Privacy Policy

1. Who we are

Tidbit ("Tidbit", "we", "us", or "our") operates the Tidbit LLM gateway and optimization service available at usetidbit.ai (the "Service"). This Privacy Policy explains what information we collect, how we use it, and the choices you have.

The legal entity that controls your personal information is Neueway Creations LLC, a Delaware limited liability company, c/o its registered agent Business Filings Incorporated, 108 West 13th Street, Wilmington, Delaware 19801. For privacy questions you can reach us at the contact details at the end of this policy.

The Service is currently offered as an invite-only beta. This policy applies to visitors to our website and to users of the Service during the beta.

2. Information we collect

Account and contact information. When you request access, accept an invitation, or contact us, we collect your name, work email address, company name, and any details you choose to include in your message.

Authentication data. When you sign in, we process identity information from your login (for example, your user identifier, email, and the role/tenant you belong to) in order to establish and maintain your session.

Usage and gateway metadata. As you route requests through the gateway, we collect operational metadata needed to provide the Service and report savings: timestamps, request and token counts, model identifiers, cache-hit statistics, cost and savings figures, API-key identifiers, and error/diagnostic events. We aim to collect metrics and aggregates rather than the substance of your prompts and completions.

Technical data. We collect standard technical information such as IP address, browser and device type, and log data generated when you use the website or Service.

3. How the Service works on your device

Tidbit optimizes your Claude traffic on the device where you install it. The installer runs a small Tidbit program (a "local daemon") in your own user account and points your Claude client at it, by writing two settings into your Claude configuration file (~/.claude/settings.json): a proxy address, which is the daemon on your own machine, and the path to a certificate file. It does not add anything to your operating system’s trust store, does not add or change hosts-file entries, does not set up a system-wide proxy, and does not modify Claude or any other app.

The certificate authority the daemon uses is a file inside your own user directory, readable only by your account. It is trusted by your Claude client alone, because that client is told to trust it by the setting above; nothing else on your machine trusts it, and no other application or user is affected. It is also name-constrained: it can only ever be used for anthropic.com, claude.ai and claude.com, and their subdomains, and is cryptographically incapable of impersonating any other website.

The daemon decrypts, and forwards to the Tidbit gateway, only the requests your Claude client sends to anthropic.com and claude.ai, and their subdomains. The TLS connection is terminated by the daemon on your own machine, and the request is then sent to the gateway over a fresh encrypted connection, where Tidbit processes the full content of the request and response in memory to inspect and rewrite it for token savings before forwarding it on to Anthropic. By default this in-memory processing leaves nothing behind: we do not retain the content of your requests or responses at rest (see "Data retention schedule").

Connections to every other destination are passed straight through the daemon as raw, still-encrypted traffic and go directly to the site the client asked for. The daemon does not decrypt them, we do not receive them, and they do not reach the Tidbit gateway. Because the proxy setting is inherited by programs your Claude client starts, some of those connections do travel through the daemon, which is a process on your own device, on their way out; being passed through is not the same as being read, and only the two domains named above are decrypted.

The daemon also checks for updates every six hours against a public download URL, and it does this whether automatic updates are on or off. With updates off, nothing is installed and nothing is downloaded except the signed manifest listing the current version, and you are told a patch exists rather than having it applied. The check is an unauthenticated request for a public file: it sends no account, device, or usage information, though as with any web request our servers see the IP address it comes from.

You can remove the daemon, the certificate file, and the two Claude settings at any time using the installer’s uninstall command.

4. Support reports and debug capture you enable

The gateway does not passively store the content of your traffic. There are three exceptions, and each requires an act by you: sending a support report, turning on debug capture for your own account, and marking an individual API request for debug capture.

Support report: when you send us one, the app packages a single request/response exchange, redacted to remove credentials, secrets, and identifiers, together with the note you write and your contact details, so we can diagnose the specific issue you are reporting. Support reports are opt-in and per-incident: nothing is submitted unless you choose to send it. We use them only to investigate and resolve your issue, retain them only as long as needed for that purpose, and you can ask us to provide a copy of, or delete, a support report you submitted by contacting us at nibble@usetidbit.ai.

Debug capture: if you turn on debug mode for your own account (for example, running `tidbit debug on`), the gateway records your full request and response bodies for that account, including system prompts, messages, and tool schemas, verbatim up to 256KB per body, and uploads them to a segregated store we use only to diagnose issues and improve the Service. This covers all of your traffic while debug is on, regardless of which API key or scope it passes through, because the capture is attributed to your account, not to a key. Debug capture is off by default, overrides any zero-data-retention setting on your account for as long as it stays on, and stops the moment you turn it off (`tidbit debug off`). Captures are deleted automatically after 30 days, and you can ask us to delete one sooner at nibble@usetidbit.ai.

Per-request debug capture: if you call the API directly, you can mark an individual request for debug capture by sending the `x-tidbit-debug` header on it. That request and its response are stored the same way, under the same redaction, retention and deletion rules as debug capture above, and attributed to the API key you sent it with. Only requests you send the header on are captured; we honour the header only when the request also carries a valid API key of yours, so no one can mark someone else’s traffic. Note that whoever sends the request decides: if you share an API key with others, anyone sending that header on a request made with the shared key is consenting for the traffic on that request.

5. Notice at Collection (California residents)

This section is our "notice at collection" under the California Consumer Privacy Act, as amended by the CPRA. It lists the categories of personal information we collect, the sources, the business or commercial purposes for which each category is used, and the retention period for each category. We collect the categories below from you when you register, join the waitlist, accept an invitation, contact us, or use the Service, and automatically from your device and your use of the Service. Additional detail on retention is in the "Data retention schedule" section below.

Identifiers: work email address, first and last name, phone number and country, IP address and user agent, referral codes, and Stripe customer and subscription identifiers. Sources: directly from you (registration, waitlist, invitation, contact form, profile) and automatically from your use of the Service (IP, user agent, logs). Purposes: create, secure, and operate your account; authenticate you; route and optimize your requests; communicate with you; detect and prevent fraud and abuse; and comply with law. Retention: for the life of your account, except IP address and user agent, which are retained as security and fraud-prevention records (see the retention schedule below).

Paired device records: for each machine you pair, a device identifier we generate, the device public key, the name you give the device, an optional fleet label your administrator can group devices under, the operating system and Tidbit client version the machine reports, the times it was paired and last connected, and the time it was revoked if it has been. Sources: created when you pair a machine, and reported by the Tidbit client on that machine when it renews its credential. Purposes: authenticate the machine, show you your paired devices so you can revoke one, and count which client versions are in use so we can support and fix them. Retention: revoking a device stops it working immediately and marks the record revoked; the record is deleted when you delete your account, subject to the 30-day window described in the retention schedule below. You can see and revoke every paired device in the Console under Devices.

Commercial information: plan, subscription and billing status, and usage and savings metering (tokens, models, cost: metadata, not the content of your prompts). Sources: your use of the Service and our payments provider. Purposes: provide the Service, calculate usage and savings, billing, and reporting. Retention: for the life of the account and as needed for financial, audit, and legal records.

Internet or other network activity: request and token counts, timestamps, cache-hit statistics, model identifiers, API-key identifiers, and error and diagnostic events generated as you route requests through the gateway; and, on our production website, usage data collected by Google Analytics (pages viewed, referring page, device and browser type, approximate location derived from IP address). Sources: automatically from your use of the Service and of our website. Purposes: operate and secure the Service, calculate savings, diagnose problems, and understand and improve how the website is used. Retention: as described in the retention schedule below.

Professional or employment-related information: company or organization name and a coarse team-size bucket. Sources: directly from you at registration or on the waitlist. Purposes: provision your organization, tailor the Service, and communicate with you. Retention: for the life of the tenant.

Sensitive personal information: account log-in credentials, consisting of your password and any two-factor authentication (2FA) secret you configure. Sources: directly from you. Purposes: solely to authenticate you and secure your account. Retention: for the life of your account. See the "Sensitive personal information" section below.

Customer content: content you or your organization causes us to store instead of processing in memory and discarding, in four cases. A support report you send us: a single redacted request/response exchange plus your note. Debug capture you turn on for your own account: the full content of that account’s traffic, verbatim, for as long as it stays on. An individual request you mark for debug capture with the `x-tidbit-debug` header: that request and its response, attributed to the API key used. Traffic Sampling, only if an administrator of your organization enables it: a redacted, capped fraction of the requests and responses routed through the keys selected. Sources: your own opt-in actions (support report, debug capture, per-request header), and, for Traffic Sampling, your organization’s active sampling consent. Purposes: diagnose the issue you reported (support report); diagnose and improve the Service (debug capture and per-request capture); improve optimization quality and build internal benchmarks in aggregate (Traffic Sampling). Retention: a support report, as long as needed to resolve your issue; debug capture and per-request capture, 30 days; traffic samples, a hard maximum of 30 days. See "Support reports and debug capture you enable", "Optional traffic sampling", and the Traffic Sampling Addendum.

We collect the categories above to provide and secure the Service, and not for cross-context behavioral advertising. We do not sell or share your personal information (see "Do Not Sell or Share" below). Where a category is used for more than one purpose, all applicable purposes above apply.

6. Sensitive personal information

The only sensitive personal information we collect is your account log-in credentials: your password and, if you enable it, your two-factor authentication (2FA) secret, which are sensitive personal information under CCPA section 1798.140(ae)(1)(D). Passwords are stored only in hashed form and 2FA secrets are stored only to verify your second factor.

We use this sensitive personal information only for the purposes permitted by CCPA section 1798.121(a) and its regulations, namely to provide the Service you request, to authenticate you, and to maintain the security and integrity of your account. We do not use or disclose it to infer characteristics about you or for any purpose that would require us to offer a "Limit the Use of My Sensitive Personal Information" choice, so we do not post that link.

7. How we use your information

We use the information we collect to: provide, operate, and secure the Service; authenticate users and enforce access controls; route and optimize requests to upstream model providers; calculate usage, savings, and billing; communicate with you about your account, support requests, and product updates; and to detect, prevent, and investigate abuse, fraud, and security incidents.

We process this information because it is necessary to provide the Service you have requested, to pursue our legitimate interests in operating and improving the Service, and to comply with our legal obligations.

8. Cookies, sessions, and authentication

We use strictly necessary cookies to keep you signed in and to maintain the security of your session. These include an HttpOnly session cookie set after you authenticate. Without these cookies the authenticated parts of the Service cannot function.

Our production website (usetidbit.ai) uses Google Analytics (GA4), loaded via Google’s gtag.js script, to understand and improve how the site is used. Analytics are off by default and run only if you allow them in our cookie notice: we use Google Consent Mode, so no analytics cookies are set and no usage data is sent to Google until you choose to allow it. When you allow it, it sets first-party analytics cookies (named _ga and _ga_*) on your device and sends usage measurements (pages viewed, referring page, device and browser type, approximate location derived from IP address) to Google LLC, which processes that data on our behalf as our service provider and is listed on our Subprocessors page. We do not use Google Analytics for advertising.

We do not use third-party advertising or cross-site tracking cookies. Our Cookie Policy lists each cookie we set, its purpose and duration, and how to control cookies, including the analytics cookies, through your browser.

9. Do Not Track and Global Privacy Control

Some browsers offer a "Do Not Track" (DNT) signal, and some offer a Global Privacy Control (GPC) signal, that tell websites you do not want to be tracked. There is no common industry standard for how to interpret a DNT signal, so, like most operators, we do not respond to DNT signals differently.

We do not track you across third-party websites and we do not sell or share your personal information; the Google Analytics measurement described in "Cookies, sessions, and authentication" above covers the use of our own site only. Because we do not sell or share personal information, a GPC signal has no sale-or-sharing to opt you out of and has no additional effect on the Service. You can control the analytics cookies themselves as described in our Cookie Policy.

10. Third-party subprocessors and disclosure

To operate the Service we share limited information with service providers who process it on our behalf. Because Tidbit is an LLM gateway, the requests you send are forwarded to the upstream model provider you target. Our current and expected subprocessors include: Anthropic, PBC (the Claude model provider your requests are routed to); Google Cloud Platform (cloud hosting, compute, managed databases, and object storage); Google LLC (Google Analytics, website usage measurement for our production site); Amazon Web Services (SES v2, our transactional and product email provider); and Stripe, Inc. (payments, checkout, and billing portal; card data is held by Stripe and never touches our systems). We publish the full, current list (with each subprocessor’s purpose, the data it processes, and its region) on our Subprocessors page, and we describe how we notify customers of changes to it there. Business customers who route personal data through the Service are also offered our Data Processing Addendum.

We may disclose information if required to do so by law, to enforce our agreements, or to protect the rights, safety, and security of Tidbit, our users, or the public.

When you route a request to a model provider, that provider processes the request under its own terms and privacy policy. You are responsible for ensuring your use of upstream providers complies with their terms.

11. Do Not Sell or Share

We do not sell your personal information, and we do not "share" it for cross-context behavioral advertising, as those terms are defined under the CCPA/CPRA. We have not sold or shared personal information in the preceding 12 months. There is no advertising in the Service, and Google Analytics processes website usage data on our behalf as a service provider, not for advertising, so no "Do Not Sell or Share My Personal Information" link is required or posted.

We do not knowingly sell or share the personal information of consumers under 16 years of age.

12. Your California privacy rights (CCPA/CPRA)

If you are a California resident, the California Consumer Privacy Act, as amended by the CPRA, gives you the rights described below over the personal information we collect about you. The categories of personal information we collect, the sources, the purposes, and the retention periods for each are set out in the "Notice at Collection (California residents)" section above; this section describes the rights you can exercise and how to exercise them, and does not repeat that inventory.

Right to know and access. You may request that we disclose the categories and specific pieces of personal information we have collected about you, the categories of sources, the business or commercial purposes for collecting it, and the categories of third parties and service providers with whom we disclose it.

Right to delete. You may request that we delete personal information we collected from you, subject to the exceptions permitted by law (for example, to complete a transaction, provide the Service you requested, maintain security, or comply with a legal obligation).

Right to correct. You may request that we correct inaccurate personal information we maintain about you.

Right to opt out of sale or sharing. You have the right to opt out of the "sale" or "sharing" (cross-context behavioral advertising) of your personal information. As explained in "Do Not Sell or Share" above, we do not sell or share your personal information, so there is nothing to opt out of and we post no "Do Not Sell or Share My Personal Information" link. This right is therefore inapplicable by practice, but we disclose it here for completeness.

Right to limit the use of sensitive personal information. You have the right to limit the use and disclosure of your sensitive personal information to what is necessary to provide the Service. As explained in "Sensitive personal information" above, the only sensitive personal information we collect is your account log-in credentials, which we use solely to authenticate you and secure your account, and never to infer characteristics about you. Because we do not use or disclose it beyond that permitted purpose, this right is inapplicable by practice and we post no "Limit the Use of My Sensitive Personal Information" link.

Twelve-month look-back. When you exercise your right to know, you may request the information covering the twelve-month period preceding your request.

How to submit a verifiable consumer request. You can submit a request to know, delete, or correct by emailing us at nibble@usetidbit.ai. For your protection we must verify your identity before we act on such a request. We do this by asking you to confirm the email address on file and, where appropriate, additional information that matches what we already hold, so that we can reasonably verify that you are the person about whom we collected the information. We will use information you provide for verification only to verify your identity and for no other purpose, and we will not disclose specific pieces of personal information where we cannot verify your identity to the degree of certainty the law requires.

Authorized agents. You may use an authorized agent to submit a request on your behalf. We may require the agent to provide proof that you gave them signed permission to act for you, and we may require you to verify your own identity directly with us or to confirm that you authorized the agent to act on your behalf.

Response timelines. We will confirm receipt of your request within ten (10) business days and will respond to a verifiable consumer request within forty-five (45) days. If we need more time, we will inform you and may take up to a total of ninety (90) days, as permitted by law.

Non-discrimination. We will not discriminate against you for exercising any of these rights. We will not deny you the Service, charge you a different price, or provide you a different level or quality of service because you exercised your California privacy rights.

13. European users (GDPR / UK GDPR)

If you are in the European Economic Area, the United Kingdom, or Switzerland, the EU General Data Protection Regulation (and the UK GDPR) gives you the rights and protections described in this section. For these purposes, Neueway Creations LLC (see "Who we are") is the controller of the personal data described in this policy; you can reach us at nibble@usetidbit.ai.

Lawful bases. We process your personal data on the following bases: performance of a contract, where processing is necessary to provide the Service you have requested and to manage your account; our legitimate interests in operating, securing, improving, and marketing the Service, provided those interests are not overridden by your rights (for example, to prevent fraud and abuse, to keep the Service secure, and to understand and improve how it performs); compliance with a legal obligation, where the law requires us to process or retain data; and your consent, where we ask for it (for example, the optional Traffic Sampling program), which you can withdraw at any time without affecting processing already carried out.

Your rights. You have the rights of access, rectification, erasure, restriction of processing, data portability, and objection (including objection to processing based on legitimate interests and, were we ever to do it, to direct marketing), and the right not to be subject to solely automated decisions producing legal or similarly significant effects (we make no such decisions). These rights parallel the California rights described in "Your California privacy rights (CCPA/CPRA)" above (the right of access mirrors the right to know, rectification mirrors correction, and erasure mirrors deletion), and you exercise them the same way: by emailing nibble@usetidbit.ai, after which we verify your identity as described in that section and respond within the time the law allows (generally one month under the GDPR, extendable for complex requests). Where we rely on consent, you may withdraw it at any time.

International transfers. We are based in the United States and use the subprocessors listed on our Subprocessors page, so your personal data is transferred to and processed in the United States and potentially other countries. Where we transfer personal data out of the EEA, the UK, or Switzerland, we rely on an appropriate safeguard, principally the European Commission’s Standard Contractual Clauses (and the UK International Data Transfer Addendum for UK data), together with supplementary measures where needed. Business customers can enter our Data Processing Addendum, which incorporates those clauses; see the "International transfers" section of the DPA.

Complaints. You have the right to lodge a complaint with your local data protection supervisory authority (in the UK, the Information Commissioner’s Office; in the EEA, the authority in your country of residence or work). We would appreciate the chance to address your concern first, so please consider contacting us at nibble@usetidbit.ai before you do.

14. Optional traffic sampling

Separately from the operational metadata above, Tidbit offers an optional Traffic Sampling program. It is opt-in only and off by default. If an authorized administrator of your organization enables it, a small, customer-chosen fraction (capped at 5%) of requests and responses through the keys you select is captured, redacted before storage (credentials, secrets, and identifiers removed), stored separately from your account and credentials, retained for a limited period, and used only in aggregate to improve optimization and build benchmarks: never sold, never shared beyond our subprocessors, and never used to train models. You can revoke consent and delete your stored samples at any time. The program is governed by the Traffic Sampling Addendum.

15. Data retention schedule

We keep each category of personal information for the period described below, or for the shorter of that period and the time reasonably necessary for the purpose it was collected for. When a period ends, we delete the information or aggregate or de-identify it so that it no longer identifies you.

Deleting an account or an organization takes effect immediately and is reversible for 30 days. Access stops at once: the account can no longer sign in, its API keys stop working, and its paired devices stop being issued credentials. The underlying records are marked deleted and held for 30 days, during which the account can be restored to exactly the state it was in, and are then permanently erased by an automatic daily sweep. If you need the records erased sooner than 30 days, contact us at nibble@usetidbit.ai.

Account and contact information (name, email, phone, company): for the life of your account, then the 30-day window above. Some account records are retained after that as needed for security, dispute resolution, and legal compliance.

Account credentials and 2FA secrets: for the life of your account; deleted when the account is deleted.

Usage and gateway metadata (token/request counts, models, cost, cache statistics, savings): retained to deliver reporting, billing, security, and audit functions for the life of your account, and after your account is closed generally no longer than 24 months, except where longer retention is required for tax, accounting, or legal-compliance purposes.

Authentication events (IP address and user agent captured at sign-up and login): these are personal information retained for security and fraud-prevention purposes for up to 24 months, after which they are deleted or de-identified.

Audit and consent records (including terms and sampling-consent acceptance): retained as legal and compliance records for as long as needed to evidence consent and to comply with law.

Waitlist and contact-form submissions: retained until we conclude the relevant beta or waitlist process, then deleted, unless we still need them to respond to you, and in any event no longer than 24 months.

Optional traffic samples: a hard maximum of 30 days from capture, then automatically deleted (see the Traffic Sampling Addendum).

Prompt and response content. By default, hosted customer accounts run in zero-data-retention (ZDR) mode: we do not retain the content of your requests or responses at rest: content is processed in memory to serve the request and to compute usage metrics, then discarded. The transient content store described next is OFF by default and applies ONLY if you explicitly enable a reversible content-offload optimization for your account: in that case the gateway may briefly retain the full content of a request (encrypted) in order to reconstruct content an optimization step would otherwise discard, for up to 7 days, after which it is deleted.

Session cookies: for the duration of your session. Google Analytics cookies on the production website: up to about two years (see the Cookie Policy).

We will retain and use information as necessary to comply with our legal obligations, resolve disputes, and enforce our agreements, even after the periods above, where the law requires or permits it.

16. Data security

We use technical and organizational measures designed to protect your information, including encryption in transit, role-based access controls, and hard tenant isolation so that one customer cannot access another customer’s data. API secrets are shown once at creation and stored only in hashed form. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

For a plain-language overview of our security practices, see Trust & Security.

17. Your rights and choices

Depending on your location, you may have the right to access, correct, export, or delete your personal information, and to object to or restrict certain processing. You can exercise these rights, or ask questions about this policy, by contacting us at nibble@usetidbit.ai. We will respond consistent with applicable law.

You may opt out of non-essential product emails at any time. Essential account, security, and transactional messages will continue while your account is active.

18. Children's privacy

The Service is intended for business use and is not directed to individuals under the age of 16. We do not knowingly collect personal information from children.

19. International transfers

We operate on cloud infrastructure that may process and store information in countries other than the one in which you reside. Where required, we rely on appropriate safeguards for such transfers.

20. Changes to this policy

We may update this Privacy Policy from time to time. When we make material changes we will revise the "Last updated" date above and, where appropriate, notify you. Your continued use of the Service after an update constitutes acceptance of the revised policy.

21. Contact us

If you have questions or requests regarding this Privacy Policy or your personal information, contact us at nibble@usetidbit.ai.