This is a translation for your convenience. The Spanish version is the binding one and prevails in case of any difference.

Cookies and storage in your browser

Draft of 7 November 2026

Draft pending review by a lawyer. It describes how TuttiFrutti works today, but it isn't final: the “To confirm” boxes must be reviewed before it's published as the final version.

1. In a few words

TuttiFrutti sets no cookies of its own.
We don't use analytics, advertising or tracking cookies or tools, our own or third parties'.
We store in your browser (in its “local storage”) only what the app needs to work: your session, your conversations and the model you chose.
Some third-party services you use at your request (the captcha, payment, signing in with Google) use their own cookies on their pages.

2. What TuttiFrutti stores in your browser

The app uses the browser's local storage (localStorage) of tuttifrutti.app. Unlike cookies, it isn't sent to our server by itself: it stays on your device.

Name	What it stores	Why	How long
`tf.key.v1`	Your session code (or your API key, if you sign in with one).	Keeping you signed in to your account or your guest account.	Until you sign out. The session expires on the server after 30 days.
`tf.library`	Your conversations (titles, messages, replies, the text of the files you attach and which model wrote each reply) and your collections.	So you see your chats when you come back. Today they aren't kept on our server.	Until you delete them, sign out or use “Clear everything” in Settings.
`tf.chats.v1`	Your conversations, in the format of earlier versions of the app.	Moving them to the new format the first time you open the app; then it's deleted.	Until that first start.
`tf.model.v1`	The last model you chose.	Remembering your choice.	Until you change it or clear the site's data.
`tf.settings`	Your settings, such as the light or dark theme and the language.	Remembering what you choose.	Until you change them or clear the site's data.
`tf.notices`	The app's notices (payments, email confirmation, your account) and whether you've read them. At most the last 30.	Showing you the bell's notices.	Until you clear the site's data.
`tf.welcomed`	That this browser has already seen the welcome.	Not showing you the welcome every time.	Until you clear the site's data.

Anyone using your browser can see these conversations. On a shared computer, sign out and clear the site's data when you finish.

3. Third-party services

Service	When it's used	What it does in your browser
Cloudflare Turnstile (captcha), from challenges.cloudflare.com	When the guest account is created on your first visit, when you sign up and when you ask for a new password.	Checks that you're a person and not a program. It may use its own storage for that check; according to Cloudflare, it doesn't use it for tracking or advertising. See Cloudflare's privacy policy.
Stripe, at checkout.stripe.com and billing.stripe.com	Only when you pay or manage your subscription: the app takes you to Stripe's pages.	Stripe sets its own cookies on its pages to process the payment and prevent fraud. See Stripe's cookie policy.
Google, at accounts.google.com	Only if you choose “Sign in with Google”.	Google uses its cookies on its sign-in page. See Google's privacy policy.

The app's fonts are served from our own server: opening TuttiFrutti doesn't contact Google or other third parties, except the captcha when it's needed.

4. Why don't we show you a cookie banner?

Art. 22.2 of the Spanish LSSI requires asking for your consent before storing or reading information on your device (with cookies or any other technique, such as local storage), except when it's strictly necessary to provide a service you've expressly asked for. According to the AEPD's Guide on the use of cookies, that exception covers, among others, the user's session, the content the user enters, the preferences they choose and security.

Everything TuttiFrutti stores falls within that exception:

tf.key.v1 is your session: without it you couldn't use your account.
tf.library (and tf.chats.v1, from earlier versions) is the content you write, kept so you can see it.
tf.model.v1 and tf.settings are preferences you choose.
tf.notices and tf.welcomed are the state of the interface itself (notices and welcome), with no identifiers or tracking.
The Turnstile captcha serves the security of sign-up and of the service.
Stripe's and Google's cookies are set on their own pages, when you decide to pay or sign in with Google, and are their responsibility.

As there's no analytics, advertising or tracking at all, there's no need to ask for consent or show a banner. We do have to inform you, and that's what this page, linked from the app, is for.

If one day we add analytics, advertising pixels or other non-essential tools, we'll ask your permission first with a notice that lets you accept or refuse just as easily, and we'll update this page.

That tf.notices and tf.welcomed, which the person doesn't expressly choose, also fall within the exception as part of how the interface works.

That the exception covers the use of Turnstile on the first visit (the guest account is created automatically when the website opens, without the visitor expressly asking for it) and that the AEPD's criterion for local storage is the same as for cookies.

5. How to delete this data

You can delete everything TuttiFrutti stores in your browser from its settings (for example, in Chrome: Settings → Privacy and security → Site data; in Safari: Settings → Safari → Advanced → Website Data). If you do, you'll be signed out and lose the conversations kept in that browser.