Privacy

What we collect

Tara is Tahoe's service that lets AI agents query Tahoe's public datasets. This policy covers the service at tara.tahoebio.io, run by Tahoe Therapeutics Inc, 490 Forbes Boulevard, Suite 3B, South San Francisco, CA 94080 (Tahoe).

When you sign in. You sign in through Amazon Cognito, with a Google account or with an email address and password. From the sign-in we receive and store your email address, whether it is verified, your name if the provider gives one, which provider you used, and your account identifier at Cognito. From your email address we derive its domain and an affiliation class (academic, government, non-profit, commercial or individual). That class is a best-effort guess, not a determination. We do not receive your password from Google, and we do not store it.

For each tool call we record: a pseudonymous account identifier (a keyed hash of your Cognito account identifier, not your name or email address), the tool you called, all the arguments you sent (including any SQL you wrote for run_sql, recorded as you wrote it apart from recognised secrets), the optional intent note and the model name you told us, your client's name and version, your client's User-Agent (up to 200 characters), when the call happened, how long it took, and whether it succeeded. For the result we record only its shape (row counts, size, whether it was truncated), not the data we return. We also record refusals, and usage counts and rate-limit state against your pseudonymous identifier.

If you choose to send feedback with the send_feedback tool, we record the text and the optional labels you provide with your pseudonymous identifier.

We automatically remove recognised secrets (for example API keys and tokens) from these records, and nothing else. Other secrets, and anything personal or confidential you put in an argument, an intent note, a SQL statement or feedback, may be recorded, so do not paste credentials into queries. Databricks, which runs the queries, keeps its own query history, including the SQL text.

Server logs. We do not turn on web-server access logging. The web server's error and operational logs may include IP addresses.

Why we collect it

• Signing you in and keeping you signed in.
• Deciding whether you can use the tools: an account needs a verified email address.
• Enforcing per-account limits, pausing the service when needed, and preventing abuse.
• Understanding how the tools are used, to improve the service and the data we serve. We may publish aggregate, de-identified usage statistics.
• Support, and diagnosing errors.

Who processes it

• Amazon Web Services hosts the service and its sign-in, and Amazon Cognito manages sign-in and holds your account.
• Google, if you sign in with it, handles that authentication under its own privacy policy.
• Databricks runs the read-only queries over Tahoe's data. Queries are tagged with three values (app, mcp_tool and release), none of which is your identity.
• Datadog receives the service's logs, which contain the records described above.
• Hugging Face is where the public Tahoe-100M dataset is published. It is a data source only; we send it none of your information.

Your readable sign-in profile is kept in a separate store that only the service can read. Call logs carry only the pseudonymous identifier.

How long we keep it

• Your sign-in profile is kept while your account exists, and is deleted within 45 days of a verified deletion request.
• Call logs and feedback are kept in Datadog's log index for 15 days.
• The web server's error and operational logs stay on the host, and no retention limit is configured for them.

Your choices

You can ask us to delete your account by writing to tara@tahoebio.ai. We acknowledge a request within 7 days and complete a verified request within 45 calendar days. If the law permits an extension, we will explain it to you within those 45 days. Where the law sets a shorter deadline, that deadline applies.

A verified request deletes your Cognito account and your stored sign-in profile. We keep your Cognito account identifier in a deletion list, permanently, so the account cannot be admitted again, and a deletion record in our logs that carries only your pseudonymous identifier. Call records and feedback in Datadog are not deleted on request: they expire under the retention above. Operational logs are not deleted on request.

You can stop using the service at any time by disconnecting it in your AI client.

Calling send_feedback is optional, and nothing else you do requires it.

We do not sell your data

We do not sell your personal information.

Children

Tara is for people aged 18 or over, and is not directed at children.

Changes to this policy

If we change what we collect or why, we will update this page. Continued use after a change means you accept the updated policy.

Contact

Tahoe Therapeutics Inc, 490 Forbes Boulevard, Suite 3B, South San Francisco, CA 94080.

Privacy, terms and deletion requests: tara@tahoebio.ai.