Privacy Policy

Version 7 · Published 21 October 2026
This is an earlier version. Read the current version (8).
All documents Back Sign in

TUA Platform — Privacy Policy

Effective date: 2026-10-14 Version: 7

Version 7 supersedes Version 6 (2026-09-25). It changes only the product's name: The Utility App is now called TUA Platform. See section 13 for this version's changes; sections 13 to 15 retain the earlier change history.

This Privacy Policy explains how TUA Platform ("the Service", "we", "us") collects, uses, stores, and protects information about you when you create an account or use the Service. By creating an account or using the Service you acknowledge that you have read and understood this Policy.

The Service is owned and operated by CelestiNet (celestinet.com), which is the party responsible for the personal information described in this Policy. References to "we" or "us" mean CelestiNet.

The current authoritative version of this Policy is the one published in the Administrator panel of the Service. Administrators may update this Policy at any time; any changes take effect when the new version is published. Where a change is material you may be asked to re-accept the Policy before continuing to use the Service.

1. Information we collect

1.1 Account information

  • username
  • email address
  • hashed password (never stored in plain text)
  • optional profile information (full name, cellphone, timezone)
  • an optional profile picture, which is stored inside the Service's database rather than as a file
  • account role and per-app permissions
  • a record of which version of this Policy and of the Terms and Conditions you accepted, and when

1.2 Security and sign-in information

  • if you enable multi-factor authentication, a secret used to verify your authenticator app
  • for each device you mark as trusted: a hashed device token, its expiry, the browser user-agent string, and the IP address last seen using it
  • hashed values of any application-specific passwords or API keys you generate. We never store the key itself — only a hash and a short prefix so you can recognise it in a list. A lost key cannot be recovered, only revoked and replaced.

1.3 Content you create

  • notes, diary entries, lists, calendar entries, reminders, tasks and projects, bookmarks, savings and budget data, contacts, statistics, documents, worlds and stories created in the Lore app, and any other data you save while using the Service's apps
  • entries stored in the Password Manager — credentials, notes, licence keys and authenticator secrets — which are encrypted at rest. Personal vault keys are protected by your password or recovery key; company-shared entries use a separately protected company key whose material is divided between the server and an authorised user's personal vault. See section 6.1.
  • images and files you upload

1.4 Communication features

  • If you use the Email app, you supply your own mail account's server details and credentials. These are stored encrypted so that the Service can connect on your behalf. Messages fetched from your mail server are cached by the Service so it can display them; the originals remain on your own mail provider's servers.
  • Every account can use TUA Chat for direct messages and groups with its connections and colleagues; TUA Chat Plus adds features such as company channels. When you use it, we store the messages you send, the files you attach, which conversations you belong to, and delivery state such as how far you have read and whether you are currently active. Read receipts can be turned off individually in your settings. Retention for company channels is set by your organisation's administrator (section 5.5).
  • You can block another user, and you can report one. A block records who blocked whom. A report records who made it, who it is about, the reason chosen and anything you write with it; it is read by the Service's administrators, and the person reported is not told.

1.5 Connected Google and Microsoft accounts (optional)

  • If you choose to connect a Google or Microsoft calendar, we store an encrypted access token and refresh token for that account, the email address of the connected account, the scopes you granted, and details of the calendars and events being synchronised.
  • These tokens let the Service act on your calendar on your behalf until you disconnect the account. You can disconnect at any time from within the Calendar app, and you can additionally revoke the Service's access from your Google or Microsoft account settings.
  • We request only the permissions needed for the features you use. We do not read your mail through these connections.

1.6 AI features (optional)

  • When you use AI Chat, AI Search or AI Tasks, the text of your prompt — and any content the feature is asked to work with — is sent to the AI model configured for this deployment. Your conversation history is stored so you can return to it.
  • A new deployment, and each newly added model, default to a self-hosted model. No external AI provider is used unless somebody configures one.
  • Where an operator or a company does configure an external AI provider, or an external web search provider, your prompts are transmitted to that provider, that provider's own privacy terms apply to what it receives, and your prompt is processed wherever that provider operates — which may be outside the European Union. Ask your administrator which model your bots use: the answer can differ from one bot to the next, and an administrator can see it in the AI app.
  • The self-hosted model runs on a separate machine from the server that serves this Service, and where that machine is depends on how the deployment was installed. See section 10.
  • Automated AI Tasks may store credentials you give them; these are encrypted at rest.

1.7 Technical / usage data

  • IP addresses of devices that access the Service, retained for abuse prevention and to operate the block/allow lists
  • browser user-agent string
  • timestamps of logins, sign-ups, and significant actions
  • pages and routes visited, for security, abuse-prevention and audit purposes
  • error reports generated by the Service
  • anonymous page-performance measurements — the address of the page and how long parts of it took to load, with no user identity attached. These are stored, for 30 days by default, and are then deleted automatically; an operator can change that window

1.8 Cookies and local storage

  • a session cookie used to keep you signed in;
  • an optional "remember me" cookie if you opt in;
  • a CSRF cookie used to protect form submissions;
  • a theme-preference cookie;
  • if you complete a bot check, a signed cookie recording that you did.

We do not use advertising or cross-site tracking cookies.

2. How we use your information

We use the information we collect to:

  1. provide, operate, secure, and improve the Service;
  2. authenticate you and protect your account from unauthorised access;
  3. communicate with you about your account (e.g. email verification, password resets, important Service notices);
  4. deliver the notifications you have asked for, in the app and — where you have enabled it — by email;
  5. synchronise data with services you have explicitly connected, such as a Google or Microsoft calendar or your own mail server;
  6. detect, investigate, and prevent abuse, fraud, and security incidents;
  7. keep audit and error logs as required for the safe operation of the Service;
  8. record that you accepted these Terms and the Privacy Policy on a specific date and version, so we can demonstrate consent if required;
  9. administer any subscription or access grant associated with your account.

We do not use your content to train AI models, and we do not sell your personal information.

Where data-protection law requires a legal basis, we rely on:

  • performance of a contract with you (providing the Service you signed up for);
  • your consent — in particular for connecting a Google or Microsoft account, and for optional features you switch on;
  • our legitimate interests in operating, securing, and improving the Service; and
  • compliance with legal obligations.

Where you connect a third-party account, that consent is specific to that connection and you may withdraw it at any time by disconnecting the account.

4. Sharing of information

We do not sell your personal information. Information is shared only:

  1. With providers strictly necessary to operate the Service. Which of these are active depends on how your deployment is configured — none of them is enabled by default: - the mail server you configured in the Email app (your instruction); - the SMTP server your administrator configured for Service email; - Google and/or Microsoft, if you connect a calendar account; - Google reCAPTCHA, if bot protection is enabled; - an error-monitoring provider, if one is configured; - an AI provider and/or web-search provider, if the deployment uses an external one rather than a self-hosted model.

Your administrator can tell you which are in use. 2. With other users of the Service where you choose to share — for example by inviting someone to a company workspace, sharing a document, list, project or Lore universe, or posting in TUA Chat. 3. Where required by law, regulation, court order, or other legal process. 4. To protect the rights, property, or safety of the Service operators, our users, or the public.

Content you share into a company workspace is visible to the members of that workspace according to their roles, and remains available to that workspace even if you later leave it.

5. Data retention

  1. Account data is retained for as long as your account exists.
  2. A sign-up whose email address has not yet been confirmed is automatically deleted after 48 hours.
  3. Audit logs, error logs, IP-tracker entries, and acceptance records are retained for as long as reasonably necessary for security, legal, and operational purposes.
  4. Cached email messages are held only so the Email app can display them; the originals remain on your own mail provider's servers and are not affected by anything the Service deletes.
  5. Messages in TUA Chat company channels are kept indefinitely unless your organisation's administrator sets a retention period. Where one is set, messages older than that period are permanently deleted — they are destroyed, not hidden.
  6. Items deleted in the Lore app are held in a recycle bin for 30 days before being removed permanently. A limited number of earlier revisions of each item is kept so you can restore previous versions.
  7. Trusted-device records expire automatically. Revoked API keys are kept as a record that they existed and were revoked.
  8. When your account is deleted, your personal account data and the content you created are removed, except: - records we are required to retain (such as legal-acceptance records or audit logs) for legitimate purposes; and - content you contributed to a shared company workspace, which belongs to that workspace. Ask your administrator about their policy for this.

Deleting your account does not, by itself, revoke the Service's access to a connected Google or Microsoft account. If you have connected one, you should also disconnect it in the app, or revoke access from your Google or Microsoft account settings.

  1. Backups are taken on a schedule rather than continuously. The Service cannot be restored to a point in time between backups, so any changes made since the last backup may be lost in a recovery. On this deployment backups are taken daily, so that window is up to 24 hours. A limited number of recent backups is kept; how many is set by the operator of your deployment.

  2. Deleting something may not immediately remove it from existing backups. A backup taken before you deleted it still contains a copy, until that backup is itself replaced by newer ones. Backups are not searched or restored in order to recover individual deleted items.

6. Security

We use a range of technical and organisational measures to protect your information, including:

  • passwords are stored only as salted, hashed values, using a modern memory-hard hashing algorithm;
  • optional multi-factor authentication;
  • sensitive content — Password Manager entries, mail-account credentials, connected-calendar tokens, and AI Task secrets — is encrypted at rest;
  • personal and company-shared Password Manager entries use the distinct encryption arrangements described in section 6.1;
  • separation of each user's data at the database level, so that the database itself — not only the application — enforces the boundary for the great majority of personal data;
  • HTTPS / TLS in transit when the Service is deployed over HTTPS;
  • a strict Content Security Policy, CSRF protection on form submissions, and security headers on every response;
  • rate-limiting and brute-force protection on authentication;
  • per-IP and per-account abuse controls;
  • no page of the Service is indexable by search engines.

No electronic service can promise complete security. We take reasonable steps to protect information, and some risks remain.

6.1 Password Manager encryption and access

The Password Manager uses different encryption arrangements for personal and company-shared entries. Both are intended to protect credentials from ordinary administrative access, although their key arrangements and sharing permissions differ.

Personal vaults. Each personal vault has its own encryption key. That key is stored only in encrypted ("wrapped") form, protected by a key derived from your account password and, where configured, by your recovery key. When you unlock your vault, the Service uses your password to open the wrapped key in server memory for the unlocked session. The vault key is not sent to your browser, and the vault locks after 24 hours without use.

CelestiNet does not have a stored master key or an ordinary administrative process for opening your personal vault without your password or recovery key. If your password is reset, the vault can be reconnected using your old password or valid recovery key. If neither is available, the encrypted contents cannot be recovered through the Service's normal recovery processes. Recovery keys are shown once, are not kept in retrievable form and should be saved securely outside the Service. Using, replacing or reconnecting a recovery key makes the previous key invalid.

Company-shared entries. Entries shared with a company are encrypted using a company key, which allows authorised members to work with shared credentials under permissions set by that company's administrators. Protection of the company key is divided into separate components:

  • one component is kept in an encrypted file on the server; and
  • another is encrypted within an authorised user's personal vault, so it is not directly accessible to CelestiNet independently of that vault's unlocking process.

Under the intended design, the server-held component alone does not provide routine access to the company's passwords. CelestiNet does not ordinarily view or extract shared passwords. The relevant key material is brought together by the Service when authorised users access shared entries. This is different from saying that a company vault can never be compromised: company administrators control member access, and a person with the appropriate company permissions may reveal entries.

Security safeguards and their limits. The application is not designed to capture and store a user's password as it is typed. We maintain unit tests intended to detect code that would introduce that behaviour. Tests can help identify regressions, but they cannot establish that malicious code or an intrusion is impossible. For example, someone who unlawfully changes the application to capture credentials, or compromises the server and introduces code that intercepts an authorised user's unlocking of a vault, could potentially obtain passwords. Those would be unauthorised, malicious activities rather than the normal operation of the Password Manager. We work to reduce these risks, but no electronic medium can be guaranteed completely secure. Any responsibility for a security incident remains subject to applicable law and the Terms; this explanation does not remove rights or duties that cannot lawfully be excluded.

Shared-vault permissions and retention. Company administrators decide who may view or use entries by category and subsection. Revealing, changing or deleting an entry is logged for their review. Reveal records are retained for 90 days, other audit records for 365 days, and deleted shared entries remain in the recycle bin for 30 days before permanent removal. Shared entries remain with the company when a member leaves. If key material required to unlock the company vault is lost and cannot be recovered, affected entries may become unreadable; this does not alter the separate encryption arrangement for personal vaults.

7. Your rights

Subject to applicable law, you may have the right to:

  • access the personal information we hold about you;
  • request correction of inaccurate information;
  • request deletion of your account and associated data;
  • object to or restrict certain processing;
  • receive your data in a portable, machine-readable form;
  • withdraw consent (where processing is based on consent).

You can exercise several of these yourself from within the Service:

  • Profile → Export your data, which produces a machine-readable archive;
  • Profile → Delete your account;
  • Preferences, to control which apps notify you and whether read receipts are shared;
  • Calendar → Settings, to disconnect a connected Google or Microsoft account.

For anything else, contact the Service administrator through the contact form at /contact.

8. Content about other people

Some apps let you store information about people other than yourself — for example contacts, calendar invitees, email correspondents, and free-text content such as notes, diary entries and stories.

For that information you are the one deciding what is collected and why, and you are responsible for having a proper basis to store it and for handling any request you receive about it. The Service processes it on your instruction.

9. Automated decision-making

The Service does not make automated decisions that produce legal or similarly significant effects about you. Automated processing that does occur — spam classification in the Email app, and AI features you invoke — assists you and does not decide anything about you.

10. International data transfers

CelestiNet is registered in the Republic of South Africa. The servers running the Service are hosted by Hetzner Online GmbH, a German company, in its data centre in Helsinki, Finland — so your information is stored and processed in Finland, in the European Union, and is accessed from South Africa in order to operate and support the Service.

Two things are deliberately not on that server, and either may be somewhere else.

The AI model server. The self-hosted AI model is a separate implementation and does not run on the server that serves this Service. It can be installed in a different location, and where it is installed depends on the needs of the deployment it serves — it is not a fixed server, and it is not necessarily in Finland or in the European Union. Where an external AI provider is configured instead (section 1.6), your prompts are processed wherever that provider operates. Ask your administrator which model your bots use and where it runs.

Backups. Copies of the Service's backups are transferred over an encrypted connection and held off the server at CelestiNet's offices in the Republic of South Africa, so a copy of your information is kept there.

Where data is transferred internationally we rely on appropriate safeguards permitted by applicable law, including the conditions for transborder information flows in section 72 of the Protection of Personal Information Act 4 of 2013 (POPIA). Your information leaves this Service by the routes named in this Policy, and we describe each of them here:

  • the external recipients listed in section 4 — each of which is off unless your administrator has enabled it;
  • the AI model server, or an external AI provider where one is configured (section 1.6);
  • the backup copies described above.

11. Children

The Service is not directed at children under the age at which they can legally consent to data processing in their jurisdiction. If you believe a child has created an account without appropriate consent, please contact the Service administrator and we will remove the account.

12. Changes to this Policy

We may modify this Privacy Policy at any time by publishing an updated version in the Administrator panel. Where changes are material, users may be required to re-accept the updated Policy before continuing to use the Service.

13. What changed in Version 7

Version 7 (2026-10-14) changes only the product's name. The Utility App is now called TUA Platform. It is the same Service, CelestiNet is still the party responsible for your personal information, and this version does not change what is collected or how it is used.

Earlier changes: Version 6 (2026-09-25)

Version 6 reflects the chat app's new name and its free version. Company Chat is now called TUA Chat, and every account can use it for direct messages and groups; TUA Chat Plus adds company channels and other features. Section 1.4 now describes chat for every account, blocking and reporting; sections 4 and 5.5 use the new name. This version does not change what is collected from a message or a file.

Earlier changes: Version 5 (2026-09-19)

Version 5 clarifies the split protection of company-vault key material, the role of password-protected personal vaults, and the distinction between ordinary authorised operation and malicious interference. It also updates the tone throughout. This is a correction to the description supplied in earlier versions, not a claim that security risks have been eliminated.

Earlier changes: Version 4 (2026-09-17)

Version 4 clarified that anonymous page-performance measurements are stored, the self-hosted AI model may run on a separate machine outside Finland, and encrypted backup copies are held in South Africa. It also clarified backup timing and Company Chat retention.

14. What changed in Version 3

  1. CelestiNet is named as the owner and operator of the Service and as the party responsible for the personal information described here (preamble and section 16).
  2. The description of Password Manager encryption is CORRECTED. Versions 1 and 2 said the vault key was "derived from your master password". That was true of an earlier design. The key is now a value of its own, stored only in wrapped form — encrypted under a key derived from your account password, and under a recovery key if you create one. The practical assurance is unchanged and is stated more precisely in section 6.1: we cannot read your personal vault, and we cannot recover it either.
  3. A new section 6.1 describes the Password Manager in full, including the consequence the earlier text did not state: if you forget your password and hold no recovery key, the contents of your personal vault are permanently lost and nobody can restore them.
  4. Company-shared entries are described for the first time. They use a key held by the Service on the company's behalf, which is what lets other members use them — and which was described in that version as operator-accessible; Version 5 corrects the description to reflect divided key material. Section 6.1 also covers permissions and audits.
  5. Section 1.3's inventory of what we collect is updated to match, and now names notes, licence keys and authenticator secrets alongside passwords.
  6. Section 10 now names where your information actually is — servers in Helsinki, Finland (EU), hosted by a German provider, operated by a company registered in South Africa — rather than referring vaguely to "the country where the Service is operated", and names the POPIA condition relied on for that transfer.
  7. Nothing in this version widens what we collect or what we do with it.

15. What changed in Version 2

Version 2 (2026-07-31) describes existing practice more completely. It does not introduce any new use of your information. Newly described:

  • multi-factor authentication, trusted devices, application passwords and API keys (section 1.2);
  • profile pictures being stored in the database (section 1.1);
  • Company Chat, including read receipts and presence, and administrator-set retention (sections 1.4, 5.5);
  • connected Google and Microsoft calendar accounts, the tokens involved, and how to revoke them (sections 1.5, 5.8);
  • AI Chat, AI Search and AI Tasks, and where prompts are sent (section 1.6);
  • which external providers may receive data and the fact that none is enabled by default (section 4);
  • retention for Lore's recycle bin and revisions (section 5.6);
  • the self-service tools for exercising your rights (section 7);
  • your responsibilities for information about other people (section 8);
  • a statement on automated decision-making (section 9).

16. Contact

The Service is owned and operated by CelestiNet — celestinet.com, which is the responsible party for the personal information described in this Policy.

For questions about this Privacy Policy or about the personal information we hold about you, contact the Service administrator through the contact form at /contact.