Version 1.0.7 · Effective 2026-10-21 · Posted 2026-10-21 · Last updated 2026-10-21
In plain English. This summary helps you read the policy. It is not part of the policy, and the full text below
controls.
Your traffic is end-to-end encrypted. Our relays carry it but can't read it. On the hosted service we hold your
org's network certificate authority so we can run the network. We commit never to use it to join your network or
read your traffic.
What we collect: what we need to run the network. That means device names, keys, addresses, software and health
facts, the people in your org, and security logs. Section 3 lists all of it.
What we don't do: we don't sell your data or show ads. The apps have no analytics or
crash reporters. The website sets no cookies of its own.
Your org controls its network data. On the hosted service we act on its instructions. We also make aggregated or
de-identified statistics to improve Tartan.
Deletion: your org's Owners decide what is deleted, and do it themselves in the console or the command-line
tool. Ask your org's admin. We don't act on deletion requests sent by email. Some security records and backups last longer, and section 7
says which.
Changes: every change goes in a dated changelog. Big ones, including changes to how we use data, take effect
at least 30 days after we post them.
1. Who we are
TechSolve LLC is a Kentucky limited liability company ("TechSolve", "we", "us") and the maker of Tartan
Networks ("Tartan"). Our address is 187 Pavilion Pkwy #131, Newport, KY 41071, and you can reach us at privacy@tartannetworks.com.
This policy covers:
our website, tartannetworks.com;
the hosted Tartan service: the control plane, console, lighthouses, relays, org DNS and certificates;
the Windows agent;
the Tartan Mobile app for Android.
Where we offer the hosted service. For now, we offer the hosted service to organizations outside the European
Economic Area and the United Kingdom.
2. Our role
For your org's network data on the hosted service, we are a processor. US state law calls this a "service
provider".
We act for the organization that uses Tartan, which is the controller, under our
Terms and our
Data Processing Addendum. The addendum applies to every org on the hosted
service.
If you use Tartan through your employer or another organization, that organization decides how your data is used,
and its own privacy notice applies too. Send your requests to that organization first. We will help it respond.
We are the controller for:
our website;
the record of who agreed to our terms;
security and abuse prevention;
support and business communications;
billing, once we bill;
the aggregated or de-identified statistics described in section 4.
If your org runs its own control plane (self-hosted), we receive none of its network data.
3. What we collect
3.1 People in an org (hosted service and console)
Name and identifier: a display name, plus either a short handle or, if your org uses its own sign-in provider
(such as Microsoft or Google), the email and account identifier that provider gives us.
Passkeys: the public key of each passkey, and facts about it: the authenticator model identifier, whether it is
synced or backed up, and its attestation format. We never receive or store passwords, private keys or biometrics.
Your fingerprint or face stays on your device.
Sessions: when you signed in and when you were last active.
Admin device requests: when someone asks to use a device as an admin, we record the device's name and operating
system, the person, the time and the IP address the request came from. Approvers use these to check the request.
Membership: invitations, roles and group memberships.
Agreement records: who accepted which version of our terms, for which org, and when.
3.2 Devices (Windows agent, Tartan Mobile and other software)
Device name. On Windows this is the computer name. On a phone it is the name you give it, which starts as your
phone's name. It often contains a person's name (for example "Jane's Pixel"), and you can change it.
Software facts. These are sent when a device joins and at each check-in:
the agent or app version;
the OS family ("windows" or "android"; not the OS version);
the CPU architecture;
the Nebula version;
the type of key storage used;
on Windows only, the file paths of the device's Nebula keys and the name of its network adapter.
Keys. Each device's public keys and certificates. Private keys are created on the device and never leave it.
Where the device supports it, they are kept in its hardware-backed keystore.
Addresses:
the network address each device is assigned in your org;
the public IP address and port it connects from;
its local network addresses. Devices report these so that devices on the same local network can connect directly.
Lighthouses share them with the other devices in your org.
Health and events. These are sent at each check-in: whether the tunnel is up, the result of the last
configuration change, and short technical event messages. None of them contain your traffic.
What the software does not collect:
the contents of your traffic;
your browsing;
the names you look up in DNS;
your location, contacts or files;
your Windows username, serial number or hardware MAC address.
The software contains no analytics, advertising or crash-reporting code.
Optional RMM hook (Windows). If your org turns this on, the Windows agent writes the computer's overlay address
into your org's own remote-management (RMM) tool. That tool belongs to your org, not to us, and the hook is off by
default.
Android permissions. The app uses:
network access and network state, to connect and to find the Wi-Fi or mobile network's DNS servers;
a foreground service and notifications, to keep the tunnel running and show its status;
the camera, only while you scan a join QR code. The image is processed on the phone and never sent anywhere.
DNS on Android. While Tartan Mobile is connected, Android sends the phone's DNS lookups to a resolver inside the
app, on the phone.
The resolver answers names in your org's own zone itself.
It forwards every other lookup, unchanged, to the DNS servers of the Wi-Fi or mobile network you are using. Those
forwarded lookups go over that network and are not encrypted.
Lookups never reach us. The app does not log or keep the names it looks up.
We plan to encrypt forwarded lookups in a later version.
If you set Android's Private DNS to a specific provider, Android may send lookups to that provider instead.
3.3 Org configuration
We hold your org's:
name and zone;
devices and groups;
access rules;
grants it makes to other orgs or receives from them;
the DNS names it publishes.
Some of this is public by nature:
Your org's DNS zone is served by public DNS.
Certificates we obtain for your zone from Let's Encrypt are recorded in public Certificate Transparency logs,
permanently, as every public certificate is.
Our public transparency registry lists organization-level records: an org identifier, its type, timestamps and signed
metadata (a registered org's handle and display name, its public keys and its CA certificates). It does not list
people. The registry is append-only and every device checks it, so these entries are permanent: they stay after the
org is deleted.
3.4 Security and operations logs
Audit log: a tamper-evident record of administrative actions. It records who did what, to what, and when, and it
names the person who acted.
Certificate records: each certificate issued to a device, kept in a certificate archive after it expires.
Web server logs: each request to the control plane records the time, the IP address and the result. We do not
log request headers or bodies.
Network edge logs: lighthouses and relays see the public IP addresses of the devices that connect to them, and
may log connection events.
Splash pages: we log the time, the requested hostname (SNI) and the result.
Alerts: operational alerts about our own systems.
Rate limits: we use IP addresses in memory to limit abuse of sign-up and enrolment.
3.5 Website
Our website sets no cookies of its own. It has no analytics, advertising or forms.
It is hosted by Cloudflare, which processes request data such as your IP address and browser type in order to serve
and protect the site.
3.6 When you contact us
If you email us, we use your email address and message to reply, and we keep them as business records.
4. How we use data
We use data to:
provide the Service: run your network, sign certificates, answer DNS, show your console and deliver updates;
keep it secure: authenticate people and devices, approve admins, detect and stop abuse, and keep audit records;
support you: answer requests and fix problems;
meet legal obligations and enforce our terms;
improve Tartan. In addition to running the service, we create aggregated or de-identified statistics, such as
counts of devices, versions in use, error rates and performance figures. They are designed not to identify any
person, device or org.
We keep and use de-identified information only in de-identified form.
We will not attempt to re-identify it, except to test that our de-identification works.
We contractually require anyone we share it with to make the same commitments.
What we do not do.
We do not sell personal data.
We do not "share" it for cross-context behavioural advertising.
We do not use it for advertising or profiling.
We do not make decisions about you based solely on automated processing that have legal or similarly significant
effects.
<!-- /data-use -->
Legal bases (EEA and UK, where they apply).
For our controller processing we rely on:
our legitimate interests in running, securing and improving a service your organization chose;
performance of our contract with your organization;
compliance with law.
Where we act as processor, your organization's legal basis applies.
5. Who we share data with
Your org. Your org's Owners and Admins can see its people, devices, addresses and audit log in the console.
Other devices in your org learn the addresses they need to connect to yours.
Orgs you share with. If your org grants another org access, that org can see the granted devices and resources,
as configured.
Your org's sign-in provider, if your org uses one. Your org chooses it, and it handles your sign-in under its own
terms.
Your org's RMM tool, if your org turns on the optional hook (section 3.2).
App stores. Google Play handles app downloads and updates under its own privacy policy.
The law. We share data when the law requires it, or to protect people from serious harm. Where we lawfully can,
we tell the affected org first.
Business transfers. If TechSolve is sold, merged or reorganized, data may pass to the successor. The successor
remains bound by this policy.
6. Where data is stored
The hosted service runs in Microsoft Azure data centres in the United States, and backups are kept in a second US
region.
If you are outside the United States, your data is transferred there.
Our DPA sets out the safeguards, including the European Commission's Standard Contractual Clauses, that apply if
EEA, UK or Swiss data reaches us.
7. How long we keep data
Each period below is the longest we keep the data. We may delete it sooner.
Data
Kept for
Endpoint and mobile device records
While the device is in use. A device unseen for 60 days is marked dormant, then forgotten about 90 days later. It is not forgotten if it still has a live certificate or holds DNS or configuration. An admin can also remove it at any time. Forgotten and removed devices are copied to a device archive. We are adding a time limit to the archive.
Infrastructure devices (edge, lighthouse, relay)
Until an operator removes them.
Device events
Up to 30 days.
People and roles
While the person belongs to an org. When a person is removed, their record is marked removed and their passkeys and sign-in identities are deleted. Their display name and identifier stay on the record, because the audit log refers to it.
Sessions
Revoked when they end or the person is removed. We are adding a time limit for revoked sessions.
Admin device requests
Pending requests expire after 24 hours. Approved requests, including the requester's IP address, are kept while the device is an admin device. We are adding a time limit after that.
Certificate records
Kept in a certificate archive as security records while the org exists, and up to 12 months after it is deleted.
Audit log
Append-only. Entries are not deleted while the org exists. After an org is deleted, its audit log is kept for up to 12 months and then deleted as a whole.
Deletion records
When an org is deleted, we keep a record that it was deleted: the org's ID and name, who requested the deletion, and when. It is kept apart from the org's audit log, as a security record, with no end date.
Agreement records
While the org exists, and up to 6 years after it is deleted. They include the name and email, if any, of the person who accepted for the org.
Web server and edge logs
We are adding a time limit.
Operational alerts
Up to 30 days.
Database backups
Point-in-time recovery for up to 14 days and nightly backups for up to 90 days. Backups are write-once, so deleted data persists in them until they expire. We restore from them only to recover the service.
Recovery copies of an org's network keys
Encrypted and kept offline, for up to 3 years. We use them only to recover the service.
Transparency registry
A registered org's entries are permanent and public: the registry is append-only. Its backup copy is kept up to 3 years.
Certificate Transparency entries
Permanent and public. We don't control them.
Emails with us
As long as the request needs, and up to 3 years.
Longer, where we need to. We may keep data longer than the table says where we need it to meet a legal
obligation, resolve a dispute, enforce our agreements, or keep the service secure, and for as long as that need lasts.
De-identified data. Aggregated or de-identified statistics (section 4) are not personal data, and a deletion does
not remove them.
Deleted organizations. An org's Owners can delete it. We may also delete an org that none of its own devices has
connected to for 60 days, or whose fees are unpaid 45 days after they were due, after telling its Owners in the
console (Terms section 9.3). A deleted org's name may later be given to another org.
8. Your choices and rights
Remove a device.
In Tartan Mobile, leave the network.
On Windows, uninstall the agent with the purge option.
Or ask your admin to remove the device.
Uninstalling the app or agent deletes the data on the device. Your org's record of the device stays until an admin
removes it or it ages out (section 7).
Delete an org, a person or a device. Only an org's Owners decide this, and they do it themselves.
An Owner deletes in the console or the command-line tool, signed in. We do not act on deletion requests sent by
email or any other way.
The service deletes or de-identifies the live records within 30 days. If it takes longer, we finish within the
time the law allows.
If no Owner can sign in, we do not delete on anyone's request; the org is deleted once it is no longer used
(section 7).
If you use Tartan through an organization. Your organization controls its network data, much as an employer
controls its email system. Ask your organization's administrator. If you write to us, we tell you to ask your
organization.
Your legal rights. Depending on where you live (for example California or another US state with a privacy law),
you may have rights over the personal data we hold as controller (section 2), such as the record of who accepted
our terms and emails you sent us. These may include the right to:
access your personal data or get a copy of it;
correct it;
delete it;
restrict or object to processing;
port it to another service;
not be discriminated against for using these rights.
Email privacy@tartannetworks.com to use these rights. We will verify your request and answer within the time the law
requires, subject to the exceptions the law allows. You may use an authorized agent where the law allows. For your
organization's network data, these rights go through your organization, as the point above explains.
We do not sell or share personal data for advertising, so there is nothing to opt out of.
9. Security
We protect data with:
end-to-end encryption between devices;
passkey-only sign-in;
hardware-backed keys where available;
per-org isolation in our database;
encryption in transit;
a tamper-evident audit log;
write-once backups;
limited, logged staff access.
On the hosted service, we keep your org's network certificate authority in managed key stores. We use it only to issue
your org's certificates and configuration.
Tartan is for organizations and for people aged 18 and over. We do not knowingly collect personal data from children.
If you believe a child's data has reached us, email privacy@tartannetworks.com and we will delete it.
Material changes take effect at least 30 days after we post them. Where the console supports it, we also show them
there to each org's Owners and Admins.
A change that uses personal data in a materially broader way than this policy describes is a material change. It
reaches personal data we already hold only with any consent the law requires.
<!-- /data-use -->