Privacy Policy

At Treefarm Studio LLC (creators of Aspen / Aspenside), one of our main priorities is the privacy of our visitors and users. This Privacy Policy describes the information we collect, how we use it, and the privacy design of Aspen’s local-first product and optional Aspen One cloud features.

If you have additional questions about this Privacy Policy, contact us at support@aspenside.com.

---

1. Scope

This policy covers:

the public website at aspenside.com and related pages;

the Aspen desktop and mobile applications;

optional account, billing, and Aspen One cloud services we operate.

“Aspen,” “Aspenside,” “we,” “us,” and “our” refer to Treefarm Studio LLC. “You” means the person using the website, apps, or services.

---

2. Local-first product data (default)

Aspen is designed so that your agent, workspaces, files, sessions, credentials, terminal activity, and device keys stay on **your devices** by default.

**Your device, your data.** When you use Aspen without optional cloud features, projects, databases, chat history, model API keys you bring, terminal logs, and system data remain on your machine or private network.

We do **not** receive, collect, store, or transmit that local content to our servers unless **you** use a feature that intentionally sends data off-device (for example Aspen One hosted Chat, hosted search, Aspen Live, account sign-in, crash reporting you enable, or a third-party integration you configure).

Bring-your-own keys and subscriptions (for example OpenAI, Anthropic, Google, local models) are configured by you. Traffic to those providers follows **their** privacy policies; we do not intermediate those calls unless you choose an Aspen-hosted gateway.

Local storage is not full-disk encryption

Local-first does **not** mean the on-device database is end-to-end encrypted or encrypted at rest by default.

Aspen stores most local product data (for example sessions, settings, and workspace-related state) in a **local SQLite database and ordinary files on disk**. That store is **not** currently protected with full-database encryption (for example SQLCipher) across the product.

Anyone with access to your unlocked user account, device backups, or the raw database files may be able to read that local data.

Some sensitive values (for example certain account/Sync secrets on desktop) may be sealed with platform secure storage where available (such as OS keychain-backed APIs). That is **selective secret protection**, not encryption of the whole local database.

You remain responsible for device access control, full-disk encryption provided by your operating system, backups, and physical security.

---

3. Accounts and Aspen One

Some features require an Aspen account and, where gated, an **Aspen One** subscription.

Account information we store

When you create or use an account, we may store:

name, email address, and authentication data (for example session tokens, OAuth provider linkage, or password hashes where applicable);

subscription and billing status (including Stripe customer identifiers and period end dates);

registered device metadata used for account and Sync management (for example device name, OS, last seen time);

short-lived Aspen Sync **pairing request** records (device/host public keys, device name/OS, status) so you can approve a new device on a trusted host.

We use this information to authenticate you, enforce entitlements, bill Aspen One, operate device pairing, provide support, and secure the service.

Billing

Paid plans are processed by **Stripe**. We receive subscription status and related billing metadata; we do not store full payment card numbers on our servers. See Stripe’s privacy policy for how they process payments.

---

4. Aspen Sync and the blind relay

**Aspen Sync** (included with Aspen One) lets your devices talk to each other through a first-party relay path and, when available, direct LAN — without requiring Tailscale.

What “encrypted in transit” means here

It is important to separate **transport protection** from **on-device storage**:

**Between paired devices over Aspen Sync:** after pairing with pinned keys, application traffic carried over Sync (API calls, files, terminal streams, session data, and similar content) is encrypted on the sending device and decrypted on the receiving device. The Sync relay is intended to forward **ciphertext only**. Session keys and long-term Sync private keys live on **your devices only**; we do **not** hold escrow copies of those private keys. Connections to the relay also use standard transport security (for example TLS/WSS).

**To our website, account API, and hosted Aspen One gateways:** traffic is protected in transit with standard transport encryption (TLS). That is **not** the same as Sync’s device-to-device encryption, and those services can process plaintext as needed to provide the feature (see Section 5).

**On your device at rest:** local SQLite/files are **not** end-to-end encrypted as a whole database (see Section 2). Sync’s in-transit encryption does **not** encrypt the underlying local database on disk.

So: Aspen Sync is designed so **we cannot read Sync payloads on the relay**, and the path is **encrypted in transit** between your devices. It is **not** a claim that all Aspen data is end-to-end encrypted everywhere, or that local storage is ciphertext-only.

What the blind relay can and cannot see

The Sync **data-plane relay** is designed to be **blind** to application content:

It verifies short-lived admission tokens **offline** and forwards ciphertext between peers that share a pairing room.

Admission tokens are minted by our control plane and carry only an **opaque pairing id** and expiry — **not** your account id, email, or device names.

The relay is not intended to maintain a user database of Sync content, decrypt payloads, or call back to our app servers to learn who you are.

In ordinary operation the relay’s knowledge is limited to technical connection metadata needed to run the service — for example whether a token is valid, pairing-room identifiers, IP addresses, timestamps, and ciphertext sizes.

A compromised or malicious relay could disrupt traffic or observe that metadata. It should **not** be able to read Sync plaintext, complete a pairing as your device, or use a relay token alone to call your local Aspen API. Pairing uses a user-visible **verification code** derived from the exact device public keys so a substituted key can be detected.

What our control plane (aspenside.com) does for Sync

Our website/API (control plane) is separate from the blind relay. It may:

check that your account is allowed to use Aspen Sync;

mint short-lived relay tokens;

broker pairing approval metadata (public keys and device labels) between your devices;

stop issuing tokens when you cancel Aspen One or remove a device.

The control plane is **not** on the Sync content path for paired-device application payloads and does not receive those Sync ciphertext payloads for storage or inspection as part of normal Sync operation.

---

5. Aspen One hosted AI features

Aspen One may include optional hosted gateways. These are **not** blind relays. When you use them, content you submit is processed so we can provide the feature and enforce fair-use quotas.

Aspen Chat (hosted)

Your prompts and model responses are sent through our gateway to our upstream model provider so we can run the included chat model.

We retain **usage meters** (for example input/output token counts, request counts, and weekly period) to enforce allowances.

We design the service **not** to keep a durable archive of prompt or completion text for product training or long-term content storage. Content is processed to fulfill the request; operational logs may briefly include technical error details.

Hosted web search

Search queries you run through the included search gateway are sent to our search provider.

We retain **query-count meters** per billing period, not a durable archive of query text or result bodies for training.

Aspen Live (hosted voice)

Audio and live session frames are relayed through our servers to the upstream speech/realtime provider for the duration of the session so we can hold the provider key server-side and meter connected time.

We retain **session/minute meters**, not a durable archive of audio or transcripts on our side for training.

Important distinctions

**Local / BYOK models:** content stays between your device and the provider you configured (unless you separately enable a cloud feature).

**Local SQLite / files on disk:** not full-database encrypted at rest by default; protected mainly by your device and OS access controls.

**Aspen Sync blind relay:** application payloads are encrypted on your devices before relay hop; we cannot read Sync content on the relay by design. This is in-transit / device-to-device protection, not at-rest database encryption.

**Hosted Chat / search / Live:** TLS in transit to our servers; we (and the upstream provider) process the content required for that request. Those providers have their own privacy policies.

---

6. Push notifications

If you enable push notifications, we may process device push tokens and notification title/body/data solely to deliver alerts you or your Aspen host trigger (for example via Firebase Cloud Messaging). We use this to wake or notify your devices, not to build advertising profiles.

---

7. Website visitors

Log files

When you visit our public website, standard server or platform logs may include IP address, browser type, approximate request time, referring/exit pages, and similar technical data. We use this to operate, secure, and improve the site.

Cookies

We use cookies and similar technologies where needed for sessions, preferences, authentication, and site functionality. You can control cookies through your browser settings; disabling some cookies may break sign-in or account features.

Aggregate download metrics

We may count anonymous download volume by platform, artifact, and version (for example daily totals). Those counters are not tied to user ids, cookies, or device identifiers.

---

8. How we use information

We use the information described above to:

provide, maintain, and secure Aspen and Aspen One;

authenticate users and enforce subscriptions and rate limits;

operate pairing, Sync token minting, hosted AI gateways, and push delivery;

process payments and prevent abuse fraud;

diagnose outages and improve reliability;

communicate service-related notices;

comply with law and enforce our terms.

We do **not** sell your personal information. We do not use your local workspace contents or Sync ciphertext for advertising.

---

9. Sharing and processors

We share data only as needed to run the service, including with:

| Category | Examples of purpose |

| --- | --- |

| Infrastructure hosts | Running aspenside.com, databases, and the Sync relay |

| Payment processor | Stripe for Aspen One billing |

| Auth / email | Account login and transactional email where configured |

| AI / search providers | Upstream model and search APIs when you use hosted features |

| Push providers | Delivering notifications you enable |

| Professional advisors or authorities | When required by law or to protect rights and safety |

Third parties process data under their own terms when you send them content (especially hosted AI and search). Review their policies if you use those features.

---

10. Retention

**Account and billing records** are kept while your account is active and as needed for legal, tax, and dispute purposes.

**Pairing requests** are short-lived and expire after the approval window.

**Usage meters** are kept as periodic counters (for example weekly buckets) for quota and support.

**Sync relay connections** are ephemeral; the blind relay is not a content archive.

**Hosted AI request bodies** are not retained by us as a long-term content store; providers may retain data under their policies for the time needed to provide the API.

**Website logs** are retained for a limited operational period.

You may request account deletion through our in-product or website delete-account flow, or by contacting support@aspenside.com. Some records may remain in backups for a limited time or where we must retain them by law.

---

11. Security

We use administrative, technical, and organizational measures appropriate to the services we operate, including:

transport encryption (TLS) for website, account, and hosted service connections;

device-to-device encryption for Aspen Sync application traffic over the blind relay (so the relay forwards ciphertext rather than readable workspace content);

least-privilege access to production systems;

offline verification on the Sync relay so it does not need your account identity to forward ciphertext.

These measures protect **network paths we operate**. They do **not** mean the local SQLite database is encrypted at rest, or that every feature is end-to-end encrypted end-to-end across the whole product.

No method of transmission or storage is perfectly secure. You are responsible for protecting access to your devices (including OS disk encryption and backups), your Aspen account, and any API keys you configure.

---

12. Children’s privacy

We do not knowingly collect personal information from children under 13 (or the minimum age required in your jurisdiction). If you believe a child has provided us personal information, contact us and we will take appropriate steps to delete it.

---

13. International users

We may process information in the United States and other countries where we or our processors operate. If you use Aspen from another region, you understand that your information may be transferred to and processed in those locations subject to this policy and applicable law.

---

14. Your choices

Use Aspen **locally** with your own keys and skip Aspen One cloud features.

Disable or avoid hosted Chat, search, Live, Sync, or push if you do not want those data flows.

Revoke paired devices in settings; revoked devices lose Sync access when tokens stop being issued and pinned keys are dropped.

Cancel Aspen One to end entitlement-gated cloud features at the next token or session boundary.

Request access, correction, or deletion of account data where applicable by contacting support@aspenside.com.

---

15. Third-party services and links

This policy does not cover third-party websites, model providers, search engines, or tools you connect on your own. Their privacy practices govern data you send directly to them.

---

16. Changes

We may update this Privacy Policy from time to time. The “Last updated” date below will change when we do. Material changes may also be noticed in the product or on the website. Continued use of the services after an update means you accept the revised policy.

---

17. Contact

Treefarm Studio LLC

Email: support@aspenside.com

Website: https://aspenside.com

---

*Last updated: August 2, 2026*