Last updated: October 2026

Tusile ("we", "our", or "the app") is a chat and voice application. This policy describes what data we collect, how we use it, and your choices.

Architecture note. Tusile has two layers: Tusile Core (operated by us) handles accounts, friends, direct messages, server discovery, and Sparks wallets and payments. Community servers may be self-hosted by independent operators, or hosted by Tusile directly on our managed infrastructure ("Tusile-hosted servers"). This policy covers Tusile Core and Tusile-hosted community servers. Self-hosted community server operators are separate data controllers for the content on their servers.

1. Data we collect and use (Tusile Core)

1.1 Account and profile

• Email address: Used to create and sign in to your Tusile account, and to send you the emails described in Section 1.7. Guest accounts have none.
• Sign in with Google or Apple: If you use it, we receive from that provider an account identifier and your email address (and, from Google, your name), and use them only to sign you in.
• Display name and optional avatar: Your global Tusile identity. Shown to other users in DMs and in community servers you join. You choose what to set.
• Password: Stored securely (hashed) and used only for authentication. We do not have access to your plain password.
• Friends list and blocks: Stored by Core so your social graph works across every community server.

1.2 Direct messages

• DM text and DM file attachments: For one-to-one direct messages with encryption turned on, Tusile Core stores only ciphertext: we cannot read the messages or open the files. For group direct messages, and for anything sent before encryption was turned on, Core stores the content itself so you and the other participants can read it.
• What stays visible to us either way: Who the participants are, when each message was sent, whether it has been read, the size and type of attachments, and reactions, which are stored as plain emoji. Encryption covers what you say, not that you said it.
• Reported messages: If you report an encrypted message, its text is sent to us in readable form so we can review the report. The app tells you this before you send it.
• GIFs: The app can search and send GIFs through a third-party GIF service (currently GIPHY or KLIPY). Your search terms pass through Tusile Core to that provider, and the GIFs themselves are loaded from the provider's servers, which therefore see your IP address. The provider processes this under its own privacy policy.

1.3 Encryption keys

• Your public identity key: Published so other people can encrypt messages to you. Public by design.
• An encrypted backup of your recovery key: Scrambled on your device with your recovery phrase before it is sent. We store the result and cannot open it; your twelve words never reach us. You can delete it at any time from the app.
• A list of your devices: A name, a platform (for example “Android”), and when each was last used, so you can see which apps have unlocked your encryption.

1.4 Presence

• Online status: Core stores and shares whether you are online or offline so friends and members of community servers you join can see your activity.

1.5 Technical and usage data

• Device and app: We may receive technical information (e.g. app version, platform) to support and improve the service.
• Logs: Core and its hosting providers may keep limited logs (e.g. IP, timestamps) for security and operation. We do not sell this data.
• Product analytics: We use PostHog (EU cloud) to collect usage events from the apps and this website (e.g. which pages are visited, which features are used) to understand how the service is used and improve it. Events are tied to a random identifier stored on your device (on the website, in a cookie and local storage); once you sign in to an account, the apps also link them to your Tusile account identifier, and Core reports some events (for example about hosting and Sparks purchases) under that identifier too. Guest accounts are not linked. No message content is included, and session recording is turned off.
• Crash reports: The apps send error and crash reports, with a sample of performance measurements, to Sentry (EU region). A report holds technical details such as the app version, the device and operating system, and where in the code the error happened. We do not attach your account to these reports.

1.6 Sparks, payments and wallets

• Payment processor and seller: Sparks are sold through Stripe Managed Payments. Stripe processes the payment and is the merchant of record: it is the seller on your receipt, sends the receipt, and handles tax. You enter your card or other payment details on Stripe's checkout; they go to Stripe and never reach Tusile. To open a checkout we give Stripe your email address and your Tusile account identifier, and Stripe processes the payment under its own privacy policy.
• Purchase records: For each purchase we store which pack was bought, how many Sparks it gave, the amount and currency charged, the amount and currency settled to us, the Stripe checkout session, payment intent and charge identifiers, the purchase's status (for example paid, refunded, disputed, failed or expired) and any amount refunded, the times it was created and paid, the server it was bought for (if any), and your Stripe customer identifier.
• Wallet ledger: Every change to a Sparks wallet is recorded: purchases, Sparks you give to a server (who gave, to which server, how much), plan charges, quest rewards, refunds, chargebacks and corrections. We also record which purchase each Spark came from and which server it went to, so a refund or chargeback can take back exactly those Sparks. If a payment of yours is disputed, your account is marked as blocked from buying or giving Sparks until the dispute is settled.
• Supporter contributions: For each server you give Sparks to, we keep the total you have given, your resulting supporter level, and whether you chose to be shown in its supporters list (off unless you turn it on).
• Earlier subscriptions: For licence and hosting subscriptions bought before 29 September 2026, we keep the Stripe subscription and customer records needed to run them until they end.

1.7 Email and notifications

• Emails: We send email through Resend: account emails (confirming your address, resetting or changing your password), a confirmation saying where the Sparks from a purchase went, notices to a server's owner when its wallet is running low, when its plan enters grace and when the plan stops, emails when a quest pays you Sparks, and, for earlier subscriptions, payment reminders. Wallet and quest emails go only to verified addresses.
• Push notifications: To send notifications to your phone or computer we store a push token for each device and send notifications through Google's Firebase Cloud Messaging, which hands them to Apple's push service on Apple devices. The notification's text (for example a sender's name and, for unencrypted messages, a preview) passes through these services. For encrypted direct messages it carries a placeholder, not the message.
• Gift notices: When someone gives Sparks to a server, its owner is told in the app and by push notification, naming the giver.

2. Data handled by community servers

2a. Self-hosted community servers (not by us)

When you join a self-hosted community server you agree that the server's operator handles the following on their own infrastructure:

• Channel messages and file attachments: Stored in the operator's database and object storage (local disk or their own S3 bucket), not by Tusile Core.
• Per-server nickname and per-server avatar (where supported): Stored on the community server, not on Core.
• Roles, permissions, invites, bans, and moderation state: Managed by the server's operator. If the server's owner attaches roles to supporter levels, Core tells the server which members hold which supporter level so it can give those roles out.
• Voice and video: Your microphone, camera, and screen-share streams are relayed in real time by the LiveKit instance running on that community server. Voice is not recorded by Tusile Core and is not stored by LiveKit in the default configuration; check with the operator if you need specifics.

For retention, deletion, export, moderation, and breach notification of this data, contact the operator of the specific community server. Tusile does not have access to content stored on community servers it does not operate.

2b. Tusile-hosted community servers (operated by us)

When you join or own a server hosted by Tusile on our managed infrastructure (a free hosted server or a Supercharged one), Tusile is the data controller for the following content:

• Channel messages and file attachments: Stored on our infrastructure.
• Per-server nickname and per-server avatar: Stored on our infrastructure.
• Roles, permissions, invites, bans, and moderation state: Stored on our infrastructure.
• Voice and video: Relayed in real time via our LiveKit instance. Not recorded or stored.

For these servers, your rights (access, correction, deletion) apply to us directly; contact us as described in Section 10. Server owners may delete their hosted server and all associated content at any time from within the app. We retain content on hosted servers as long as the server exists; we may also remove content or servers that violate our Terms of Service.

3. How we use your data

We use the Core data above to:

• Create and manage your Tusile account and global profile.
• Deliver direct messages, friend updates, and presence to you and the other participants.
• Register community servers for discovery and validate licenses.
• Sell Sparks, keep wallets, charge plans, pay quest rewards, and handle refunds and disputes.
• Keep the payment and accounting records that tax and accounting law requires.
• Enforce our terms, prevent abuse (including fraud with Sparks and quests), and comply with the law.
• Operate, secure, and improve Core and the client apps.

We do not sell your personal data to third parties.

4. Who can see your data

• Other Tusile users: Your display name, avatar, and online status are visible to your friends and to members of community servers you join. DM contents are visible only to participants of that DM.
• Server owners and members (Sparks): A server's owner can see who gave Sparks to the server and how much, and is notified of each gift with the giver's name. Other members see you in a server's supporters list only if you choose to be shown there. A server role an owner attaches to a supporter level is visible to other members like any role. Every member of a server can see its wallet: the balance, its plan and how many days the balance covers, and notices when the plan is in grace or the server has moved back to the free tier.
• Self-hosted server operators: When you join a self-hosted community server, that operator (not Tusile) can see content you post to that server's channels, your membership, and any roles assigned to you.
• Tusile (hosted servers): When you join a Tusile-hosted server, we can see content posted there, as described in Section 2b. We do not sell or share this content with third parties.
• Service providers: We use third-party services to run Tusile. They process data on our behalf, or under their own terms where stated above, only as needed to provide their service:
  • Hetzner Online (servers and databases, in the EU) and Amazon Web Services (file storage and DNS);
  • Stripe (payments for Sparks and earlier subscriptions, as merchant of record for Sparks);
  • Resend (email);
  • Google Firebase Cloud Messaging and Apple Push Notification service (push notifications);
  • PostHog (product analytics) and Sentry (crash reports);
  • GIPHY or KLIPY (GIF search);
  • Google and Apple, if you sign in with them.

5. Data retention

• Account and profile (Core): Kept until you delete your account (see Section 7).
• Direct messages and DM files (Core): Kept so long as the DM exists, in line with our backup and retention practices.
• Payment records: Kept after you delete your account, for refunds, disputes, and tax and accounting, for as long as tax and accounting law requires. On deletion they are detached from your account: the link to your account is removed. Stripe keeps its own records of the payment under its own policy.
• Wallet ledger: Kept after you delete your account, because it is the financial history of every wallet it touched. Your personal wallet and its entries stay under a random account identifier that, once your account is deleted, no longer leads to you. Your supporter contribution totals on servers are deleted with your account.
• Self-hosted server content: Retention is set by the community server's operator. Contact them for their retention policy and for deletion requests of content on their server.
• Tusile-hosted server content: Retained while the server exists. Server owners can delete the server (and all its content) at any time from the app. A deleted server stops being reachable straight away; its content is kept for a short period so that a deletion made by mistake can be undone (30 days for a free server, 60 days for a Supercharged one), and is then permanently erased. Members may contact us to request deletion of their messages on hosted servers.
• Voice: Not recorded by Core; relayed in real time by the community server's LiveKit instance.
• Logs: Retained only as long as needed for security and operations.

6. Security

We use industry-standard measures (e.g. encryption in transit, secure auth) to protect your data. No system is completely secure; we encourage strong passwords and safe use of the app.

One-to-one direct messages are additionally end-to-end encrypted: they are locked on your device with a key we never hold. We cannot read them, restore them, or hand them over, and if you lose your recovery phrase we cannot get them back for you either. That is the same property, seen from the other side.

7. Your rights and choices

• Access and correction: You can view and update your profile (e.g. display name, avatar) in the app.
• Deletion: You can delete your account from the app's settings, or ask us to (see below). After deletion, we remove or anonymize your data within a reasonable time, except where we must keep it for legal or safety reasons, such as the payment records and wallet ledger described in Section 5. Sparks left in your personal wallet are forfeited.
• Supporters list: You choose, for each server, whether other members see you in its supporters list, and can change it at any time in the server's Sparks tab. The server's owner always sees who gave.
• Notifications: You can turn push notifications off in the app or in your device settings.
• Voice: You can leave a voice channel at any time to stop transmitting your voice.
• Local data: On your device, the app may store preferences and cache (e.g. for faster loading). You can clear app data or uninstall to remove it.

If you are in the European Economic Area or the UK, you may have additional rights (e.g. access, portability, restriction, objection) under applicable data protection laws.

8. Children

The app is not directed at children under 13 (or higher age where required). We do not knowingly collect data from such users. If you believe a child has provided us data, please contact us so we can delete it.

9. Changes to this policy

We may update this policy from time to time. We will post the revised version (with a new "Last updated" date) in the app or on our website. Continued use of the app after changes means you accept the updated policy.

10. Contact

For privacy-related questions, account deletion, or data requests:

• App / developer: Tusile (Karol Rzotki)
• Email or support: krzotki@gmail.com

If you are in the EEA/UK and have a complaint, you may also lodge it with your local data protection authority.