Where you run it decides what we hold.
Tileward runs in three places: our hosted API, your own cloud account, or a machine with no route out. In two of those three we never receive your data at all, which changes this document more than any clause in it. The rest of this page is about the first one.
Who we are, and what this covers.
Tileward, Inc. is a company incorporated in the United States. You can reach us about anything on this page at hello@tileward.com.
This policy covers three separate things, and they are not equally sensitive: this website, the hosted service at api.tileward.com and app.tileward.com, and software you run yourself. It does not cover what your own users do with an assistant you have built on top of us — for them, you are the one with a privacy policy to write.
Two of the three deployment modes send us nothing.
This is not a privacy posture we adopted afterwards; it is how the product is built. A model compressed to a single GPU is a model you can run where your data already lives, and if you do, there is no request to us to make a privacy question out of.
| How you run it | What reaches Tileward | Our role |
|---|---|---|
| Hosted API api.tileward.com | Prompts, completions, whatever Context has stored for you, and the audit record of each guard decision. | Processor for that content. Controller for your account and billing data. |
| Your VPC | Nothing of the content. The model, the context store and the audit records all live in your cloud account. If you are on committed-use billing, an aggregate usage count — seats, tokens, tiles active, no content — as described below. | Controller for account and licensing data only. |
| On-prem, air-gapped | Nothing. There is no network path from the deployment to us. | Controller for account and licensing data only. |
If you are filling in a vendor questionnaire and the honest answer to "where is our data processed" is "on our own hardware", say that. It is the right answer, and it is the reason the compression work exists.
The server makes exactly one kind of outbound call: to Stripe, for billing. There is no telemetry, no usage beacon and no call-home beyond that. An air-gapped deployment reports nothing to us, ever.
Committed-use Enterprise billing is the one exception: it reports an aggregate count, not a log. Four numbers, rolled up for the billing period — seats active, tokens sent, tokens received from the model, and the number of tiles actively used since the last report — with no prompt, completion or document content in it, no tile names or configuration, and no way to reconstruct any of that from it.
{
"period_start": "2026-07-01",
"period_end": "2026-07-31",
"seats_active": 14,
"tokens_sent": 4820193,
"tokens_received": 1902744,
"tiles_active": 6
}
That is the whole payload. No account identifier beyond whatever the billing connection already carries, no tile names, no user identifiers, no request or session ids — six numbers and a date range.
What we hold if you use our API.
Account data
Your name, work email, company, plan, and the API keys issued to you. We are the controller for this. API keys are stored as SHA-256 hashes, never in plaintext. We keep a short non-secret prefix alongside so you can tell keys apart in the console, and authentication works by hashing what you send and comparing — we cannot recover a key, and neither can anyone who reads the database. OAuth access tokens and authorisation codes are stored the same way, and codes are single-use.
Content you send
Prompts and completions through /v1; the conversation turns and documents Context stores for you; the text of each message the guard classifies. You are the controller for all of it and we act on your instructions.
Audit records
One record per guard decision, allowed or refused: time, tenant and seat, the tile matched, the policy version, the verdict, how the match was made, and whether the model was invoked at all.
Billing
Payments are handled by a third-party payment processor. Payments are handled by Stripe. Card details are entered on Stripe’s own hosted pages and never reach our servers; what we store is the brand and last four digits Stripe returns, so you can see which card is on file.
Audit records are the awkward category
They exist to be kept. That is their whole function: a record you can hand an auditor showing what was refused, when, and on what basis. But they are also a log of what people asked, and a deletion request that empties them destroys the thing the customer bought.
The audit record stores no message text. Each row holds a timestamp, the account and key that made the call, the action, the session id, and a small detail object — the client name and user-agent, and for an upload the file name and chunk count. Prompts and completions are not written to it.
How long each thing stays.
The audit window is a product feature, priced by tier, so the numbers below are set by the pricing table on the home page rather than by this policy. If one changes, both change.
| Plan | Audit records | Everything else |
|---|---|---|
| Explore (free) | 7 days | See below |
| Build | 30 days | See below |
| Pro | 30 days | See below |
| Team | 1 year | See below |
| Enterprise, self-hosted | Kept locally, by you | Not applicable — we hold none of it |
Stored context. What Context holds for you stays until you delete it or close the account. Closing the account deletes it immediately — no grace period, no retention window. The purge is a single transaction and leaves no tombstone. See account deletion below for the full picture, including tiles and audit records.
Prompts and completions in transit. Tileward Context does retain conversation content, because that is the product: the distilled state of a conversation is stored against its session so it can be recalled on a later turn, along with the documents you upload and their titles. That is what you are buying. What is not kept is a separate log of raw requests and responses beyond serving them.
No. Not ever, not for any model.
We do not use your prompts, your stored context, your documents or your audit records to train, fine-tune or evaluate a model — ours or anyone else's. No carve-out for "aggregate" or "de-identified" use, no opt-in buried in a settings page, nothing.
This isn't a promise bolted onto the business; it's a description of what the business is. Tileward compresses and governs models other people trained — we take a model that already exists and make it small enough to run on hardware you control, then enforce a policy on top of it. We are not in the business of building or improving models, so there is no use for your data in that direction and no plan to create one.
Who else sees it.
We use a small number of service providers to run the hosted service and this website. They are listed, with what each one is for, on the sub-processor page — including the rows we have not filled in yet.
We do not sell personal data, and we do not share it for advertising. We disclose data to a public authority only where we are legally required to, and where the law permits it, we notify the customer first, before the disclosure happens.
Where it goes, and what you can ask for.
International transfers. There aren't any. Tileward, Inc. is based in the United States only, and no server outside the US hosts the hosted service or holds customer data, for any plan. If that changes, this paragraph changes with it, on the same day.
Access, correction, deletion. Write to hello@tileward.com and we will get back to you within 5 business days. If you reached us through a company that uses Tileward, we will pass the request to them — they hold the relationship with you, not us. Depending on what you are asking for, we may need to verify it is really you before acting on it — typically a one-time code sent to the email on file, or a code from an authenticator app if you have one set up.
Portability. A portable copy of what Context holds for you is provided as JSON-LD: a conversation and its documents are a graph of linked turns and references, not a table, and flattening that into CSV would throw away the structure that makes it useful. We do not offer a CSV export of Context data for this reason.
Account deletion. Takes effect immediately, in one transaction, with no grace period: the account is marked deleted, API keys are revoked and live sessions end; any tiles created privately for you are deleted; and everything Tileward Context holds for the account is deleted. None of that is recoverable after the request completes. Audit records are the one thing not touched by account deletion — they are not sped up or held back by it, they simply keep running out the same per-plan retention window shown above, whether the account is open or closed, and age out on that schedule automatically.
Children. Tileward is not intended for use by children, regardless of how you reach it. The hosted API and Enterprise deployments are typically procured by an organisation, but Context and the MCP surface can be used directly by an individual — that use is for adults building on the service, not for children, and we do not knowingly collect data from them. We also do not collect anything that would let us verify a user's age in the first place, so this is a statement of intent, not something enforced by an age check at signup.
What tileward.com itself does.
Worth separating from the product, because it is much less than people assume.
The site sets no cookies and loads no third-party analytics script. It does record which buttons get clicked, and it sends that to its own server on this domain, not to any analytics vendor. Each record is one line: which button, where it pointed, the first sixty characters of the label on it, which page you were on, and the time. There is no identifier in it — no cookie, no account, no device or session ID, and neither your IP address nor your browser version is read or stored — so two clicks cannot be joined into a person or a visit. It is a tally of which buttons work, and it cannot be anything else. Records age out after 90 days. If any of that changes, this paragraph changes on the same day and will say what it changed to.
Requests are served through Cloudflare, which necessarily sees the IP address of the connection in order to route it. See the sub-processor page.
If this page changes.
If we make a material change to this policy, every account holder gets an email about it within 72 hours of the change. No separate opt-in required, and no relying on a quiet edit to this page being enough.
Questions about any of this: hello@tileward.com.