Tori: Privacy Policy
Effective 20261028 · Octo Fintech Holdings LLC
This policy describes what Tori (Octo Fintech Holdings LLC, Delaware) receives when you use the Service at usetori.dev and earntori.com, what it keeps, for how long, and your choices. The specifics of what Tori receives, how it moves, what it keeps and who else handles it are maintained at usetori.dev/security, which this policy incorporates; where a signed data processing addendum is more specific, it controls.
1. What Tori receives
Tori receives the contents of the code files a check selects, the repository's file-path list, .env.example, your GitHub identity at sign-in, a machine identifier when an agent session starts, a project identifier, and the client version; the full table, including how files are selected and how to exclude paths, is at usetori.dev/security.
Tori does not receive any other file, your application's runtime data, your customers' or end users' data, or credentials. It never reads a repository as a whole and runs no background process on your machine. Tori's website sets no advertising or analytics cookies.
2. How Tori uses it
To run the checks, keep the record, operate your account, and meet legal obligations. The checks are deterministic rules; no AI model or model provider is in the data path. Tori does not use your data for any other purpose, does not use it to train models, and does not sell it or share it for advertising.
3. What is kept, and for how long
Findings, the signed record, account details and machine identifiers are kept for the life of the account; the retention table is at usetori.dev/security. File contents are processed in memory and discarded after the check; they are never written to storage or logs. The GitHub access token is used during sign-in and discarded. Hosting logs (request metadata, application messages) are kept for 1 day. Deleted data can be recovered for up to 1 day and not after.
4. Who else handles it
Vercel (API), Neon (database) and GitHub (sign-in) are the only subprocessors; roles, data and attestations are at usetori.dev/security. Processing and storage are in the United States (AWS us-west-2, Oregon). No other third party is in the data path. Tori gives 30 days' notice before adding a subprocessor.
5. Security
Traffic between your machine and Tori is encrypted with TLS; data at rest is encrypted by Neon. The key that signs the record is a protected secret on Tori's servers and never leaves them. Production access is held by the founder, with MFA and separate production credentials; it reaches findings, the record and account details, never file contents or end-user data. Tori notifies you within 72 hours of becoming aware of a security incident affecting your data.
6. Your choices and rights
You can see everything Tori holds about a project with tori ledger, tori standards and tori rules. You can ask Tori to export, correct or delete your findings, record and account details by emailing security@usetori.dev; deletion is completed within 30 days of a request or account closure. If you are in a jurisdiction that grants data-protection rights (for example the EU/UK or California), you may exercise them the same way; Tori does not sell personal information and does not discriminate for exercising rights.
7. Roles
For account data (your GitHub identity, project names, the record) Tori is the controller. For file contents sent for a check, Tori processes them on your instructions and keeps none of them. Tori is not intended for use by anyone under 18.
8. Changes
Tori may update this policy; material changes are announced by email or at usetori.dev at least 30 days before they take effect. The effective date at the top is the current version.
9. Contact
Octo Fintech Holdings LLC · security@usetori.dev