TutuHai ("we" or "us") is the instant-messaging product of the Tutu suite. We take your privacy seriously. This policy explains how we collect, use, store, and protect your personal information when you use TutuHai. By using this service, you agree to this policy.
1. Information We Collect
To provide our instant-messaging service, we collect:
- Account information: the email address, password (stored encrypted with Argon2, which we cannot reverse to plaintext), nickname, and avatar you provide when registering or signing in. When you sign in with Tutu ID (tutuid), we create your account solely based on your unified account identifier.
- Messages and content: the text, images, files, and other message content you send, along with the associated conversation and the time it was sent.
- Media files: the images and files you upload, used to send, receive, and display within conversations.
- Technical information: essential logs such as login device, IP address, and timestamps, used for security protection and anomaly detection.
2. Messages & Storage
TutuHai is a message-oriented, persistent instant-messaging service: messages follow a "persist-first, then broadcast" model — each message you send is safely written to the database before being delivered in real time, so crashes, disconnections, and switching devices will not cause message loss, and message history can always be retrieved. This means your messages are stored long-term on our servers until you or the other party deletes them, or you close your account.
3. How We Use Information
- To provide and maintain our instant-messaging and live customer-support services, and to enable real-time synchronization across devices.
- For account authentication, session management, and security protection (such as brute-force prevention and anomalous-login detection).
- To comply with applicable laws and regulations and content-compliance requirements.
We do not use your chat content for advertising profiling, and we do not sell your personal information to unrelated third parties.
4. Data Retention & Deletion
- Messages: retained long-term to support history viewing and multi-device synchronization; you may delete your own messages.
- Account closure: you may request to close your account. After closure, the account enters a soft-deleted state and is permanently hard-deleted after 30 days (in line with data minimization and the "right to be forgotten").
- Orphaned-media cleanup: a background cleanup task periodically reclaims orphaned media files no longer referenced by any message, to avoid redundant retention.
5. Your Rights
You have the right to access, correct, and delete your personal information, and you may close your account at any time. Changing your password or signing out of all devices will invalidate existing login tokens. To exercise these rights, you can act within the app or contact us using the methods below.
6. Third-Party Services
- Tutu ID (tutuid): if you choose to sign in with your Tutu account, authentication is provided by tutuid and is subject to its privacy policy.
- Anonymous analytics: we use our own analytics service (tutustat) to collect anonymous page-view counts to improve the product, without any identifiable chat content.
- Mini-programs: third-party mini-programs run in an isolated sandbox; your login credentials never enter a mini-program, and a mini-program can only obtain the capabilities you grant it item by item.
7. Security Measures
We protect your data using encrypted password storage (Argon2), JWT session tokens, transport encryption, and least-privilege principles. However, please note that transmission over the internet cannot be guaranteed to be absolutely secure, so please keep your account and password safe.
8. Contact Us
If you have any questions about this privacy policy or your personal information, please contact us via live customer support or the official channels of the Tutu suite. This policy may be updated from time to time, and material changes will be announced on this page.