Privacy Policy

Last updated: October 9, 2026.

Toldie has two kinds of user. Senders are founders updating the investors in their company, and fund managers updating the limited partners in their fund. Readers are the investors and limited partners, family offices among them, who receive those updates. Everything below applies to both kinds of sender and both kinds of reader.

The rest of this page says exactly what we hold, where it lives, how it is protected, and how long we keep it. The Terms of Service cover the rules of use.

What we collect

Senders: email address, first name and the name readers see, whether you are updating investors about a company or limited partners about a fund, its name, category (a fund's strategy) and stage, an optional website, a one-line description, the replies you write, the updates drafted from them, what you change in a draft before sending, the follow-up questions Toldie asks about a draft and whether you answered them, when you last signed in, and how you found Toldie (the link or page that brought you, and any access code). Readers: name, email address, chosen cadence, the questions and offers you send, whether you confirmed, whether you tapped that an update was useful, which updates you opened, when and how many times (unless you turn that off; see Opens), and, if you report a sender, your name, address and reason. Everyone: the time and outcome of emails we send, and standard server logs (IP address, browser, page) kept for security.

People not on Toldie yet: when an investor, a limited partner or a fund invites a founder or a fund manager, we keep that person's name and address, the inviter's name and address (and fund, if any), and the inviter's note, to send the invitation, to list it on the inviter's own page, and, if the person invited joins, to ask them whether the inviter should get their updates. A fund, a family office or any other firm that asks to prove its domain: the work address it used, and the domain.

Readers are added only when they sign up themselves, confirming by email and then approved by the sender, or when a sender adds an existing contact, who is told at once and can change cadence or leave in one tap.

How we use it

To ask founders and fund managers the weekly question, to draft and deliver updates, to route readers' questions to the sender in bundled form, to show senders who opens their updates (see Opens), to send the emails you asked for, and to keep the service secure. We do not sell personal data, and we do not use it for advertising.

Drafting with a language model

To turn a sender's reply into an update we send the reply text, whether it is a company or a fund, its name, category, stage and one-line description, the sender's first name, the text of pending questions from readers, the last few sent updates, and the sender's last few draft edits to a language model over an API. The names and email addresses of investors and limited partners are never sent. The provider is currently Groq (an open-weight model), with Anthropic as an alternative. We keep only metadata about each call (timing, token counts, whether the output was rejected) for 90 days, never the text.

A guard rejects any draft containing a number the sender did not write. Nothing is sent to readers until the sender approves it, unless they turned on auto-send in Settings, as the short version above says.

How Toldie learns

Toldie does not train a model. To write in your voice it includes your last few draft edits (what Toldie wrote, what you changed it to) in your own company's or fund's requests to the model, and nobody else's. Administrators can also read the most recent draft edits from every company and fund, and the follow-up questions Toldie asked with whether each was answered, on an internal page; that is where changes to how Toldie writes come from. Readers' "useful" taps are read as totals for this; each sender also sees their own readers' taps, as described under Opens. If your sign-in address is on a work domain, Toldie loads that domain's public home page once and asks the model whether it is your company's or fund's site, so your readers can be told what it found; only a one-sentence result is stored.

Does Toldie keep my secrets?

Yes, and here is exactly how. Toldie never connects to your email account; it sends you email and reads only the replies you send to it. Toldie sends your updates only to the investors or limited partners you approved or added. Each one also has a web page whose link needs no login, so a reader can forward it, and whoever they send it to can read that update. There is no feed, no directory, no benchmark built from your text, and no public page where one company's or fund's update can be seen next to another's. The admin pages show two kinds of update text, both described under How Toldie learns: the most recent draft edits, Toldie's draft beside the sender's version, and the follow-up questions Toldie asked about drafts. Some mail reaches a person at Toldie whole, in their own mailbox: a reply sent to toldie@toldie.com instead of the reply address, which can be a sender's update in their own words or a reader's reply with the update quoted below it; mail to hello@, press@ and privacy@; and the notice Toldie emails when a report puts a sender on hold, with the reporter's name, address and reason. The drafting model receives your reply text for processing only, never your readers' names or addresses, and it is not used to train anything. Your raw email replies are deleted after 30 days, and the backups that hold them are erased within 120 days.

How long the finished updates stay is your choice, in Settings: keep them as the record your readers can look back on, or have Toldie delete them 90 or 30 days after sending, with the draft edits and follow-up questions that belong to them. Readers keep the emails they already received either way. Toldie deletes the text, and the backups that still hold it are erased within 120 days; a reply that was forwarded to a person at Toldie, as described above, stays in their mailbox. Deleting your company or fund removes it and everything that belongs to it at once, except the few things listed under Deletion.

Where data lives

The application, email receiving, short-lived storage for incoming mail, and database backups run on Amazon Web Services in the US East (N. Virginia) region. The PostgreSQL database is hosted by Neon in the same AWS region, and email is sent through Resend, also from US East.

Encryption

In transit: all pages and links are HTTPS only with HSTS. Email we send goes over TLS whenever the receiving mail server supports it. Connections between the application and the database require TLS.

At rest: the database is encrypted with AES-256 by Neon, and its backups with AES-256 by AWS. Incoming mail is stored in a private, encrypted bucket that only the mail parser can read.

Access control

Everyone signs in with a single-use emailed link or six-digit code that expires in 15 minutes; there are no passwords to leak. Sessions are signed, HttpOnly, secure cookies that last 30 days. Every emailed action link (approve, send, skip, confirm, unsubscribe) carries a random single-use token signed with a secret key, and no link performs an action just by being opened: mail scanners that prefetch links cannot approve or send anything.

Update links are unguessable and need no login. The reader who received one can forward it, and whoever opens it sees that update and the company or fund it came from, for as long as the update is kept on Toldie. There is no public feed. Update pages, the pages of each company and fund, and every page behind a token or a sign-in are marked not to be indexed by search engines; the pages about Toldie itself are meant to be found.

Inside Toldie, production access is limited to one deployment identity and a named list of administrators, who sign in like anyone else and then need a separate admin password. Administrators can see every sender's and reader's name and address, counts and delivery status, reports readers make, and the recent draft edits and follow-up questions described under How Toldie learns. The mail forwarded to a person at Toldie, described under Does Toldie keep my secrets, arrives in that person's own mailbox, outside these controls.

Opens

What is recorded. Each update Toldie sends a reader (a weekly update, a combined update, or a catch-up) ends with a 1x1 image, unless the reader has turned opens off, as described below. Its address carries a signed reference to that one email and nothing else: no name, no email address, no company. When the reader's mail app loads the image, Toldie records which reader opened which update, and when. Each later load is recorded too, so the sender sees how many times; two loads within five seconds count as one open, and at most 200 are kept for any one email. Toldie also records whether an open looked automatic, and of what kind: Apple Mail's privacy protection, a security scanner, Gmail's image proxy, or a mail app. The open keeps only that kind, not the IP address or the browser the image was loaded from. Notices, confirmations and Toldie's emails to senders carry no such image, and links in emails are not rewritten to track clicks.

Why. So a sender knows who reads their updates without anyone having to reply, and can take off the list a reader who has stopped opening without an awkward email. Each update that carries the image says at its foot what the sender sees, that opening is how a reader stays on the list, and that a reader whose mail app blocks images can turn opens off; the reader's settings page explains it too. Toldie points out to the sender a reader who opened none of their last few updates that could show an open (four for a weekly reader, three every two weeks, two monthly or quarterly), counting only updates sent since the reader last joined or changed how often they hear, and more than three days ago unless they have opened it; it never removes anyone itself, since a mail app that blocks images looks the same as a reader who never opens. A "useful" or "not useful" tap on an update shows it was read, so it counts as opening that update, for this and for the ranking. The sender's list also ranks readers, opens first: by how many of their latest updates they opened, the newest counting most; then by how often they opened them again; then by their offers of help and "useful" or "not useful" taps, so the sender knows whom to call when they raise. Questions never count.

Who sees it. The sender of the update, on their list of readers: for each reader, their latest updates with each time each was opened, how many opens in all and when the last was, and which opens may have been automatic; and their offers of help and "useful" or "not useful" taps. Questions still reach the sender without names and are not counted against anyone. No other reader sees any of it.

Possibly automatic opens. Apple Mail's privacy protection loads every image in an email as it arrives, whether or not it is read, and a security scanner may load it within seconds of sending. Toldie marks those opens as possibly automatic. They still count, so a reader with Apple's protection on is never pointed out for not opening, but they count for less in the sender's ranking.

Turning it off. It is on for every reader until they turn it off, with the switch on the settings page linked from every update. From then on their updates carry no image, the opens already recorded for them are deleted at once (the backups that still hold them are erased within 120 days), and the sender sees only that they don't share opens. They are never pointed out for not opening; the sender sees their offers of help and "useful" or "not useful" taps as before, and ranks them by those, with the readers who opened nothing, below every reader who opens. The switch says so. Turning it on again counts only updates sent after that.

Product analytics, when enabled, record what senders do, such as "question sent", and never include readers' data or update text.

How long we keep things

• Sent updates and replies, and the draft edits and follow-up questions that go with them: for as long as the company or fund exists on Toldie, or 90 or 30 days if the sender chose a window in Settings (for an update, counted from when it was sent).
• Readers' details, their questions and offers, "useful" taps, send history, and which updates they opened and when: for as long as the company or fund they belong to is on Toldie. A reader's opens are deleted at once if they turn opens off, and the backups that still hold them are erased within 120 days.
• Raw incoming email (the full reply, quoted text and signature included): 30 days, then deleted automatically. The cleaned entry is kept with the update.
• Action links and sign-in codes: single use, and deleted 30 days after they expire.
• Entries a sender deletes: removed from every draft immediately, purged after 30 days.
• Language model call metadata: 90 days.
• Invitations to founders and fund managers: one Toldie never sent, because the inviter never confirmed their address, is deleted 30 days after it was made, unless it led to a company or fund still on Toldie. Every other invitation is kept until the person invited or the inviter asks us to remove it.
• A domain claim, by a fund, a family office or any other firm: deleted 30 days after the firm last asked for it, if the domain was never verified. A verified claim is kept, because it is what senders are shown.
• A report of a sender: kept on the reported company or fund until an administrator clears it.
• Mail forwarded to a person at Toldie, and the notice emailed when a report puts a sender on hold: kept in that person's own mailbox, outside Toldie's systems. Nothing here deletes them.
• Your sign-in (your address, when you last signed in, and how you found Toldie): until you ask us to remove it. Deleting a company or fund does not remove it, because one sign-in can hold several.
• Server and application logs: 30 days.
• Database backups: taken every six hours; each is kept 90 days, then held 30 more days as a deleted version before it is erased.

Deletion

Founders and fund managers can delete their company or fund from Settings. That removes its readers, replies, updates, draft edits, questions, send history and opens at once. A few things outlast it, each on its schedule above: raw incoming email is deleted within 30 days, database backups are erased within 120 days, invitations connected to it follow the invitation rule, mail forwarded to a person at Toldie stays in their mailbox, and your sign-in stays until you ask. Investors and limited partners can unsubscribe from any email with one tap, and after that get no updates from that company or fund unless they confirm they want them again: its founder or fund manager cannot add them back, only email them a request to confirm; to remove your name and address entirely, use the contact below.

Who else touches the data

Amazon Web Services (hosting, email receiving, backups), Neon (the database), Resend (email delivery), Groq or Anthropic (drafting, text only, as described above), and, only if enabled, Sentry (error reports) and PostHog (product analytics on what senders do). Each processes data on our instructions. Mail forwarded to a person at Toldie, and report notices, are delivered to that person's own mailbox and held by its email provider. We have no other recipients.

If something goes wrong

If we learn of a breach affecting your data, we will tell affected founders, fund managers, investors and limited partners by email without undue delay, say what was involved, and what we did about it.

Your rights

You can ask for a copy of the personal data we hold about you, ask us to correct it, or ask us to delete it. Write to the address below and we will answer within 30 days.

Children

Toldie is for founders, fund managers, investors and limited partners, and is not directed at anyone under 18.

Changes

When this policy changes in a way that matters, we update the date above and tell founders and fund managers by email.

Contact

privacy@toldie.com