Skip to content
Tydy

Privacy Policy

Effective: Updated:

This Privacy Policy describes how the Operator processes personal data when you use the Tydy service at tydy.dev.

Contents
  1. 1. Operator
  2. 2. Scope
  3. 3. Categories of data
  4. 4. Purposes of processing
  5. 5. Legal bases
  6. 6. Telegram and AI processing
  7. 7. MCP access
  8. 8. Sharing and processors
  9. 9. Cookies and local storage
  10. 10. Retention and security
  11. 11. Your rights
  12. 12. International aspects
  13. 13. Children
  14. 14. Changes
  15. 15. Contact

1. Operator #

The Operator of the Tydy service (the “Service”) is Komishan Nikita Danilovich (Комишан Никита Данилович), a self-employed individual (самозанятый), INN 231142994315.

For privacy matters contact privacy@tydy.dev. For general support contact support@tydy.dev. For legal notices contact legal@tydy.dev. For security reports contact security@tydy.dev. The Operator communicates by email only and does not publish a postal address for these purposes.

2. Scope #

This Policy applies to personal data processed in connection with accounts, workspaces, billing, Telegram integrations you configure, Model Context Protocol (MCP) connections, and related support or security activities on tydy.dev.

It does not cover third-party services that you connect or visit outside the Service, including Telegram itself, payment providers, or MCP client applications, each of which has its own terms and privacy practices.

3. Categories of data #

Depending on how you use the Service, the Operator may process:

  • Account and profile data (for example email, display name, authentication credentials and session identifiers).
  • Workspace and membership data (roles, permissions, project and task content you and your collaborators create).
  • Communication content ingested only through Telegram chats you explicitly configure for integration, including messages, media metadata, and related AI routing context.
  • AI proposal and review data (proposed actions, confidence metadata, Inbox review outcomes such as accept, ignore, or restore).
  • MCP connection metadata (OAuth consent, scopes, personal access token identifiers and hashes—not plaintext token values after issuance—and usage signals needed for security).
  • Billing and payment status data necessary to manage Free, Pro, and Team plans, optional Pro trials, auto-renewal status, and YooKassa payment records in RUB; saved payment-method metadata (type, provider identifier, masked display data such as last4 when used). Full card credentials are processed by YooKassa and are not stored by the Operator.
  • Technical and security logs (IP-derived signals, request metadata, device trust markers, and abuse-prevention events).
  • Preference data stored locally in your browser (for example locale and theme), which is not read as an analytics cookie.

4. Purposes of processing #

Personal data is processed to provide and improve the Service, authenticate users, enforce workspace permissions, route and review AI-proposed changes to project state, deliver optional Telegram and MCP integrations, process payments, prevent abuse, comply with applicable law, and respond to support or security requests.

The Service treats Telegram ingestion as conversational context: a message is not automatically a task. AI output proposes typed actions; business rules and, where required, human review in the Inbox determine what is applied. Original source context is retained so that updates can prefer existing work over duplication.

6. Telegram and AI processing #

Telegram is used only for integrations you configure. The Operator does not claim to process all of your Telegram activity—only content and metadata delivered through the configured integration paths.

AI features analyse batches of messages and related project context to propose actions. Below applicable confidence or policy thresholds, proposals may remain pending review and are not silently written as authoritative task changes. Applied actions are designed to remain undoable through product mechanisms where available.

7. MCP access #

MCP access may use OAuth and/or personal access tokens (PATs). Effective permissions are the intersection of granted MCP scopes and your live workspace role-based access control (RBAC). Token secrets are shown once where applicable and stored in hashed form; plaintext secrets are not retained for replay after issuance.

You are responsible for the MCP clients and hosts you authorize and for revoking connections you no longer trust.

8. Sharing and processors #

The Operator does not sell personal data. Data may be shared with subprocessors strictly needed to operate the Service (for example hosting, email delivery, and YooKassa for RUB payments), with collaborators inside workspaces you join, and when required by law or to protect the Service, users, or the Operator.

Workspace content is visible to members and integrations according to permissions configured in that workspace. Hiding a control in the user interface is not itself an authorization grant.

9. Cookies and local storage #

The Service uses necessary cookies: flowtask_session (session authentication), flowtask_csrf (cross-site request forgery protection), and tydy_remember_device (optional trusted-device / remember-me credential). Locale and theme preferences are stored in localStorage. The Service also uses Yandex.Metrika (counter ID 112759090) for visit statistics, click maps, and session replay; Yandex may set its own cookies or similar identifiers. For guests, Metrika runs only after consent via the cookie banner; for signed-in users it is always enabled. The Service uses Sentry (EU region) for error and performance monitoring; browser Session Replay follows the same consent rule as Metrika.

Further detail is in the Cookie Policy.

10. Retention and security #

Data is retained for as long as needed to provide the Service, meet legal and accounting requirements, resolve disputes, and maintain security logs for a proportionate period. You may request deletion of account-related data subject to workspace ownership rules, legal holds, and backup cycles.

The Operator applies technical and organizational measures appropriate to the risk (access control, hashed credentials and tokens, workspace scoping, logging). No method of transmission or storage is perfectly secure; the Operator does not claim certifications or compliance seals that have not been independently verified for this Service.

11. Your rights #

Subject to applicable law, you may request access, correction, deletion, restriction, portability, or information about processing. Contact privacy@tydy.dev. The Operator may need to verify your identity and may refuse or limit requests where permitted (for example where fulfilling a request would disclose another person’s data or compromise security).

If you believe your rights have been infringed, you may also contact the competent supervisory authority in your jurisdiction.

12. International aspects #

The Service may be accessed from multiple countries. Processing may occur on infrastructure located outside your country of residence. By using the Service you acknowledge that cross-border transfers may be necessary to operate tydy.dev.

13. Children #

The Service is intended for business and professional use by adults. It is not directed to children. If you believe a child has provided personal data, contact privacy@tydy.dev so that appropriate steps can be taken.

14. Changes #

The Operator may update this Policy. The updatedDate above will change when material revisions are published on tydy.dev. Continued use after the effective date of changes constitutes acceptance where permitted by law; where notice or consent is required, the Operator will provide it through the Service or email.

15. Contact #

Privacy: privacy@tydy.dev. Security: security@tydy.dev. Legal: legal@tydy.dev. Support: support@tydy.dev. Operator: Komishan Nikita Danilovich (Комишан Никита Данилович), self-employed (самозанятый), INN 231142994315.