Security Overview
Effective October 13, 2026
This page describes how we work today, and it changes as the product does. The Privacy Policy holds the privacy commitments; this page backs them up.
Encryption
In transit. Connections from your device to Tidy’s edge, and from Tidy to outside providers, use TLS 1.2 or better. Internal service calls use plain HTTP on an isolated private network. They are not encrypted; the public edge is the only way in.
At rest. Stored server data is encrypted, and access tokens are encrypted again before storage. On Android, each account has its own app-private storage, protected by Android’s device encryption. The chat session store has its own database encryption; the main local database does not. The web app’s local copy relies on your browser and device security.
Sync is encrypted on the way to Tidy, but it is not end-to-end encryption: Tidy’s services and the AI providers handling a request can process its content.
Separation between accounts
Accounts are kept apart from each other. Inside a household or team, each member sees only what their access allows. On Android, each account on a device has its own storage and local database.
Who can reach your data
Tidy’s systems process content to run the service. Staff don’t read it routinely. A workspace owner can grant our support team access when they need help; a grant lasts at most 8 hours, ends on its own, can be ended sooner, and is logged.
Where it runs
Tidy runs on servers we manage in the United States, for databases, file storage, sync, transcription, and simple image generation. We also use named providers: Amazon Web Services for email delivery and encrypted backups, Google Cloud for new-mail notifications, Cloudflare for web traffic, and the AI providers on the Subprocessors page.
Email attachments are scanned for malware when they arrive, and imported files are scanned before upload. Malware is rejected.
Changes and vulnerabilities
Every code change goes through automated dependency scanning, static security analysis, and secret scanning before it ships, and we apply security updates routinely.
Found a vulnerability? Email [email protected] with “Security report” in the subject. We’ll work with you, and we won’t take action against good-faith research that respects our members’ data.
Incidents
If a security incident affects your data, we investigate, contain it, fix the cause, and tell affected members without undue delay, and regulators where the law requires. The notice says what happened and what we did.
Backups
Backups are encrypted. Deleted data leaves our backups as they expire, within 6 months, and a restore never brings back a deleted account. The Data Deletion page has the detail.
Your part
Use a strong password, keep your devices locked, disconnect accounts you no longer use, and tell us quickly if something looks wrong.
What we don’t claim
Tidy holds no security certifications, and this page claims none. Two-factor sign-in is not available yet. No system is perfect; this page describes the practices we actually run.
Contact
Security reports and questions: [email protected]. Privacy questions: [email protected].