TuttiFrutti

This is a translation for your convenience. The Spanish version is the binding one and prevails in case of any difference.

Privacy policy

Draft of 8 November 2026 · Applies to https://tuttifrutti.app and https://tuttifrutti.fly.dev

Draft pending review by a lawyer. It describes how TuttiFrutti works today, but it isn't final: the details marked [LIKE THIS] are missing and the “To confirm” boxes must be reviewed before it's published as the final version.

1. Who processes your data

The controller of your personal data at TuttiFrutti is:

For any question about your data, write to us at mindrapeofficial@gmail.com.

Whether a data protection officer (DPO) must be appointed under art. 34 of the LOPDGDD and art. 37 of the GDPR. At the current volume probably not, but processing AI conversations at scale could change that.

2. In a few words

3. What data we process, why, on what basis and for how long

Data Why Legal basis (GDPR) How long
Account: email, password stored only as an Argon2 fingerprint (it can't be read), sign-up date, whether the email is confirmed, plan, credit balance, the language of your emails and whether the account is disabled. Creating your account, letting you sign in and providing the service you sign up for. Performance of the contract (art. 6.1.b). As long as you have the account. When you ask for it to be deleted, it's erased except what we must keep blocked by law (art. 32 LOPDGDD).
Sign in with Google: the email Google confirms to us as verified. We only ask Google for your email, not your name or photo. Creating your account or signing in without a password. Performance of the contract (art. 6.1.b). Like the account data.
TuttiFrutti's connectors: which of our own tools (Pitaya, Kiwi, Social Banana, Mango Code, Cherry Craft, images, video and voice) you turned on or off, and when. So the chat's AI only uses the tools you allow. Performance of the contract (art. 6.1.b). While you have the account.
Google Drive, only if you connect it: the permission Google gives us (an access token, kept encrypted on our server and never in your browser), the email of the connected Google account, the permission granted (drive.file), the “TuttiFrutti” folder we create in your Drive and a log of each action (connecting, saving or attaching a file, with its name, the date and whether it worked; the last 200). The content of your files isn't kept on our server: it only passes through it while you save it to Drive or attach it to a chat. Saving the replies and creations you choose to your Drive (always after you confirm) and attaching files from your Drive to the chat. With the drive.file permission we only see the files TuttiFrutti saved there, never the rest of your Drive. Performance of the contract (art. 6.1.b), at your request. Until you disconnect it or delete the account: then we withdraw the permission at Google and delete it. What you saved to your Drive stays there; it's yours.
Guest account: when you open the website without an account we give you an anonymous trial account (with a fictitious email ending in @guest.invalid), with its session and its usage. Letting you try TuttiFrutti (10 TuttiFrutti Pro messages) without signing up. Pre-contractual steps at your request (art. 6.1.b). Deleted automatically after 30 days if you don't sign up, it has no credits and no open session (checked daily). If you sign up, it becomes your account.
Sessions and keys: a random code that identifies you when you sign in, or your API key. The server only keeps its fingerprint (hash), not the code. Keeping you signed in to your account. Performance of the contract (art. 6.1.b). Sessions: 30 days or until you sign out. API keys: until they're changed or the account is deleted; for the keys you create on "Developers · API" we also keep their name, their first characters and when they were created and used, and revoked ones are kept that way, unusable, to show you what they spent.
Email links: to confirm your email or choose a new password. We only keep their fingerprint. Confirming the email is yours and recovering access. Performance of the contract (art. 6.1.b). Confirmation: 48 hours. New password: 1 hour. Deleted when used or when they expire.
Your messages and the replies, including what you write or paste in the chat and the text of the files you attach. Generating the reply. Each message sends the conversation up to that point, so the AI has the context. Performance of the contract (art. 6.1.b). Our server doesn't keep them. They stay in your browser until you delete them. Each AI provider keeps them according to its terms (section 5).
Usage log: for each message, date, model, input and output tokens, cost, charge and whether it was free; and how many free messages you've used each day. Deducting credits, applying your plan's limits, sharing free messages fairly and detecting abuse. Performance of the contract (art. 6.1.b) and legitimate interest in preventing abuse (art. 6.1.f). 24 months. The oldest records are deleted every day.
Payments: your Stripe customer ID, your subscriptions (status and plan), credit purchases (amount, credits and refunds), paid invoices (plan and credits given) and what you accepted when paying (the box for the terms and for the immediate start of the service). Card details are collected and kept by Stripe alone. Charging, giving the credits of each payment, sending you the purchase confirmation, handling refunds and withdrawals, and meeting accounting and tax obligations. Performance of the contract (art. 6.1.b) and legal obligation (art. 6.1.c). 6 years from the end of the financial year (art. 30 of the Spanish Commercial Code), and the applicable tax periods. They're kept even if you delete your account, without your email.
Security: your IP address. We use it in memory to limit attempts (for example, 10 failed sign-ins every 15 minutes, 5 guest accounts a day per address) and send it to Cloudflare Turnstile to check you're a person. It isn't stored in the database. Protecting accounts and the service against bots, brute force and abuse. Legitimate interest in the security of the service (art. 6.1.f and recital 49). Only in memory, for the window of each limit (from 15 minutes to 24 hours).
Server technical logs: your account's internal number, the model, tokens and cost of each message, and payment and sign-in events. Never the content of your messages. Running the service, investigating errors and reconciling charges. Legitimate interest (art. 6.1.f). Our hosting provider's log retention period.
Emails we send you: your address and the relevant link. Confirming your email, recovering your password and confirming each purchase. We don't send advertising. Performance of the contract (art. 6.1.b). Kept by the sending service according to its terms.
Whatever you write to us if you contact us. Answering you and handling your rights. Performance of the contract or legitimate interest (art. 6.1.b and f); legal obligation for rights requests (art. 6.1.c). As long as needed to resolve it and, afterwards, the limitation periods for possible claims.

Whether the 24-month period for the usage log is appropriate, and the retention period of Fly.io's logs and of the disk backups (volume snapshots).

4. Your messages and the AI providers

TuttiFrutti has no AI models of its own. When you send a message, our server forwards it, along with that chat's earlier conversation, to one of these providers, and returns their reply to you:

You don't know in advance which of them answers each message; under each reply we tell you which model wrote it. That's why we ask you not to write health data, passwords, bank details or other people's data in the chat that you don't want these providers to receive. More details on the AI transparency page.

We don't use your conversations to train models (we don't keep them). What each provider does with them is set by its API terms.

For each AI provider: whether it keeps the requests, for how long, and whether it may use them to train or improve its models under the current API terms of Groq, Cloudflare, DeepSeek, OpenRouter and OpenAI. State it here provider by provider. At OpenAI, the API doesn't use data for training by default, but keeps it for a while to monitor abuse (confirm the current period). At OpenRouter, confirm exactly what data_collection: deny guarantees (that the company running the model doesn't keep or use the messages) and which countries those companies are in.

5. Who receives your data

We don't sell or hand over your data. Only the providers we need to deliver the service receive it, under data processing agreements (art. 28 GDPR) or, when they act on their own behalf, as independent controllers:

Provider What it does Data it receives Where
Fly.io, Inc. (USA) Hosting: the server and database run on a machine in Paris. All account, usage and payment data; the traffic of your messages. EU (Paris). US company.
Groq, Inc. (USA) Answers with AI (free model). Your messages and that chat's conversation. USA.
Cloudflare, Inc. (USA) Answers with AI (Workers AI: free model, images and reading aloud) and the Turnstile captcha. AI: your messages, the image description or the text being read. Captcha: your IP and technical browser data. USA and its global network.
DeepSeek (Hangzhou DeepSeek Artificial Intelligence Co., Ltd., China) Answers with AI (TuttiFrutti Pro, API models and, when the others run out, the free one). Your messages and that chat's conversation. China.
OpenRouter, Inc. (USA) Chat backup when DeepSeek can't answer: sends the message to one of the companies running the same DeepSeek model, only among those that don't keep messages. Your messages and that chat's conversation. USA and the countries of the company running the model.
OpenAI (OpenAI, L.L.C., USA, or its European subsidiary) Backup for the chat (GPT-5 mini and GPT-5 nano) and for images and reading aloud. Your messages and that chat's conversation; the image description or the text being read. USA.
Stripe (Stripe Payments Europe, Ltd., Ireland; Stripe, Inc., USA) Charges, subscriptions, invoices and customer portal. To prevent fraud and meet its legal obligations it acts as an independent controller. Your email, your payment details, your IP and the payment data. EU and USA.
Resend (USA) Sending the confirmation and new-password emails. Your email and the content of the message. Sent from Ireland (EU). US company.
Google (Google Ireland Ltd.; Google LLC, USA) “Sign in with Google” and the Google Drive connector, only if you choose them. Google acts as an independent controller of your Google account and your Drive. Your Google account and your IP, on its sign-in page. It only gives us your email. EU and USA.

We may also disclose data to authorities and courts when the law requires us to.

TuttiFrutti's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. We don't use the files in your Drive for advertising or to train AI models, and nobody at TuttiFrutti reads them.

That a data processing agreement (DPA) has been accepted with Fly.io, Groq, Cloudflare, DeepSeek, OpenRouter, OpenAI and Resend, and the exact legal name of Resend, of the DeepSeek entity that signs the API terms and of the OpenAI entity the API is contracted with (the US one or its Irish subsidiary).

6. International transfers

Some providers are outside the European Economic Area or belong to companies based outside it. We only transfer data with the safeguards of chapter V of the GDPR:

Provider by provider: whether it has joined the EU-US Data Privacy Framework (check the official list at dataprivacyframework.gov) and, if not, whether its DPA includes standard contractual clauses. Priority: Groq, OpenRouter, Resend and Fly.io.

OpenRouter sends each message to another company (the one running the model), which is its sub-processor. Check its list of sub-processors, which countries they're in and that its DPA covers those onward transfers.

DeepSeek is the highest-risk point. Check whether its API terms offer standard contractual clauses and carry out a transfer impact assessment, bearing in mind the actions of European authorities regarding DeepSeek. If there are not enough safeguards, consider using the same DeepSeek models through a provider with servers in the EU or the USA, or asking for explicit consent under art. 49.1.a only as a last resort.

7. Automated decisions

We don't make decisions with legal effects on you based solely on automated processing, and we don't profile. The automatic limits (daily free messages, sign-in attempts, captcha) only apply the rules of the service equally to everyone.

8. Minimum age

You must be at least 14 years old to use TuttiFrutti (art. 7 of the LOPDGDD). If you're under 14, don't use it: if we detect an account belonging to someone under 14 we'll delete it. To subscribe to a paid plan or buy credits you must be of legal age or have your parents' or guardians' permission.

9. Your rights

You can ask us at any time for:

You can exercise two of them yourself in the app, from Your account → Your data:

For everything else, write to us at mindrapeofficial@gmail.com from your account's email, so we can check it's you. We'll answer within one month at most (extendable by two more months in complex cases, letting you know). It's free.

Your conversations are only in your browser: signing out of your account or deleting it removes them from it, and you can also delete them with “Clear everything” in Settings or by clearing the site's data in your browser.

If you think we haven't handled your data properly, you can complain to the Spanish Data Protection Agency (AEPD), C/ Jorge Juan 6, 28001 Madrid, www.aepd.es. We'd appreciate it if you wrote to us first so we can try to resolve it.

10. Security

All communication is encrypted (HTTPS). Passwords are stored with Argon2, and sessions, API keys and email links only as a cryptographic fingerprint. The Google Drive permission is kept encrypted (XChaCha20-Poly1305) with a key only the server has, and never reaches your browser. We limit access attempts and use a captcha at sign-up, for guest accounts and when asking for a new password. If there were a security breach affecting your data, we would notify the AEPD and, where appropriate, you.

11. Changes to this policy

If we change this policy significantly (for example, when keeping chat history on the server or adding a provider), we'll let you know in the app or by email before the change applies.