Privacy Policy

What we collect

We collect the following categories of information:

• Account data: your email address, your name, your sign-in details, and what you tell us during setup, such as how you heard about Tada.
• Repository and deployment data: if you connect GitHub or a deployment provider such as Railway, the repository names, branches, commits, deployment events and flow files Tada needs to run your checks and report the results.
• Run data: the result of each run, including its verdict, the steps it took, screenshots of a step that failed, and the recording of a run that passed. A run also records the requests your app answered with a server error, and their status codes. It notes how long the slowest few requests took to answer. For each, it keeps the address without its query string and the step that sent it. It never keeps what a request or response contained.
• Test accounts: the email address and password of the test account Tada uses to sign in to your app. Tada generates that password and stores it encrypted. If a flow needs an email, such as a sign-in link, your app sends it to a temporary Tada inbox that holds it only for a short time.
• Demo content: the videos we record or you upload, their poster images, titles, durations, captions and narration.
• Voice data: if you record your own voice for narration, that voice sample.
• Rivet conversations: the messages you exchange with Rivet, Tada's assistant, and the facts you ask her to remember about your app.
• Feedback content: comments and reactions left on a demo. Anyone with a share link can leave a comment with a display name of their choosing. No account is required, and the name they enter is whatever they type.
• View counts: an anonymous, randomly generated identifier stored in the viewer's browser so repeat opens of the same link are counted once. It is not linked to a person and we do not use it to track anyone across sites.
• Technical data: standard server logs (IP address, browser type, timestamps) generated automatically when you use the service.

How your videos are stored

Demo videos, poster images and run screenshots are stored in object storage (Cloudflare R2). Recordings made by our runner are uploaded by our servers. Recordings made by an older version of the Tada tool on your own computer are uploaded from your device. Playback streams directly from storage to the viewer using short-lived, signed URLs that expire. A demo is reachable by anyone who has its share link, so share links should be treated as unlisted, not secret. Screenshots from a run that did not pass are visible only to your workspace.

How we use your data

We use your data to provide and improve Tada: to run your checks and report the results, to record and host your demos, to generate share links, to run Rivet and the other features described below, to send the emails you have asked for, to display feedback, and to count views. We do not sell, rent, or share your personal data with third parties for marketing or advertising, and we do not use your content to train AI models.

Email

We email you about your account, such as sign-in links, run results and receipts. When you sign up we also send you occasional product updates. Every update carries an unsubscribe link, and unsubscribing never stops the emails your account needs.

Billing

If you subscribe to a paid plan, we keep the information needed to run your subscription: your plan, your billing contact details, your run counts for the period, and a record of what you were charged. Payments are handled by Stripe, and we never receive or store your full card number.

Run counts exist to bill you correctly and to show you what you have used. They are counts, not the contents of your recordings.

Runs, AI and voice

Tada's servers run your checks. Our runner opens your app in a browser, follows the steps in your flow files, records what happens, and reports the result. If your app is running on your own computer, the Tada tool opens a temporary Cloudflare tunnel for the length of the run so our runner can reach it. Older versions of the Tada tool may still record on your computer and upload the result.

The checks themselves do not use AI. A run follows your flow files step by step, and no AI model decides whether it passed.

Some features do send your content to AI and voice services:

• Rivet: your messages, the conversation so far, the facts you asked her to remember, and the workspace details she needs to answer, such as repository names, flows and run results, are sent to an AI model to write each reply. We reach models through OpenRouter, which sends each request to a provider that runs the model. Those providers are Anthropic, OpenAI, Moonshot AI, xAI and DeepSeek. Which one answers a given reply depends on your plan, on the model you pick in Settings, and on which are reachable at the time, because an unavailable model falls back to another provider. Every request refuses any host that would keep or train on what we send it, and excludes hosts we have decided not to send customer content to.
• Weekly summary emails: on paid plans, a summary of your recent runs is sent to an AI model, through OpenRouter, to write the email.
• Learning your app: when Tada explores an app you connect, it sends the page title, headings, button and field labels and short visible lines to an outside service that reads the words on each screen and answers a fixed set of questions about it, such as whether the screen is a sign-in page and whether we managed to sign in. That is how Tada knows where it is. On a signed-in screen those words can include your own data. We send no page code, no cookies, no screenshots and no web address query strings. The service writes nothing and returns a short answer; it does not train on what we send it, and it passes it to no one else. Ask us and we will tell you which company it is.
• Narration: the text of your captions is sent to ElevenLabs to generate the voice-over. If you record your own voice, your recording is also sent to ElevenLabs, which makes a synthetic copy of your voice that narrates your demos. When you delete your voice in Settings or close your account, we delete that copy at ElevenLabs.

These services process your content to deliver the feature you are using. We do not use your content to train AI models.

How Tada learns your app

When you connect a repository, Tada learns the app by itself, so it can write and run checks without being asked each time. Give it a staging, test or preview environment: that is the one it works on. This is what that involves.

• It reads your repository through the GitHub connection you granted, to work out which screens exist and how they link up.
• It opens your app in our browser and walks it like a visitor: following links, reading each screen, and looking for the sign-in page first. It never submits a sign-in form with a login you did not give us.
• Where you have given Tada a way in, it signs in and walks the screens behind it, so the checks it writes cover the app your users actually see.
• On an environment whose name says it is not live, such as staging, test or preview, Tada may press buttons, fill forms and save, because that is what checking a feature means. On any other environment, using a login you gave us, Tada only looks and presses nothing.
• Tada never signs itself up for your app. When it cannot get in, it stops and asks you for a way in.
• Where you switch it on for an environment, Tada creates its own test users through your app's own invite screen, so it can check what a real team member sees. Their names end in “(Tada)”, their email addresses are at residents.taada.fyi, and you can remove them like any other user.
• It does this again when your app changes, and it stops once it knows the app.

You can ask us to stop at any time, and we will switch learning off for your workspace.

How we share your data

We share data only in these circumstances:

• Service providers: companies that process data on our behalf to operate Tada. Railway hosts our servers and runners. Supabase runs our database and sign-in. Cloudflare stores videos and screenshots and provides temporary tunnels. Stripe handles payments. Loops sends our emails. PostHog provides product analytics. Jam provides in-app bug reporting: its script runs on the Tada app and records the browser console and network activity of that page, and a report reaches us only when someone starts a recording and submits it. OpenRouter and the AI model providers it uses, ElevenLabs, and the screen-reading service in the list above power the AI and voice features described there.
• Services you connect: when you connect GitHub, Slack or a deployment provider such as Railway, we exchange data with that service to run your checks and report results, for example posting a check on a pull request or a message to a Slack channel. That service's own terms cover how it uses your data.
• Legal obligations: we may disclose data if required by law, subpoena, or court order, or to protect our rights, safety, or property.

We do not sell your personal data or share it with data brokers or advertisers.

Data security

All data is transmitted over HTTPS/TLS. Access to stored videos is granted only through short-lived signed URLs. Test account passwords and the tokens for services you connect are stored encrypted. We follow industry-standard security practices, including access controls and secure infrastructure.

Data retention

On a paid plan we keep your demos indefinitely. On the free plan we may stop serving a demo after 30 days.

You can delete a demo at any time, which removes its video, poster, and comments. If you delete your account, we delete the associated data within 30 days, except where retention is required by law.

Your rights

You have the right to:

• Access the personal data we hold about you.
• Correct inaccurate or incomplete data.
• Delete your demos and your account.
• Export your data in a portable format.

To exercise any of these rights, contact us at [email protected].

Cookies

We use essential cookies and local browser storage for authentication, sessions, and the anonymous view-counting identifier described above. We do not use advertising or cross-site tracking cookies.

Product analytics

We use PostHog to understand how Tada is used: which pages are visited, which actions are taken, and where errors occur. When you create an account, this analytics is part of the service and is tied to your account. On our public pages we only enable it if you accept the cookie banner, and you can change that choice at any time from the footer.

Our documentation pages are the exception. We run no analytics on them, set no analytics cookie there, and show you no banner, so you can read them without being counted or asked anything.

Shared watch links work differently. If you open one without being signed in, PostHog counts the visit, a click on the Tada logo, and any error that stops the video from playing. It does this without cookies and without storing anything in your browser. It tells visits apart with a privacy-preserving hash computed on its servers, and none of it is linked to an account.

When Rivet or a weekly summary uses an AI model, PostHog records which model answered, how many tokens it used, what it cost, how long it took, and whether it failed. It does not record the text of your messages or of the replies.

International data transfers

Tada is hosted in the United States. If you access Tada from outside the US, your data will be transferred to and processed in the United States. By using Tada, you consent to this transfer.

Children's privacy

Tada is not intended for anyone under 13. We do not knowingly collect personal data from children. If you believe a child has provided us data, contact us and we will delete it promptly.

Changes to this policy

We may update this Privacy Policy from time to time. When we make material changes, we will update the date above and, where appropriate, notify you. Continued use of Tada after changes constitutes acceptance.

Contact

Tada is operated by Modulab LLC. Questions about this policy? Reach us at [email protected].