Tuft VPN Privacy Notice

Effective August 10, 2026

This Tuft VPN Privacy Notice (the “Tuft Notice”) supplements and forms part of the Expo Privacy Policy (the “Expo Privacy Policy”). Tuft is one of the Services operated by 650 Industries, Inc. (“Expo”). Capitalized terms not defined in this Tuft Notice have the meanings given in the Expo Privacy Policy.

The Expo Privacy Policy governs your use of Tuft except as specifically described in this Tuft Notice. If this Tuft Notice conflicts with the Expo Privacy Policy with respect to information processed through Tuft’s VPN functionality, this Tuft Notice controls.

VPN traffic

Tuft carries only traffic addressed to your connected Tuft machine. Other app and internet traffic does not pass through Tuft.

Tuft does not sell, use, or disclose to third parties the contents of traffic transmitted through Tuft’s VPN functionality for any purpose. Tuft processes such traffic only as technically necessary to transmit it between your device and the Tuft machine you select. Tuft does not inspect or retain the contents of that traffic.

Operational data

The restriction on VPN traffic does not prevent Expo from processing the limited account, enrollment, connection, security, diagnostic, and performance information described below when necessary to provide, secure, support, and improve Tuft. Expo handles that information under the Expo Privacy Policy and this Tuft Notice.

Tuft may process:

• the connection code, machine identifier, public key, and machine name used during enrollment;
• connection state and technical metadata needed to establish and operate the tunnel, such as timestamps, app version, operating-system version, and error information; and
• diagnostic and performance events used to detect failures and improve reliability.

Tuft does not use this information for advertising or user profiling.

Sharing

Expo does not sell information processed through Tuft. Expo may disclose operational data to authorized vendors and service providers solely as described in the Expo Privacy Policy, including to operate Tuft infrastructure, monitor reliability, and provide customer support. Where a provider processes Tuft operational data on Expo’s behalf, Expo requires it to provide the same or an equivalent level of protection required by this Tuft Notice and applicable law.

Retention and deletion

Temporary connection codes expire automatically. Operational and diagnostic records are retained only as long as needed to provide, secure, and troubleshoot Tuft, after which they are deleted or de-identified.

You can revoke a machine’s access at any time by choosing Forget Machine in the app. To fully erase information associated with your Expo account, sign in to that account and delete it as described in the Expo Privacy Policy. Questions and other privacy requests may be submitted through Expo’s contact form while signed in so Expo can verify your identity.

Your choices

You may disconnect the VPN or forget a machine at any time. Tuft asks for permission before installing its VPN configuration, and you can also remove that configuration in iOS Settings.

Questions and requests

The Expo Privacy Policy describes Expo’s broader privacy practices, international transfers, legal bases for processing, and the process for contacting Expo or exercising applicable privacy rights.

Changes

If this policy changes, we will update the effective date above. Material changes will be disclosed in the app or through another appropriate notice.