Your data stays on your device.

Last updated 28 July 2026

Tito is a privacy-first AI assistant. The AI runs entirely on your phone, there is no account, and by default nothing you say or write ever leaves the device. This policy explains that in full, and names the few things that touch the network.

The short version

Your conversations, memory, and any text Tito reads are stored only on your device.
The AI model runs locally. Your prompts are never sent to a server to be answered.
There is no account, no sign-in, and no usage tracking or analytics.
Only two features ever send your content off the device, and both are off until you turn them on.

What stays on your device

Everything you create in Tito lives in a private database on your phone: your conversations, the general memory Tito builds about your preferences, the text extracted from documents and photos you attach, and any skills, agents, or notebooks you make. This database is marked so it is excluded from iCloud and cloud backups, so your content does not leave the device that way either.

Any secrets you enter, such as a web-search API key or a connected account token, are kept in the system keychain, not in the app's database.

What uses the network, and only then

A few things need the internet. We separate them into features that send your content, which are always opt-in, and infrastructure, which never sends your conversations.

Optional features you turn on

Web search. Off by default. When you switch it on for a message, only your search query is sent to the search provider you choose, never your conversation history. A clear indicator shows when it is active.
Connected documents. If you choose to connect an external document service, Tito accesses only what you ask it to, when you ask. This is off until you set it up.

When a feature is on, the content it sends goes to the provider you selected, under that provider's own privacy terms. Turn the feature off and nothing further is sent.

Infrastructure

These connections keep the app working but never carry your conversations:

Model downloads. On first launch you download an AI model from a public model host. This is a normal file download; your content is not part of it.
Model catalog. The app fetches a signed list of available models from our servers. It contains no personal data.
Purchases. The one-time Tito Pro purchase is processed through Apple and validated through our payments provider, RevenueCat. To confirm your purchase, RevenueCat receives the purchase transaction and an anonymous identifier. It does not receive your conversations, your name, or your content. See RevenueCat's privacy terms for details.

What Tito does not do

No account or sign-in to use the app.
No usage analytics, no behavioral tracking, no advertising identifiers.
No selling or sharing of personal information. There is nothing to sell, because your content stays with you.

Diagnostic logs, if you generate them, are kept on your device and are yours to export or delete. Any crash reporting is opt-in.

Children

Tito is not directed to children under 13, and we do not knowingly collect personal information from them. Because the app requires no account and collects no personal data on our servers, there is no such data for us to hold.

Changes to this policy

If we change this policy, we will update the date above and post the new version here. Meaningful changes will be reflected in an app update.

Contact

Questions about privacy? Email [email protected].