Privacy policy
Last updated 17 September 2026.
tondi turns long videos into short clips on your own Mac. Your video is never uploaded, so for the part of tondi that most people worry about, there is simply no data to collect. The only personal information we ever hold is what an account needs: your email address and whether your subscription is active.
The short version. Your video, its audio, the transcript and the finished clips stay on your Mac, and are never uploaded anywhere. The app makes three kinds of outbound connection, all described below: it downloads its transcription model once, it checks once a day whether a newer version of tondi exists, and — only if you create an account — it checks your subscription. None of them carries any of your content.
Who is responsible
tondi is made by Alex Gosselin, a sole proprietor based in Ontario, Canada. For any privacy question, or to exercise any of the rights described below, email support@tondi.app.
What happens on your Mac
When you drop a video into tondi, everything happens locally:
- The audio is transcribed on your machine.
- Highlights are chosen by a scoring system running on your machine. It is not a language model and it does not call any service.
- Clips are rendered on your machine and written to the folder you chose.
- Your settings and clip History live in
~/Library/Application Support/tondi/.
None of this is transmitted anywhere. Uninstalling tondi and deleting that
folder removes everything the app has stored on your Mac, with one
exception: if you have signed in, your session token lives in the macOS
Keychain rather than in that folder. Signing out before you uninstall
removes it; so does deleting the app.tondi.session item in
Keychain Access.
The connections the app makes
The first time you run tondi, it downloads an open-source speech-recognition model of about 460 MB from Hugging Face, which hosts it. This happens once. As with any download, Hugging Face can see your IP address and the fact that a file was requested. No information about you, your video or your use of tondi is sent.
tondi also checks whether a newer version of itself exists. Once a day it requests a small file from tondi.app listing the current version. That request carries no information about you — not your email, not whether you have an account, not what you have been doing in the app. As with any web request, our host can see your IP address and that a file was asked for.
Updates are not installed without asking you. When one is available, tondi tells you and you choose whether to install it. There is one exception, and it is worth stating plainly: if a release ever has to be withdrawn urgently — a security problem, or a bug serious enough that continuing to use that version would harm your work — we can mark a version as the minimum, and copies older than it will stop making clips until they are updated. This is not used for ordinary releases, and it cannot be triggered by anyone but us: the instruction is cryptographically signed, and tondi ignores an unsigned one.
If you never create an account, the model download and this update check are the only connections tondi makes. It does not otherwise need the internet.
If you create an account
Accounts exist so a tondi Pro subscription can follow you between Macs. Making clips does not require one.
When you sign in, tondi sends your email address to tondi.app so we can email you a six-digit sign-in code. There is no password. Once signed in, the app holds a session token in your Mac's Keychain, and periodically asks tondi.app one question: whether this account is on Free or Pro. That check sends the token and, from version 1.1.4, two numbers: how many clips and how many videos this Mac has made with tondi, as running totals. That is the whole of it — not the videos, not the clips, not their names, lengths or transcripts, not what you were doing in the app. We use the two numbers to see whether tondi is being used. Nothing is sent if you are not signed in.
The answer is stored on your Mac and stays valid for up to seven days, so tondi keeps working while you are offline or travelling. Signing out deletes the token from your Keychain and the stored answer from your Mac.
If you subscribe, payment is handled entirely by Stripe on Stripe's own checkout page in your browser, and Stripe is the merchant of record for the sale. Card details never pass through tondi or through our server, and we never see or store your card number. Because Stripe is the seller, it collects your name and billing address — it needs them to work out the right tax — and it sends your receipts and invoices to you directly. We keep your email address, your subscription status and the dates it runs between. You can delete your account at any time by emailing support@tondi.app.
If you join the Windows waitlist
tondi.app has a box where you can leave your email address to hear when tondi is available for Windows. We keep that address for one purpose: to send you one email when it ships. It is not added to any other list, not used for anything else, and not shared. Email support@tondi.app to be taken off at any time; the address is then marked as removed and is never emailed.
Analytics
tondi contains no analytics and no crash reporting. The one usage figure it sends is the clip count described above — two whole numbers, sent with the sign-in check, only when you are signed in.
That is about the app on your Mac. The website counts page views — see This website below. The two are separate, and nothing about your videos, transcripts or clips is involved in either.
This was not true of earlier versions, and it matters enough to say directly. Versions up to and including 1.0.1 were built on a UI framework that reported anonymous usage information to its own vendor at every launch. That reporting covered the framework's own use, not your video or your clips, and it was never something tondi intended to send. It was removed in 1.0.2, released 10 August 2026. If you are running an older build, updating stops it.
This website
tondi.app is a set of static files hosted on Cloudflare Pages, and downloads are served from Cloudflare R2. There is no advertising on this site and there are no tracking pixels.
The site counts page views, using Cloudflare Web Analytics. It records which page was viewed, along with the sort of thing your browser sends to any website anyway: the site that linked you here, your browser and your country.
It also counts clicks on the download button: a running total per day and per version, kept in our own database. That is the whole record — nothing about who clicked is stored with it.
It stores nothing at all in your browser — no cookies, no local storage — so it cannot recognise you on a second visit or follow you to another site. Cloudflare discards your IP address at the data centre that receives it, rather than keeping it. There is no profile of you and nothing that identifies you. We use it for one thing: knowing whether anybody is finding tondi.
Cloudflare acts as our host and delivery network, and in doing so processes standard request information such as your IP address, the time of the request and your browser's user-agent string, in order to serve the page and protect against abuse.
The only JavaScript on this site is the page-view counter described above — one small script from Cloudflare, on every page. Nothing else here runs JavaScript, including the account pages; the remaining scripts are structured-data blocks, which describe the page to search engines and do not execute.
There are no tracking cookies. One cookie is set, and only
if you sign in at /account/: a session cookie that
keeps you signed in. It holds a random token, nothing about you, and it is
marked HttpOnly so no script can read it. Signing out revokes
it immediately. Cloudflare could also issue a cookie if it ever needed to
show you a security challenge — during an attack, say — but that does not
happen in normal browsing.
Who else is involved
| Who | Why | What they can see |
|---|---|---|
| Cloudflare | Hosts the website, the download and the account database | Request data: IP address, user-agent, what was requested |
| Hugging Face | Hosts the speech-recognition model the app downloads once | IP address at the moment of that download |
| Resend | Sends sign-in code emails | Your email address and the code sent to it |
| Stripe | Takes payment, if you subscribe | Your email, billing address and card details — the card is theirs alone, we never see it |
Resend is only involved if you create an account, and Stripe only if you pay. Neither is contacted otherwise.
That is the complete list. No third party receives your video, your audio, your transcripts or your clips, because none of those ever leave your Mac.
Accounts
You can use tondi without an account. If you make one, here is everything it holds:
- Your email address. That is the entire profile — there is no name, no password, no phone number.
- Sign-in codes, stored only as a one-way hash, expiring after 10 minutes and usable once.
- A token per signed-in device, also stored only as a hash, so a copy of our database would not let anyone sign in as you.
- Two numbers per signed-in device: how many clips and how many videos that Mac has made (app 1.1.4 and later).
There are no passwords, because we never wanted to be responsible for one. Signing out revokes that device immediately. Ask us to delete your account and everything above goes with it.
Payments
Paid subscriptions are handled entirely by Stripe. Card details never reach tondi — payment happens on Stripe's own hosted page, and we never see, receive or store a card number.
What we store against your account is a Stripe customer reference, your subscription status and its renewal date — enough to answer "is this person a subscriber?" and nothing more. Stripe collects a billing address at checkout, which is required for sales tax and stays with Stripe.
How long we keep it
Almost everything tondi touches is on your Mac, and we cannot delete or retain what we never receive. What follows is only about the account.
- Sign-in codes stop working after 10 minutes and can only be used once. The record that a code was issued is removed with the account.
- Device sessions expire on their own — after 30 days for a browser signed in at tondi.app, and 180 days for the app, which holds its token in the Keychain. Signing out ends one immediately.
- Your account — your email address and subscription status — is kept while you are using tondi, and deleted after 24 months without a sign-in. You can ask us to delete it sooner at any time.
- The Windows waitlist is kept until the one email it exists for has been sent, and deleted within 30 days after that — or marked removed immediately if you ask.
- Rate-limiting counters, which exist only to stop someone hammering the sign-in endpoint, are short-lived and hold no more than an email address or an IP address for the length of their window.
Records of payments are Stripe's, not ours, because Stripe is the merchant of record. Stripe keeps them for as long as its own tax and accounting obligations require, and deleting your tondi account does not remove them.
Where your data is held
tondi is run from Ontario, Canada. The services it depends on are based in the United States: Cloudflare hosts the website, the downloads and the account database; Stripe takes payment; Resend sends sign-in code emails; and Hugging Face hosts the speech model the app downloads once.
So if you are in the UK or the EU, the small amount of personal information an account involves — your email address, and the fact of a subscription — is processed outside your country, both in Canada and in the United States. Each of those providers is engaged under its own standard data processing terms, which cover international transfers. Canada is recognised by the European Commission as providing an adequate level of protection for personal data handled by commercial organisations.
Your video, audio, transcripts and clips are not part of this, because they never leave your Mac and are never sent to any of them.
Children
tondi is not directed at children under 13, and we do not knowingly collect information from them.
Your rights
Depending on where you live, you may have the right to ask what personal information is held about you, to have it corrected, or to have it deleted — including under Canada's PIPEDA and, in the UK and EU, the GDPR.
Those rights, named plainly, are: to access what we hold, to have it corrected, to have it erased, to receive it in a portable form, and to object to or restrict how it is used. There is no automated decision-making and no profiling.
In practice tondi holds almost nothing: the app stores your files only on your own Mac, and the website keeps no visitor records of its own. If you believe we hold something about you, email support@tondi.app and we will respond within 30 days, free of charge.
If you are unhappy with the response: in the UK you may complain to the Information Commissioner's Office; in the EU, to the supervisory authority of the country you live in; and in Canada, to the Office of the Privacy Commissioner. You do not have to go through us first.
Changes to this policy
If this policy changes in a way that affects what data is collected, the date at the top will change and the change will be described here. Material changes will be made before, not after, the feature they describe ships.