Privacy Policy

Last updated 23 October 2026

This policy describes how Tonbo IO Inc. handles personal information for the Tonbo platform at tonbo.dev — accounts, usage and the content you store.

The website at tonbo.io has its own privacy policy, covering visits to that site and its open-source agent pages. This one covers the platform.

1. What we collect

  • Identity. When you sign in with GitHub or Google we receive an account identifier and your email address, and we store a Tonbo account identifier, your linked provider identities and your sessions. We never receive a password — those two providers are the only way to sign in, and authentication happens on their side.
  • Username. The globally unique handle you claim during onboarding.
  • Usage records. For metering and billing: which bucket or resource was addressed, the acting principal, request counts, byte counts and time windows.
  • Billing records. Credit grants, applications, holds and charges.
  • Customer Content. The payloads you write to Streams and the databases built on them. We process this to operate the Service for you; we do not read it for our own purposes.

2. What we do with it

We use this information to operate and secure the Service, to meter and bill usage, to authenticate you, to communicate about your account, and to meet legal obligations. We do not sell it, and we do not use Customer Content to train models.

3. Where it is processed

The platform runs in two AWS regions: us-east-1 (United States) and ap-southeast-1 (Singapore). Your information may be processed and stored in any of them. If you are located elsewhere, using the Service involves transferring your information to United States and Singapore.

  • Account, identity and billing records, including API keys, connected integrations and the directory of which region each of your resources is in, are stored in us-east-1. A disaster-recovery copy of that database is kept in ap-southeast-1; it serves no queries.
  • Each Streams bucket is stored in one region, which does not change once the bucket is created, together with the databases built on it. Usage is metered in the region where it occurs, and the resulting charges are recorded in us-east-1.

4. Who else processes it

We rely on the following providers. Each processes only what its role requires:

  • Amazon Web Services — compute, databases and object storage in every region above; holds Customer Content and account, usage and billing records at rest.
  • Supabase — authentication, in us-east-1; holds your sign-in identity, email address and sessions.
  • Cloudflare — edge network, DNS and TLS; sees request metadata and session cookies.
  • Stripe — payment processing. Card details go directly to Stripe; we do not receive or store them.
  • GitHub and Google — sign-in identity providers.

5. Cookies

We set a session cookie when you sign in, so the platform can recognise you between requests. It is necessary for the Service to function and is not used for advertising or cross-site tracking. Signing out or closing your account ends the session.

6. How long we keep it

We retain information for the minimum period necessary to provide the Service, to meet our legal, tax and accounting obligations, to resolve disputes, and to enforce our agreements. Specifically:

  • Customer Content is deleted when you close your account. We do not archive it. Copies present in operational backups age out on the backup rotation.
  • Billing and transaction records are kept as long as tax, accounting and audit obligations require.
  • Your username is kept permanently as a tombstone and is never reissued. Reissuing a handle would let a later account inherit references to yours.
  • A one-way hash of your email address is kept as the record that your deletion request was honoured. We do not keep the address itself, and the hash is not used for any other purpose.

7. Deleting your account

You can close your account from account settings. Two things are worth knowing before you rely on it:

  • It will not start while an organization still depends on you: one where you are the only owner and others are members, or more than one where you are the only member. Hand those organizations to someone else first.
  • Completion is not instantaneous. Deletion runs as a durable workflow that retries on failure. It begins immediately, but finishing depends on the products releasing their resources.

When it completes, your authentication identity, sessions, profile, personal organization and dependent records are removed. The username tombstone and the email hash described above remain.

8. Your rights

Depending on where you live, you may have the right to access, correct, export or delete your personal information, to object to or restrict certain processing, and to withdraw consent. Much of this is available directly in account settings; for anything else, write to us and we will respond within the period the applicable law requires.

We do not sell personal information or share it for cross-context behavioural advertising, so there is nothing to opt out of on that front.

9. Security

We use industry-standard measures including encryption in transit, encryption at rest, scoped credentials and isolation between customers. No system is perfectly secure, and the Service is currently pre-release — see the Terms of Service for what that means for availability and durability.

10. Children

The Service is not directed to children. You must be at least the age of majority in your jurisdiction, or 18, whichever is higher. We do not knowingly collect information from anyone below that age; if we learn that we have, we will delete it.

11. Changes

We may update this policy. Where a change is material, it takes effect 30 days after we notify you, by email or in the Service.

12. Contact

Tonbo IO Inc.
privacy@tonbo.io