Protection, with the boundaries explained
Tjati uses transport encryption, access controls, environment separation, logging and monitoring intended to detect failures or abuse. Stored OAuth credentials are encrypted. Uploaded files are encrypted at rest by Cloudflare.
Our servers' storage, including the database, cache and operational logs, is encrypted at rest. Tjati is not end-to-end encrypted: our systems and selected providers must be able to read information when needed to deliver a feature.
Understand what an AI connection receives
AI and voice features process information with the providers described in the Privacy Policy and subprocessors list. Review those pages for the data each feature uses. Do not assume that a personal planning app is a place for passwords, sign-in codes or information your employer does not permit you to share.
External AI connections use authorization and explicit scopes. Review the requested access before connecting a client, and revoke connections you no longer need.
Control your account and your content
You can export your core content in JSON or Markdown from Settings → Privacy. You can also request account deletion there. Export first if you want a copy: deletion cannot be undone.
Deletion runs across the systems that hold your data. Limited information can remain in caches, security records and backups during the retention periods described in the Privacy Policy. Database backups are kept for 30 days.
Report a security concern privately
Email [email protected] with “Security” in the subject. Include what you found, how to reproduce it and the possible impact. Please do not access, modify or delete anyone else’s information while investigating.
Use private email for vulnerabilities rather than a public Discord message. Our support page describes the response target and good-faith reporting guidance.