Privacy policy
Last updated: 1 October 2026
The short version
- The Towfu app runs on your computer. Your code, prompts, conversations, files and AI account logins stay there. We never receive them.
- The app has no telemetry or analytics.
- To sell and license Towfu we keep your e-mail address, your licence and a one-way fingerprint of each computer you activate.
- This website uses cookieless, aggregate analytics. There are no advertising or tracking cookies.
Who we are
Towfu is made by Towfu Ltd, Barrow-in-Furness, LA14 4AN, United Kingdom, the data controller for the data described here. Contact: .
The Towfu app
Towfu launches command-line tools you have installed, such as Claude Code and Codex, on your own computer. Those tools talk directly to their providers (for example Anthropic or OpenAI) under your own account, under the providers' own privacy policies. Towfu doesn't sit between them and the provider and doesn't receive that traffic.
Towfu stores its settings, layouts, terminal output, drafts and notes in your Windows user profile. Nothing is uploaded.
The app itself makes these network requests:
| Request | What is sent | When |
|---|---|---|
| Update check | A standard download request for the update file (your IP address and app version reach our download host, Cloudflare) | Shortly after launch, then every few hours |
| Trial start | Machine fingerprint (see below) | Once, on first launch without a licence |
| Activation | Licence key, machine fingerprint, computer name (editable) | When you click Activate |
| Licence refresh | Your signed licence token (contains the licence id and machine fingerprint) | At most once a day, in the background |
| Deactivation | Licence key and machine fingerprint | When you click Deactivate |
Things you ask the app to do, like Git push and pull, SSH sessions or opening a web page in the preview pane, connect to the places you point them at.
Machine fingerprint: a SHA-256 hash of your Windows machine ID combined with a Towfu-specific value. It lets us count how many computers a licence is active on. It can't be reversed into the machine ID and isn't used for anything else.
Buying Towfu
Our online reseller, Paddle.com, processes orders and is the merchant of record for all orders. Paddle collects your payment and billing details and handles tax, receipts and payment support as an independent controller, under Paddle's privacy policy. Paddle shares with us your e-mail address, country, and what you bought and when. We never see your card details.
What we keep, why, and for how long
| Data | Purpose | Legal basis (UK GDPR) | Kept for |
|---|---|---|---|
| E-mail address, licence key (encrypted), order reference, purchase date, licence status | Deliver and recover your key, handle refunds, support | Contract | While the licence exists, then 6 years for accounting records |
| Machine fingerprints, computer names, activation and last check-in dates | Enforce the computer limit; let you manage activations | Contract; legitimate interests (preventing key sharing) | Until deactivated, plus 12 months |
| Trial fingerprint and dates | One free trial per computer | Legitimate interests | 24 months |
| Licence event log (issued, activated, refunded…) | Support, abuse prevention | Legitimate interests | 24 months |
| Support e-mails | Answer you | Legitimate interests / contract | 24 months after the conversation ends |
IP addresses reach our hosting provider, Cloudflare, with every request and are used briefly for rate-limiting and security. We don't store them in our licence database.
This website
We use Cloudflare Web Analytics, which doesn't use cookies or local storage and doesn't identify individual visitors. It shows us aggregate numbers such as page views and referring sites. The site sets no cookies. If you open the checkout, Paddle's checkout may use its own cookies to process your payment; see Paddle's policy.
Who processes data for us
| Provider | Role | Where |
|---|---|---|
| Cloudflare, Inc. | Website, downloads, licence server and database | Global network; data may be processed outside the UK under the UK International Data Transfer Addendum / adequacy arrangements |
| Resend | Sending licence e-mails | USA, under their data processing agreement |
| Paddle.com Market Ltd | Reseller and merchant of record (independent controller) | UK |
Your rights
You can ask for a copy of your data, ask us to correct or delete it, object to processing based on legitimate interests, or ask us to restrict it. E-mail . Deleting your licence data means the licence can no longer be activated or recovered. If you're unhappy with how we handle your data, you can complain to the Information Commissioner's Office (ico.org.uk).
Changes
If we change what the app sends, we'll update this page and mention it in the release notes before the change ships.