Privacy policy

1. What this covers

This policy explains what Tide collects when you use trytide.vercel.app and the Slack, Discord, and GitHub integrations, why it is collected, and how long it is kept. Tide is built for teams: your workspace’s owners and admins control what Tide can see.

2. What Tide collects

• Account data. Your email address, the name you provide, passkey public keys, and session records. Tide stores no passwords.
• Workspace content. Task requests, plans, thread conversations (including messages sent in Slack or Discord threads that are linked to a task), decisions, review findings, and the code changes agents produce.
• Repository data. Metadata and file contents of repositories your workspace approves, read at task time to do the work. Tide accesses only approved repositories.
• Connected credentials. Provider credentials you choose to connect (subscription tokens or API keys) are encrypted with AES-256-GCM at rest and used only to run your workspace’s tasks.
• Billing data. Plan, credit ledger, and usage records. Card details go directly to Stripe; Tide never stores card numbers.
• Operational logs. Audit events, service logs, and per-call model usage needed to run and secure the Service.

3. How it is used

To operate the Service: running agents against your requests, mirroring threads across surfaces, enforcing budgets and permissions, metering usage, billing, preventing abuse, and providing support. Tide does not sell personal data and does not use your code or content to train models.

4. Model providers

Task content is sent to model providers to generate plans, changes, and reviews. By default that traffic flows through Vercel AI Gateway to OpenAI, Anthropic, or xAI under their API terms. If your workspace connects a personal subscription or its own API keys, those calls run under your agreement with that provider. API-based model traffic is generally not used by providers to train their models under their current terms.

5. Where data lives

Tide runs on Vercel (hosting, isolated sandboxes, model gateway) with data stored in Supabase-managed Postgres. Sub-processors: Vercel, Supabase, Stripe (payments), Resend (email), GitHub, Slack, and Discord (for the surfaces you connect), and the model providers above. Each processes data only to provide their function.

6. Retention

• Raw task content, thread messages, model output, and execution logs expire on your workspace’s retention schedule, 30 days by default.
• Billing records, the credit ledger, and audit events are retained longer, as required for accounting and security.
• Deleting your workspace removes customer content after a short recovery window; backups age out on their own schedule.

7. Security

Passwordless authentication with single-use, hashed magic-link tokens and passkeys; row-level security enforced on every workspace table; append-only event and ledger records; encrypted provider credentials; and sandboxes that never receive Tide, GitHub, chat, or billing secrets. No system is perfectly secure, but Tide is built so a single failure does not expose your work.

8. Your rights

You can access and update your account information in the product. For export, correction, or deletion requests, or any privacy question, contact lucas@zeroleaks.ai and we will respond within 30 days. Depending on where you live you may have additional rights under laws such as the GDPR or CCPA, which we honor.

9. Changes

If this policy changes materially, workspaces will be notified by email or in the product before the change takes effect.