 10 first); restrict processing while a dispute is resolved; object to anything based on legitimate interests, including direct marketing, which we will stop without a balancing test; receive data you gave us in a portable format; withdraw consent at any time; and not be subject to solely automated decision-making, which we do not do at all.
How to exercise them: use the contact form. That is the whole mechanism. There is no self-service privacy dashboard, no export button, and no delete-my-account button — they do not exist in the software and we will not describe features we have not built. A person reads your request and acts on it.
Tell us enough to find your records — the email you used, or roughly when and what you submitted. We will ask for more only if we cannot identify you. We will respond within the time the law requires, and we aim to respond within 30 days. Under the GDPR that is one month, which the law lets us extend by two further months for a complex request; if we extend, we will tell you within the first month. No charge, unless a request is manifestly unfounded or excessive.
You may complain to a data protection supervisory authority at any time without going through us — the one where you live, where you work, or where you think the problem happened. In the UK that is the Information Commissioner's Office (ico.org.uk); the European Data Protection Board publishes the list of national authorities. We have no establishment in the EU or UK, so there is no lead authority to name.
10. Erasure, exactly
Permanently and irreversibly destroyed on request: your form submissions, including the IP stored with them; your comments, via the purge function.
Only disabled and overwritten: member accounts. The software cannot delete a member record — a member participates in the site's revision history, and destroying the record would corrupt it, so the capability was deliberately never built. What we do instead is disable the account and overwrite the identifying fields, so what remains no longer identifies you. We will confirm when it is done.
Kept: consent records, where we need them to show consent was properly obtained and withdrawn — Art. 17(3) permits this. Records the law requires us to keep. Analytics events, which carry no identifier that could be traced back to you.
Erasure applies to live systems immediately and to any backups as they age out of rotation. We do not restore erased data into a live system.
11. International transfers
Your site chat messages go to the AI provider we configure; today that is Google, a US company. Where personal data leaves the UK or EEA the lawful mechanisms are an adequacy decision, Standard Contractual Clauses, or a permitted derogation; Google participates in the EU–US and UK–US Data Privacy Framework. GitHub, also a US company, receives download and update-check requests. These are the transfers we can currently identify. The hosting location is not yet settled (section 4). For self-hosted installs, data lives wherever the operator deploys it.
12. Children
This site is not directed at children and we do not knowingly collect data from anyone under 16, or the applicable age of digital consent where you live. There is no age gate, no date-of-birth field, and no age verification, so we have no technical means of knowing a visitor's age. What we rely on is that this is a site about content management software. If you believe a child has given us personal data, tell us and we will delete it.
13. Security
What is structurally true, rather than reassuring adjectives:
- No passwords exist in this system. There is no password database to breach.
- Session tokens are never stored — only a hash, so nothing in the database can be replayed as a login.
- Newsletter confirmation tokens are stored as hashes, with an expiry.
- Analytics discards personal data before storage by construction: the structure that reaches storage has no IP or User-Agent field.
- Comment IPs are hashed at the network boundary, before storage.
- All cookies are HttpOnly, so no JavaScript on the page can read them.
- Member sessions and administrator sessions are architecturally isolated and cannot read one another. Deleting a visitor's data is a permission that must be explicitly granted.
- Traffic is served over HTTPS.
What we do not claim: no security certification, no third-party penetration test, no guarantee. If you find a vulnerability, please report it using the contact form before disclosing it publicly.
If a personal data breach is likely to risk your rights and freedoms, we will notify the supervisory authority as the law requires: under GDPR Art. 33, without undue delay and, where feasible, within 72 hours of becoming aware. If it is likely to be high risk to you, we will contact you without undue delay, as Art. 34 requires, and tell you what happened, what was involved, and what you can do. We do not promise a shorter deadline than the law sets.
14. Self-hosted Tovu — you are the controller
If you run Tovu yourself, everything above is essentially irrelevant to your install.
Your install sends us nothing. No content, no visitor data, no configuration, no usage, no crash reports. Your database is yours.
It does talk to third parties. These go straight from your machine to them, not through us:
- GitHub — the desktop app checks GitHub for a new release shortly after launch and then every few hours, and downloads updates from there. GitHub sees your IP address, the app version, and your platform. Set
TOVU_DESKTOP_DISABLE_UPDATER=1to turn this off. - The npm registry — when you install Tovu, a plugin, or another package.
- The AI provider you pick — see below.
- Any service you connect — for example a publishing host, a source-control account, or an external tool server. Each gets what you send it, under its own terms.
You are the data controller for your site. Every mechanism in section 3 runs in your install and writes to your database. You decide what to enable. You need your own privacy policy — do not copy this one, it describes our choices. We are not your processor, and there is nothing for us to sign a data processing agreement about. (A hosted Tovu would change that; see section 17.)
The admin AI assistant uses the provider you pick. Your content, prompts, and any files or pages the assistant reads go to that provider, under your account and its terms. It does not route through us. The software supports:
- Your own API key with Anthropic, OpenAI, Azure OpenAI, Google Gemini, OpenRouter, or any compatible endpoint you enter.
- A local model through Ollama, which stays on your machine.
- A coding-agent CLI already installed on your machine, such as Claude Code or Codex. That tool sends content to its own vendor under its own terms.
AI you connect is not ours. The AI providers, coding-agent CLIs, and tool (MCP) servers you connect process your data under their own terms and privacy policies, not this one. To the fullest extent permitted by law, we are not responsible for how they handle, keep, or use it, or for leaks or exposure through them or through what an AI agent does with the access you give it. You choose them and what they can reach. Terms of Service section 11.1 has more.
Things worth checking in your own install:
- The visitor site chat is off by default and costs money when on. If you enable it, whatever your visitors type goes to the model provider you configured, on your key. Disclose that in your own policy.
- Set a real secret for
COMMENTS_IP_SALT. Left unset with comments enabled, the software falls back to a publicly documented development value and your commenters' IP hashes become trivially reversible. - Check what your theme actually loads. A theme manifest that declares web fonts can, on some render paths, make every page fetch them from Google and send your visitors' IPs there. Read your own rendered HTML rather than assuming. (The theme this site runs does not.)
- Decide whether to honor Do Not Track and Global Privacy Control in the analytics configuration.
- Member records cannot be deleted in your install either. If you take on members, plan for anonymization rather than deletion.
15. California, and other US states
Today we do not sell or share your personal information as the CCPA defines those terms, and never have. We run no advertising and have no advertising partners. Because there is nothing to opt out of, there is no "Do Not Sell or Share" link. If that changes, we will add that link and an opt-out before any selling or sharing starts (section 17). We honor Global Privacy Control and treat it as a valid do-not-sell-or-share request. We collect no sensitive personal information, so the right to limit its use does not arise.
In California's categories we collect identifiers (IP address from forms and chat rate-limiting; email if you give us one) and internet activity in a limited, non-identifying form. We collect no commercial information, no geolocation, no biometric, audio or video data, no employment or education records, no protected classifications, and we draw no inferences to build a profile.
California rights — know, delete, correct, opt out of sale or sharing (nothing to opt out of), limit sensitive information (none collected), and non-discrimination. We will never give you worse service for exercising a privacy right, and we run no financial incentive programs. To exercise them, use the contact form. We will respond within the time the law requires, and we aim to respond within 30 days. Under the CCPA that is 45 days, which the law lets us extend once by a further 45 days if we tell you why. We will verify your identity proportionately, usually by asking you to confirm from the email address associated with the data, and we accept authorized agents with written proof of authority.
Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana and other states grant broadly similar rights. If you live in one, ask and we will honor the equivalent right, within the time that law allows. Today we do no targeted advertising, no sale, and no profiling, so those opt-outs have no subject matter here yet.
16. Changes
We may update this Policy, and will change the date at the top when we do. For a material change — a new category of data, a new third party, a new purpose — we will say so on this page, and email you if we hold your address, before it takes effect, and ask for consent where consent is required rather than assume it. Previous versions are available on request.
17. What may change
Two things we might do if Tovu later becomes a business. Neither happens today. Before either does, we will update this Policy and ask for your consent where the law requires it.
- Advertising — if we later show ads or use advertising data, that could count as "selling" or "sharing" under US state law. Before we do, we will say what data is involved and who gets it, add a "Do Not Sell or Share My Personal Information" link, honor opt-outs and Global Privacy Control, and ask for consent to any non-essential cookies where the law requires.
- Hosted Tovu — if we later run Tovu sites for customers, then for those sites the customer is the controller and we are its processor. We will offer a data processing agreement, publish a list of our subprocessors and give notice before adding one, tell customers about a breach affecting their data without undue delay, and let customers export their data before we delete it when they leave. Hosted Tovu will have its own terms.
About AI and reporting content
Tovu includes AI assistants. AI output can be wrong, misleading, harmful, or infringing. Review it before you publish it or rely on it. What you send to an AI provider is handled under that provider's terms and privacy policy. See the Privacy Policy and Terms of Service for details.
Report AI content using the site's contact form. Include where you saw it and what happened, and avoid including secrets or unnecessary personal information.