Privacy policy — Tulbelt

Summary

Tulbelt collects nothing. Its settings stay in your browser.
Tulbelt Plus reads your Tulip data with your own session and keeps it in your browser. When you use an AI assistant, your chat and the context it needs go to the AI provider you chose, with your own key; record values never do. Once a day, it sends Locus Operational Technology usage counts for licensing, never content.
Nobody sells your data, uses it for advertising, or uses it to decide credit.

Tulbelt (free)

Tulbelt is the open-source extension of quality-of-life toggles, published by Daniel Pomeranz under the MIT license.

It keeps one thing: which toggles you've turned on, in the browser's extension storage on your computer. It has no account, no analytics and no telemetry, and makes no network requests of its own. Its toggles change how Tulip's pages look and behave in your browser; what they read from Tulip stays there.

Tulbelt Plus

Tulbelt Plus is made by Locus Operational Technology ("Locus"). This section covers all three of its editions: Tulbelt Plus, Tulbelt Plus (Builders Only) and Tulbelt Plus (Dashboards+ Only). An edition without a builder doesn't send what only that builder sends.

What stays in your browser

Kept in the browser's extension storage, on your computer, and never exposed to Tulip pages:

your settings and which features are on;
your AI provider keys, the models you added and any private AI server address;
a random ID for this browser installation and the last license answer;
the name and email you last entered on the support form;
dashboard view-time totals that haven't been sent yet.

The Tulip data the extension reads (tables, records, apps) is fetched with your own Tulip session and shown in your browser. Dashboards draw it in a sandboxed frame on your computer. It doesn't pass through Locus or any AI provider.

What's saved in your Tulip instance

Dashboards, datasets, WidgetLab + projects and Tultalk + projects (the documentation generated from your app exports, your notes and plans) are saved in a table in your own Tulip instance (the "home table"), with your Tulip session, so others on the instance can open them. They stay under your organization's control in Tulip; Locus can't see them.

What goes to your AI provider

When you use an assistant in Dashboards +, WidgetLab + or Tultalk +, the extension sends the provider you chose (OpenRouter, OpenAI, Anthropic or your own server), with your own key:

what you write in the chat;
the dashboard or widget code being worked on;
a description of the data it works with: table and field names, labels, types and notes;
in Tultalk +, the documentation generated from your app exports.

Record values are never sent, and the assistants can't see your screen or Tulip's pages. The provider handles what it receives under its own terms and privacy policy. Anything you type into the chat is sent as written, so don't paste sensitive details there.

What goes to Locus

What	When	Why
Your Tulip instance's name, the random ID for this browser installation, and the extension's version	Once a day	License check, support
For each dashboard viewed in Dashboards + View: its ID, how long it was on screen in a visible window, and a one-way hash of the instance and the viewer's Tulip user ID	Once a day, for the days before	Licensing, usage counts
Your support message, the name, email and Tulip instance you enter with it, which features are switched on, and your browser's user agent and language	When you send one	To reply

The hash lets Locus count distinct viewers without learning who they are. It is pseudonymous, not anonymous: someone who already knows a user's Tulip ID could match it.

Locus never receives dashboard names or content, data from Tulip tables, your AI keys, your chats with the assistant, or Tulip user names or emails.

How Locus uses and shares it

Only for license verification, enforcing the license agreement, support, improving Tulbelt Plus, and aggregate usage reporting. Locus doesn't sell it, use it for advertising or to decide creditworthiness, share it with anyone but the hosting providers that run its service, or try to identify individuals from it.

Browser permissions

Each permission the extensions ask for, and why:

Access to *.tulip.co: Everything they do happens on Tulip: the toggles, the Tulbelt + link in Tulip's navbar and the builder pages, which read and write your tables with your session.
Access to openrouter.ai, api.openai.com and api.anthropic.com: Tulbelt Plus: to send the assistant's requests to the provider you picked.
Optional access to other sites: Tulbelt Plus: asked for one site at a time, only when you add a private AI server, so the assistant can reach it.
Storage: To keep the settings and data listed above on your computer.
Clipboard write: Tulbelt Plus: only when you click a Copy button. The extensions never read the clipboard.
Declarative net request and web navigation: Tulbelt and the full Tulbelt Plus: for toggles that adjust Tulip URLs, such as opening tables sorted newest first. Limited to tulip.co.

None of the extensions load or run code from outside their own package.

Your choices

Removing an extension deletes everything it kept in your browser. What it saved in your Tulip instance stays there until you delete it in Tulip.
You can remove your AI keys on the Tulbelt Plus options page at any time, and manage what your provider keeps in your account with them.
Locus deletes the data it holds about your organization within 30 days of a written request to tulbelt@locus-ot.com, except aggregate data that doesn't identify you.

The extensions are tools for people who build in Tulip and aren't directed at children.

Changes and contact

If this policy changes, the new version is posted here with a new effective date.

For questions about this policy, or to ask Locus to delete your organization's data, email tulbelt@locus-ot.com. Tulbelt Plus users can also use the support form in the extension (the feedback icon in the popup, or Support on the options page).