Privacy Policy
Taho is a mobile-first API testing and security auditing application for Android, developed and operated by Vivek Sagar ("Taho", "we", "us"). This policy explains what data Taho handles, where it is stored, and the choices you have.
Taho was designed to be local-first: your API requests, history, collections, environments, and credentials live on your device, not on our servers. We collect the minimum data needed to provide accounts and paid subscriptions.
1. Summary
- On-device only: requests, response history, collections, environments, settings, profile details (display name, username, avatar), scheduled monitors, and AI assistant keys.
- Server-side: your account email/password (authentication) and your subscription entitlement flag — hosted on Supabase.
- Payments: processed by Dodo Payments. Card and billing details go directly to Dodo Payments' checkout; they never pass through the app.
- No analytics, no advertising IDs, no crash-telemetry SDKs.
2. Data we process
2.1 Account data (stored server-side)
If you create an account, we process your email address and password for authentication. Authentication is handled by Supabase (Supabase Auth, email/password sign-in). Your password is stored only as a modern salted hash by Supabase — never in plain text, and never visible to us. Your email is also used to identify your subscription and, if you choose, to contact you about your account.
2.2 Profile data (stored on-device)
Your display name, username, and avatar image are stored locally in the app on your device. The display name you enter at sign-up is kept with your account record in Supabase Auth so it can be restored when you sign back in. Avatars are copied into the app's private storage on your device and are never uploaded.
2.3 App content (stored on-device)
- Requests, collections, history, environments, settings are saved locally using Android SharedPreferences.
- Credentials attached to requests and environments (auth tokens, Authorization headers, API keys, cookies, marked-secret variables) are additionally moved into the Android Keystore-backed secure storage so they are not kept in plain preferences.
- Taho does not upload, sync, or mirror any of this content to us.
2.4 Subscription data
Paid plans are processed by Dodo Payments. When you start a checkout, your account email and display name are passed (via a Supabase Edge Function that protects our API keys) to Dodo Payments to create your checkout session. Payment card data is entered on Dodo Payments' page under their privacy policy; it never reaches us.
To know whether you have Pro access, we store a minimal entitlement record in Supabase Postgres: your user ID, plan type (monthly/annual), Dodo subscription ID, and billing-period end. The app also caches this status locally so Pro features work offline for up to 24 hours between server confirmations.
2.5 AI assistant keys (bring-your-own)
The optional AI assistant uses your own API key for Google Gemini or any OpenAI-compatible provider. Keys are stored only in the device's secure storage. Requests are made directly from your device to the provider endpoint you configured (for example Google's Generative Language API or api.openai.com). There is no Taho server proxy for AI traffic: we never see your key or the prompts/responses exchanged with the provider. Your use of those providers is additionally governed by their own terms and privacy policies.
2.6 Network activity inherent to the app
Taho's purpose is sending HTTP requests to servers you choose. When you send a request or run a monitor, the target server receives whatever the request contains (URL, headers, body, credentials) and sees your device's network identity (such as your IP address). We do not intercept, log, or store this traffic anywhere other than the local history on your device.
2.7 Backups
Backups are .taho files you export yourself. Exports are sanitized: auth tokens, secret environment values, sensitive headers, and response bodies are stripped before the file is created. You decide where these files go (share sheet, cloud drive, email). Importing a backup reads a file you pick from your device.
2.8 What we do NOT collect
- No analytics or product-usage telemetry.
- No crash-reporting SDKs.
- No advertising identifiers, trackers, or fingerprinting.
- No location data, contacts, photos, microphone, or camera access.
3. Android permissions
| Permission | Why |
|---|---|
INTERNET | To send the HTTP/WebSocket requests you create, reach Supabase (auth/entitlement) and Dodo Payments (checkout/billing portal), and call your chosen AI provider. |
POST_NOTIFICATIONS | To show locally-generated alerts from your scheduled monitors (Android 13+). |
4. Third parties
| Provider | Role | Data involved |
|---|---|---|
| Supabase (supabase.com) | Authentication, entitlement database, Edge Function proxy for payment APIs | Email, hashed password, user ID, plan type, subscription ID, period end |
| Dodo Payments (dodopayments.com) | Payment processing, subscription management, customer portal | Email, name, and payment details you enter at checkout |
| Your AI provider (e.g., Google, OpenAI, Groq, OpenRouter, or a local endpoint) | AI assistant responses (BYOK) | Your API key and the prompt content you send — direct from your device |
| Servers you test | The app's core purpose | Whatever your request contains |
We do not sell personal data, and we do not share it with anyone else.
5. Data retention and deletion
- Local data: kept until you delete it. Use Settings → Clear All Data inside the app to wipe all locally stored content (requests, history, collections, environments, cached keys, monitors, profile). Uninstalling the app also removes all on-device data.
- Account: email us at sagarvivek141@gmail.com from your account address and we will delete your account and associated server records (profile metadata and entitlement rows). Requests are typically handled within 30 days.
- Payments: transaction and billing records held by Dodo Payments are retained by them as required by their policies and applicable law (e.g., tax/accounting rules).
6. Security
- Passwords are handled exclusively by Supabase Auth and stored as hashes.
- Credentials in the app are kept in Keystore-backed secure storage rather than plain preferences.
- Entitlement changes are applied server-side by signed webhooks; the app cannot forge them.
- Backups strip secrets by design, and imported backups cannot re-enable security-relevant settings such as certificate-validation bypasses.
- No data-broker integrations, no third-party SDKs beyond those listed in §4.
No method of transmission or storage is perfectly secure; please use strong, unique passwords and only point Taho at systems you are authorized to test.
7. Your rights (GDPR, DPDP Act, and similar)
Depending on where you live, you may have the right to access, correct, export, restrict, or delete your personal data, to withdraw consent, and to lodge a complaint with a supervisory authority. Because almost all Taho data is already on your device, you can exercise most of these rights yourself (view, edit, export, or clear data in-app). For anything stored server-side (account email/profile record, entitlement row), contact us at sagarvivek141@gmail.com.
8. Children's privacy
Taho is a professional developer tool and is not directed at children under 13 (or the equivalent minimum age in your jurisdiction, such as under 18 without parental consent under some interpretations of India's DPDP Act). We do not knowingly collect personal data from children. If you believe a child has created an account, contact us and we will delete it.
9. International transfers
Your account and entitlement data may be processed in regions where Supabase and Dodo Payments operate, which may differ from your country. Where required, appropriate safeguards (such as contractual clauses) apply to those transfers.
10. Changes to this policy
If we make material changes, we will update the effective date above and, for significant changes, notify you in the app or by email. Continued use after an update means you accept the revised policy.
11. Contact
Vivek Sagar
Email: sagarvivek141@gmail.com