Privacy policy

Who we are

Tuff, at usetuff.com, is an app for a team’s projects, tasks, chat and documents, run by EI Yuri Gokoryan, an individual business in France. This page explains what we keep about you, why, who helps us run Tuff, and what you can ask us to do. Email [email protected] with any questions about it.

What we keep

Your account

Your name, your email address and your password (stored only as a one-way hash that we can’t read), a photo if you add one, a line about what you do, and your two-factor sign-in secret if you turn it on.

What you and your team put in

Projects, tasks, messages, documents, files, comments, reactions and logged time. It belongs to the workspace where it was created, and the workspace decides who can see it.

Activity and sign-ins

An activity feed of who did what in a project, when you were last active, your signed-in sessions with the browser and IP address each one came from, and sign-in events such as a new device or a changed password. We use these to keep your account safe and to show you where you’re signed in.

Signing in with Google or Apple

If you choose to, we receive your name, your email address and an ID for your account there. We don’t receive your password or anything else from that account.

Notifications

If you turn them on for a device, we keep the address your browser’s push service gives us to reach that device.

Paying for a plan

Which plan a workspace is on and the status of its subscription, with the IDs Polar gives the customer and the subscription. We never see or store card details.

What we don’t do

No advertising, no selling or renting of anything about you, no tracking across sites, and no cookies beyond the ones that keep you signed in. We don’t use what you put in Tuff to train AI models.

Who helps us run Tuff

Railway

Runs the app and its database, in the United States.

Cloudflare

Provides DNS for the domain, carries traffic to the site, and stores the files you upload. Its Web Analytics counts visits to our public pages — the home page, help, sign-in and these legal pages — without cookies and without identifying you. It is never loaded inside the app.

Resend

Sends our emails: invitations and password resets.

Better Stack

Checks that Tuff is up, and keeps the error lines our server writes when something fails. They name what broke and where, not what you wrote.

Polar

Sells paid plans as the merchant of record: it takes the payment, handles the tax and sends the invoices. It keeps the billing name, email, address and payment details you give it.

Google and Apple

Only if you sign in with them.

KLIPY

Provides GIFs. When you search, your browser contacts KLIPY directly, and KLIPY sees your search words, your IP address and a random ID your browser keeps. A GIF in a message is loaded from KLIPY by the browser of each person who reads it.

Your browser’s push service

Apple, Google or Mozilla, depending on your browser, delivers the notifications you turn on. Their content is encrypted so that only your browser can read it.

When someone posts a link in a message or a comment, our server reads that page and fetches its image to show a preview card. The site sees requests from our server, not from you or from anyone reading the card.

On your device

Your browser stores your sign-in so you stay signed in, a cookie that lets it load the files you have access to, a copy of what you last opened so the app loads fast and you can read it without a connection, and anything you were in the middle of writing. None of it is used to track you anywhere else.

Who sees what

People in your workspace see what their role and their projects allow. We look at a workspace’s content only to keep the service running, when you ask us for help with it, or when the law requires it.

How long we keep it

For as long as your account and your workspace exist. Deleted items are kept for thirty days so they can be restored, then removed for good along with their files. A project deleted for good from the bin is removed immediately. Sessions end when you sign out or when they expire.

Your rights

You can download a copy of everything we hold about you, and delete your account, yourself, under Your data in your account. Workspaces you’re alone in go with it; in others you leave, and what you wrote there stays with that workspace under “Deleted account”. To see, correct or remove anything else, email [email protected] and we’ll reply within thirty days. If you’re in the European Union or the United Kingdom, you have these rights under the GDPR, and you can also complain to your data protection authority.

Security

All traffic is encrypted. Each workspace is kept separate in the database itself, so one company’s work can’t be read from another’s. Passwords are hashed, and two-factor sign-in is available to anyone who turns it on.

Children

Tuff is for work and isn’t meant for anyone under sixteen.

Changes

When this page changes, we update the date at the top. If we change what we keep or who helps us run Tuff, we tell workspace owners before the change applies.