Last updated: March 28, 2026
OPALLOO INOVACOES LTDA, registered under CNPJ 53.284.020/0001-06, located at Avenida Brigadeiro Faria Lima, 1811 - Cj 115, Jardim America, CEP 01452-001, São Paulo - SP, Brazil ("Tarsy", "we", "us", or "our") operates the Tarsy iOS application, the Tarsy macOS companion application, the relay server infrastructure, and the website at tarsy.dev(collectively, the "Service").
This Privacy Policy explains what information we collect, how we use and share it, and your choices regarding your information. By using the Service, you acknowledge that you have read and understood this Privacy Policy. This Privacy Policy is incorporated into and subject to our Terms of Use.
When you create an account, we collect:
When you connect your Mac to the Service, we collect device metadata to enable connectivity and display it in the app:
On the iOS side, we access standard device properties (device model, OS version, screen dimensions) solely for rendering and coordinate mapping purposes. This information is not transmitted to our servers.
To let you manage projects remotely, the macOS app scans standard development directories (e.g., ~/Desktop, ~/Documents, ~/Projects, ~/Developer) for Git repositories. We collect:
This metadata is stored in your account to display your workspaces. We do not read, index, or store the contents of your source code files on our servers.
Subscription purchases are processed entirely by Apple through the App Store and StoreKit. We do not collect, process, or store your credit card number, billing address, or any payment instrument details. We only receive and store:
If you enable push notifications, we store your Apple Push Notification service (APNs) device token so we can deliver notifications (e.g., when an AI agent needs your input or a task completes). You can disable push notifications at any time in your device settings.
Tarsy offers voice-to-text functionality using Apple's SFSpeechRecognizer framework. Audio is processed on your device whenever on-device recognition is available. Tarsy does not record, transmit, or store audio files. Only the resulting transcribed text is sent as a message to the AI agent.
When you dispatch tasks to AI coding agents, we store task metadata including task description, status (running, waiting, completed, error), the AI engine used, error messages (if any), and timestamps. This data is used to display task history and enable task continuity across sessions.
The macOS app captures your screen using Apple's ScreenCaptureKit framework and encodes the video (H.264 or MJPEG) for real-time streaming to the iOS app. Screen data is:
Screen frames are not stored, recorded, or logged by us — not on the relay server, not in any database. The relay server acts as a forwarding server that does not store or inspect your content. We do not have access to the visual content of your screen.
The iOS app sends touch, scroll, keyboard, and gesture input events to the macOS app to enable remote control. These input events (tap coordinates, scroll deltas, keystrokes, drag paths) are transmitted via WebSocket and are not stored or logged by us or by the relay server.
Certain operations on your Mac may require administrator (sudo) privileges. When this occurs, the macOS app requests your sudo password via the iOS app. The password is transmitted over the encrypted WebSocket connection, used once to execute the privileged command, and cached locally on your Mac for a maximum of 60 seconds before being discarded. Your sudo password is never transmitted to or stored on our servers.
Tarsy supports multiple AI coding agents, including Claude (Anthropic), Gemini CLI (Google), Codex CLI (OpenAI), Aider, and custom CLI tools. When you use these agents:
Tarsy integrates with the UltraContext API for enhanced AI context management. When this feature is active, conversation messages (role and text content) may be sent to the UltraContext service through a secure server-side proxy. Your authentication token is never exposed to UltraContext directly. UltraContext processes data under its own privacy policy.
When available, Tarsy can interface with OpenClaw, a local AI model gateway that runs entirely on your Mac. All data processed through OpenClaw remains on your device and is never transmitted to external servers by Tarsy.
We use the information we collect to:
We do not use your information for advertising, profiling, or automated decision-making.
We do not sell, rent, or trade your personal information. We share your data only in the following circumstances:
We use the following third-party service providers to operate the Service:
We may disclose your information if required to do so by law, or in the good-faith belief that such action is necessary to comply with applicable law, respond to a court order or legal process, or protect the rights, property, or safety of Tarsy, our users, or the public.
If we are involved in a merger, acquisition, or sale of all or a portion of our assets, your information may be transferred as part of that transaction. We will notify you via email or a prominent notice on the Service before your information is transferred and becomes subject to a different privacy policy.
Your account data is stored on Supabase-hosted infrastructure. The relay server (hosted on Fly.io in São Paulo, Brazil) does not persist any data — it only forwards WebSocket messages in real-time. Local data (authentication tokens, preferences) is stored securely on your device using the system Keychain and standard app storage.
We implement industry-standard security measures, including:
While we take reasonable precautions, no method of electronic transmission or storage is 100% secure. We cannot guarantee absolute security.
Your data may be processed in countries other than your country of residence, including the United States and Brazil, where our service providers operate. By using the Service, you consent to the transfer of your information to these countries. We ensure that any such transfers comply with applicable data protection laws, including the use of Standard Contractual Clauses (SCCs) approved by the European Commission where required.
Depending on your location, you may have the following rights regarding your personal data:
To exercise any of these rights, contact our Data Protection Officer at privacy@tarsy.dev. We will respond to your request within 30 days, or sooner if required by applicable law.
If you are located in Brazil, you have the rights provided under the Lei Geral de Proteção de Dados (LGPD), including the right to confirmation of processing, access, correction, anonymization, blocking, or deletion of unnecessary data, portability, information about shared data, and the right to revoke consent. You may also file a complaint with the Autoridade Nacional de Proteção de Dados (ANPD).
If you are located in the EEA, you have the rights provided under the General Data Protection Regulation, including the rights listed above and the right to lodge a complaint with your local data protection supervisory authority. Our legal basis for processing your data includes: performance of a contract (providing the Service), legitimate interests (improving the Service, security), and consent (where applicable). You may also use the European Commission's Online Dispute Resolution platform at ec.europa.eu/consumers/odr.
If you are a California resident, you have the right to know what personal information we collect, request its deletion, and opt out of the sale or sharing of personal information. We do not sell or share your personal information as defined under the CCPA/CPRA. To exercise your rights, contact us at support@tarsy.dev.
The Service requests the following device permissions:
All permissions are optional and requested only when the corresponding feature is used. You can revoke permissions at any time in your device settings. The Service will continue to function with reduced functionality if permissions are not granted.
Tarsy does not use third-party analytics SDKs, advertising trackers, or fingerprinting technologies. We do not participate in cross-app tracking. We do not collect or use the Apple Advertising Identifier (IDFA). We do not use cookies in our native applications. Our website does not use tracking cookies or third-party analytics scripts.
The Service is not directed to anyone under the age of 18. We do not knowingly collect personal information from children under 18. If we learn that we have collected personal information from a child under 18, we will take steps to delete that information promptly. If you believe a child under 18 has provided us with personal information, please contact us at support@tarsy.dev.
We may update this Privacy Policy from time to time. We will notify you of material changes by posting the updated policy on this page, updating the "Last updated" date, and, where appropriate, sending you a notification via email or in-app notice. Your continued use of the Service after such changes constitutes your acceptance of the updated Privacy Policy.
This Privacy Policy may be made available in multiple languages for convenience. In the event of any discrepancy between the English version and any translation, the English version shall prevail.
If you have any questions about this Privacy Policy, wish to exercise your data rights, or have concerns about how your information is handled, please contact us: