Tidy Privacy Policy

Last Updated: 14 July 2026

This Privacy Policy and our Terms of Service together form one unified agreement governing your use of the Services. Please read both documents carefully. If you were directed here, you can use the link above to review the Terms of Service as well.

1. About This Privacy Statement

This privacy statement explains how POND AI, INC. ("Tidy", "we", "us", "our") processes personal data in connection with the Tidy mobile app (including the Tidy iOS app), our website ( https://tidy.chat ), and related AI agent services (collectively, the "Services"). Tidy is committed to safeguarding your privacy and processes personal data in accordance with applicable privacy laws, including the General Data Protection Regulation ("GDPR") where applicable. This statement gives you an overview of how we process personal data, for what purposes, and your rights as a data subject.

2. Who Is Responsible for Processing Your Personal Data?

Tidy is the data controller for personal data processed in connection with the Services. This means that we determine the purposes and means of the processing and are responsible for ensuring that your personal data is processed in compliance with applicable law.

Contact details:

POND AI, INC.

Address: 1111B S Governors Ave STE 34109 Dover, DE, 19904 US

E-mail: privacy@tidy.chat

Registered in Delaware, File No. 10203186

3. Which Personal Data Do We Process and for Which Purposes?

a. Account data and identity

In connection with providing the Services, Tidy collects and processes personal data about users. We process your phone number as the primary identifier for your account: to establish and verify your identity, to sign you in using one-time passcodes (OTP) sent by SMS, and to detect and prevent fraud and abuse. To set up and administer your account, we also process profile information you provide, such as a display name and, optionally, a profile photo (see Section 3(b)). Where you create an account on our website or contact us through other channels, we may also process an email address and login credentials. To process payments, billing and payment information is handled via third-party payment processors; Tidy does not store complete payment card numbers.

To operate, personalise, and improve the Services, Tidy processes usage and log data, including IP addresses, browser type, device identifiers, access times, and referring URLs. To communicate with users regarding the Services, including service-related notices, security alerts, and support responses, Tidy processes contact information and communication records.

Tidy may also process aggregated and de-identified usage data for product analytics and service improvement.

The legal basis for processing account and service data is performance of the contract between Tidy and you (GDPR Art. 6(1)(b)) and Tidy's legitimate interests in operating and improving its services (GDPR Art. 6(1)(f)).

b. Optional information you provide through the mobile app

The Tidy mobile app may ask your permission to access the following information. Each of these is optional, is used only for the purpose described, and the app continues to function without it:

• Profile photo: if you choose to set a profile picture, you may upload a photo from your device's photo library. We access only the image you select to set your avatar; we do not access or scan your broader photo library.

• Location: if you grant location access ("while using the app"), your location is used only to find places near you. Location is never required — you can always enter a location manually instead — and we do not track your location in the background.

• Push notifications: if you enable notifications, we collect your device's push token so that we can deliver the tracker and alert notifications you have asked for. You can turn notifications off at any time in your device settings.

The legal basis for processing this information is your consent (GDPR Art. 6(1)(a)), which you may withdraw at any time through your device permission settings, together with performance of the contract between Tidy and you (GDPR Art. 6(1)(b)).

c. Tracker and agent content

A core function of the Services is to let you create personal tracking agents ("trackers") and to be notified about them. To provide this function, Tidy processes the things you ask it to track and the messages you send to the agent, including any personal data contained in or referenced by those requests. This content is used to run your agents, generate responses, and deliver the notifications you have requested. The legal basis for this processing is performance of the contract between Tidy and you (GDPR Art. 6(1)(b)).

d. Social features

When you use Tidy's social features, we process your friendships and friend requests, and any reports you submit about other users or their content. Your username, profile photo, join date, stamps, and the tracker activity you choose to share appear on your profile and in the feeds of users you are connected with as friends. If you create a share link, anyone with the link can view the information on the shared page. The legal basis for this processing is performance of the contract between Tidy and you (GDPR Art. 6(1)(b)).

e. Analytics and diagnostics

To understand how the Services are used and to keep them reliable, we process product-interaction analytics (such as which features are used and how you move through the app) together with crash and performance diagnostics. We use a third-party analytics provider, PostHog, as a processor for this purpose. This data is used to operate, secure, and improve the Services; it is not used to read the content of your trackers or messages. The legal basis is Tidy's legitimate interests in operating and improving the Services (GDPR Art. 6(1)(f)).

f. Third-party AI providers

To run your trackers and generate responses, relevant data such as your instructions and tracker content may be transmitted to our AI providers, Anthropic and OpenAI, who process it only on Tidy's behalf to provide the Services. Tidy does not sell your personal data, and does not share it with AI providers for their own purposes, including advertising or training their general-purpose AI models.

g. Suppliers and other business partners

Tidy processes personal data in connection with its agreements with suppliers and other business partners, including contact details (name, position, telephone number, and email address) and other information necessary to administer those relationships. The legal basis for such processing is Tidy's legitimate interest in managing supplier relationships (GDPR Art. 6(1)(f)).

4. Who Do We Share Your Personal Data With?

a. Data processors

Your personal data may be made available to service providers that process data on our behalf. These include providers of cloud hosting, authentication, analytics, customer support tools, payment processing, and other technical infrastructure necessary for the provision of the Services. We enter into data processing agreements with all such providers, which ensure that your personal data may not be used for purposes other than those we have specified. Our providers are required to impose equivalent obligations on their sub-processors.

b. AI providers

Tidy's AI providers are Anthropic and OpenAI. As described in Section 3(f), they receive only the data needed to run your trackers and generate responses, and process it solely on Tidy's behalf. Tidy does not sell your personal data or share it with AI providers for their own purposes.

c. Other third parties

Tidy will not disclose your personal data to third parties beyond those necessary to provide the Services, unless there is a lawful basis for such disclosure. Tidy may share personal data in the following circumstances:

• In connection with a merger, acquisition, or sale of all or a portion of Tidy's assets, in which case personal data may be transferred to the acquiring entity.

• Where required by applicable law, court order, or governmental authority.

• Where necessary to protect the rights, property, or safety of Tidy, its users, or the public.

• With your consent or at your direction.

5. Your Rights

You have the following rights under applicable data protection law (subject to conditions and exceptions):

• Access – to know what personal data we process about you

• Rectification – to have inaccurate or incomplete data corrected

• Erasure – to request deletion of your personal data

• Restriction – to limit processing in certain circumstances

• Portability – to receive your personal data in a structured, commonly used, machine-readable format

• Objection – to object to processing based on Tidy's legitimate interests

• Withdraw consent – to withdraw any consent you have given for specific processing activities

• Complaint – to lodge a complaint with the relevant supervisory authority in your jurisdiction

You may exercise your rights by contacting us at privacy@tidy.chat . We will respond within the timeframes required by applicable law. If you are located in the European Economic Area, United Kingdom, or Switzerland, you may also lodge a complaint with the relevant data protection authority. We encourage you to contact us first so that we can address your concerns directly.

6. Cookies and Tracking Technologies

Tidy and its service providers may use cookies and similar tracking technologies on the Tidy website and platform to collect usage and browser information. The types of cookies we use include:

• Essential cookies: necessary for authentication, session management, and core platform functions.

• Analytics cookies: which help us understand how users interact with the Services. We may use third-party analytics providers for this purpose.

• Preference cookies: which remember your settings and preferences.

You may manage cookie preferences through your browser settings. Disabling certain cookies may affect your ability to use parts of the Services.

7. How Long Do We Store Your Personal Data?

We retain personal data only for as long as necessary to fulfil the purposes described in this statement, or as required by applicable law.

You can delete your account at any time from within the Tidy app. When you delete your account, we delete the personal data associated with it within 30 days, except where we are required to retain certain information to comply with legal, tax, or regulatory obligations, or where it has been anonymised so it can no longer be linked to you.

• Account information and profile data: retained for the duration of your account and for a reasonable period thereafter for legal, tax, and compliance purposes.

• Tracker and notification data: retained while your account is active and deleted within 30 days following account termination.

• Usage and log data: retained for up to 12 months for analytics and security purposes.

• Communication and support records: retained for up to 3 years for quality assurance and legal purposes.

Anonymised or aggregated data derived from your use of the Services may be retained for longer periods and cannot be traced back to you individually.

8. Measures to Safeguard Your Personal Data

We apply technical and organisational security measures, including encryption in transit (TLS/SSL) and at rest, access controls, and secure cloud hosting, to protect personal data against unauthorised access, misuse, or disclosure. Internal procedures are maintained to ensure ongoing compliance and information security.

No security system is impenetrable. You are responsible for maintaining the security of your Tidy account. If you believe your account has been compromised, please notify us immediately at security@tidy.chat .

9. International Data Transfers

The Services are hosted in the United States. If you are located in the European Economic Area, United Kingdom, or Switzerland, your personal data may be transferred to and processed in countries outside those jurisdictions that may not provide the same level of data protection. Where such transfers occur, we rely on appropriate transfer mechanisms, including Standard Contractual Clauses (SCCs) adopted by the European Commission, adequacy decisions, or other lawful transfer mechanisms under applicable law.

AI providers used by Tidy may process data in jurisdictions outside the EEA. We select AI providers that maintain appropriate safeguards for international transfers and enter into data processing agreements that include SCCs where required.

10. Legal Bases for Processing (GDPR)

Where GDPR or equivalent legislation applies, our legal bases for processing personal data are:

• Performance of a contract (Art. 6(1)(b)): processing necessary to provide the Services you have requested, including account administration and running your trackers.

• Legitimate interests (Art. 6(1)(f)): processing necessary for our legitimate interests, such as analytics, security, fraud prevention, and service improvement, where those interests are not overridden by your rights and freedoms.

• Legal obligation (Art. 6(1)(c)): processing required by applicable law.

• Consent (Art. 6(1)(a)): where we have obtained your specific, informed consent for a processing activity, such as optional data uses or marketing communications. You may withdraw consent at any time without affecting the lawfulness of processing carried out prior to withdrawal.

Tidy is the data controller for processing of personal data in connection with the Services.

11. Children's Privacy

The Services are not directed at children under the age of 18. We do not knowingly collect personal data from children under 18. If you believe we have collected personal data from a child under 18, please contact us at privacy@tidy.chat and we will take prompt steps to delete such data.

12. Changes to This Privacy Statement

We may update this privacy statement from time to time. The most current version will always be available at tidy.chat/privacy . For material changes, we will provide notice through the Services or by email prior to the change taking effect.