TUSK Privacy Policy

Operating entity: Virtual World Computing, LLC (Santa Barbara, California, USA)

Properties covered: tuskcentral.ai (the first and primary TUSK domain), hello.tuskcentral.ai, support.tuskcentral.ai, new.tusksearch.com, tusksearch.com, tuskbrowser.com, the TUSK browser extensions and mobile apps, and any subdomains operated by Virtual World Computing, LLC (collectively, "TUSK" or the "Service"). Effective date: May 20, 2026 Prior version effective date: February 18, 2026 (legacy tusksearch.com/privacy-policy and tuskbrowser.com/privacy-policy/) Version: v1.0

§1 — Introduction and scope

This Privacy Policy describes how Virtual World Computing, LLC ("VWC," "we," "our," "us") collects, uses, shares, and protects personal information when you use TUSK. By using TUSK, you confirm that you have read this Privacy Policy and that you understand how we handle your personal information.

Geographic scope. TUSK is offered to residents of the United States (including its territories) and to residents of Canada other than residents of the Province of Quebec (collectively, the "Available Markets"). TUSK is not offered to, and is not directed at, residents of the Province of Quebec or residents of any country outside the Available Markets, including but not limited to the European Union, the United Kingdom, the European Economic Area, Switzerland, the People's Republic of China (including Hong Kong and Macau), the Russian Federation, or any country subject to comprehensive U.S. sanctions. We use technical controls — including country-level and Canadian region-level geo-restriction — to restrict access from outside the Available Markets, and we do not knowingly process personal information of residents of any excluded jurisdiction, including Quebec.

Age scope. TUSK is offered only to individuals who are 18 years of age or older. We do not knowingly collect personal information from anyone under 18. See §8 (Children).

Local law controls. Section 10.4 of this Policy references the Personal Information Protection and Electronic Documents Act (PIPEDA) of Canada. That description is an operational summary prepared by U.S. counsel. It is not a complete statement of Canadian privacy law, and if PIPEDA or the law of your Canadian province of residence (other than Quebec) gives you rights or protections beyond what we describe here, that law applies.

If you have questions about your rights, you may contact us or, if you are a Canadian resident outside Quebec, the Office of the Privacy Commissioner of Canada (priv.gc.ca).

What this Policy covers. All properties and surfaces operated by VWC under the TUSK brand, including the TUSK web search and news application, the Tusk Central AI multi-model gateway, the TUSK browser extensions, and the TUSK mobile and desktop applications.

What this Policy does not cover. Third-party websites, applications, services, or AI models that you access through TUSK (including the upstream model providers identified in §6), nor advertisements or content you click through to from TUSK. Those third parties operate under their own privacy policies.

§2 — Categories of personal information we collect

This section uses the personal-information categories set out in California Civil Code §1798.140 so that the same descriptions also satisfy the disclosure expectations of other U.S. state privacy laws and of Canadian PIPEDA.

2.1 Identifiers

• Account email address (if you create an account or subscribe to the newsletter)
• Account display name (if you create an account)
• IP address (collected automatically; used for security, anti-abuse, geographic enforcement of the Available Markets, and approximate localization)
• Device identifiers and advertising identifiers (for anti-fraud and, where you have consented, advertising)
• Account identifier from your social login provider if you sign in via Google, Apple, or Discord (we receive only the identifier and email; we do not receive your password)

2.2 Customer records and commercial information

• Stripe customer identifier (we do not store your card number, CVV, or expiration date in TUSK systems; payment information is collected and stored by Stripe under Stripe's privacy policy)
• Credit balance and credit-purchase history (TUSK monetization is by advertising plus Stripe credits; there are no recurring subscriptions)

2.3 Internet and electronic activity

• Search queries you submit
• Tusk Central AI prompts you submit and the resulting outputs
• Pages you view, links you click, and time spent on the Service
• Cookies, pixels, SDKs, and similar tracking technologies (see §7)
• Microsoft Clarity session-replay data: mouse movements, clicks, scroll events, page transitions, and a visualization of how you used the Service. Clarity input fields are masked and Clarity is gated on consent (see §7).
• Aggregate analytics from Google Analytics 4 (with IP anonymization and ad-feature configuration) and Umami

2.4 Geolocation

• Approximate location derived from IP address — collected automatically and used for (a) enforcing the Available Markets (including detection of Quebec-region access from Canadian IPs), (b) language and currency localization, and (c) where you have consented, advertising.
• Precise device location — collected only when you turn on the Tusk Central AI location feature, which adds your location to your AI prompt so that the model can give location-aware responses. The level of precision depends on your device and the permissions you have granted (some devices return city-level precision; others return more precise coordinates if you have granted that permission to your browser or app). You can turn this feature off at any time. When this feature is on, your location is retained as part of your prompt content under §9 (Retention) and is subject to the same controls as other prompt data.

We do not collect precise device location for any purpose other than the opt-in feature described above.

2.5 Audio capture and sensory information

• Dictation in Tusk Central AI. When you tap the in-app microphone to dictate a prompt, your device captures the audio and converts it to text. The transcribed text is sent to Tusk Central AI as part of your prompt content and is subject to the controls and retention described in §2.3 and §9. We do not retain the underlying audio after transcription. Where transcription is performed by an external provider, that provider processes the audio under its own privacy policy.
• Asynchronous support video. Videos you upload through Videoask are collected only when you initiate the upload, and are processed by Videoask under its own privacy policy.
• We do not otherwise record audio or video of you.

2.6 Inferences

We do not build inferential profiles about you that would extract conclusions, characteristics, preferences, attitudes, intelligence, abilities, or aptitudes from your activity on TUSK. We do not use Tusk Central AI, search history, or news-feed activity to produce decisions about you that would have legal or similarly significant effects.

See §2.9 for de-identified and aggregated data, which is not personal information.

2.7 Free-text input

A note about free-text fields. Search queries, AI prompts, support tickets (Zendesk), and Videoask responses all accept free-text input from you. You should avoid putting unnecessary sensitive personal information (such as health, financial account numbers, government identifiers, sexual orientation or behavior, religious beliefs, political opinions, immigration or criminal status, biometric or genetic information, or trade-union membership) into any free-text field unless it is necessary for the request. This is especially important for search queries and Tusk Central AI prompts, the content of which is shared with advertising partners to support context-based advertising (see §6.3). We retain free-text content under §9.

2.8 Sensitive personal information

To the extent you choose to volunteer the categories listed in §2.7 above into a free-text field, that content may constitute "sensitive personal information" under California, Connecticut, Virginia, Colorado, and other U.S. state privacy laws, or comparable categories under Canadian PIPEDA.

We treat sensitive personal information with the same retention, access, and security controls described in this Policy. We do not use it for purposes other than the purpose for which you submitted it, except that, to the extent sensitive personal information appears in a search query or Tusk Central AI prompt, it may be shared with advertising partners as part of the query or prompt content described in §6.3. You can avoid this by not volunteering sensitive personal information in free-text fields. California residents have a right to limit our use and disclosure of sensitive personal information, and all users may opt out of the sale or sharing of personal information (including by sending a Global Privacy Control signal); see §7 and §10.

2.9 De-identified and aggregated data

We also collect and process de-identified and aggregated data — that is, data from which personal identifiers have been removed (de-identified) or data that has been combined across many users so that it does not identify any individual user (aggregated). Examples:

• Feature-usage counts (e.g., how many users used a given feature in a given month, without per-user breakdown)
• Error and failure rates per feature, platform, and app version
• Performance telemetry — request volumes, latency distributions, infrastructure health metrics
• Aggregate analytics produced by Google Analytics 4 (with IP anonymization and ad-feature configuration), Umami, Datadog, and Grafana

De-identified and aggregated data is not personal information under California Civil Code §1798.140 or under comparable definitions in Canadian privacy law, and the data subject rights described in §10 do not apply to it. We do not attempt to re-identify de-identified data; we keep it in de-identified form; we use it only in de-identified or aggregated form; and we contractually require the processors we use for these purposes not to re-identify it.

§3 — How we collect personal information

We collect personal information from three sources:

• Directly from you, when you create an account, sign in, submit a search query or AI prompt, contact support, subscribe to the newsletter, or purchase credits.
• Automatically, when you use the Service (IP address, device identifiers, cookies and similar technologies, session data, error logs).
• From third parties, including OAuth providers (Google, Apple, Discord), our payment processor (Stripe), our news content licensor (NewsWhip), and ad-network partners.

§4 — Purposes of processing and lawful basis

§5 — How TUSK uses AI, and what that means for your information

5.1 What Tusk Central AI is

Tusk Central AI is a multi-model gateway that lets you choose an underlying AI model and submit a free-text prompt. Tusk Central AI accepts only text input and returns only text output. There is no image, audio, or video generation. There is no agent loop, no autonomous action, no tool use, and no persistent memory across sessions.

5.2 You are interacting with AI

Tusk Central AI is an artificial intelligence system. You should always assume that an AI generated the output you receive from Tusk Central AI, and that the output may be inaccurate, incomplete, biased, or fabricated. You should independently verify anything important.

5.3 We do not train models on your inputs

VWC does not train, fine-tune, or otherwise customize any AI model. We do not use your prompts, your outputs, your feedback, or any other content you provide to train any AI model — our own or anyone else's.

5.4 What happens to your prompt

When you submit a prompt to Tusk Central AI:

1. The prompt is sent from TUSK's infrastructure (AWS, U.S.) to OpenRouter (U.S.).
2. OpenRouter routes the prompt to the upstream model provider you selected.
3. The output is returned through the same path.
4. The prompt and output are stored in TUSK infrastructure for the retention period in §9 and are accessible to a small number of authorized engineers for debugging and abuse-detection only.
5. OpenRouter does not retain your prompt or output (prompt logging is disabled in TUSK's OpenRouter configuration).
6. Your prompt is processed by the upstream provider you selected, subject to that provider's own data-handling terms (see §6.4).

Separately from the model-processing path above, the content of your search queries and Tusk Central AI prompts is shared with advertising partners to support context-based advertising, as described in §6.3. You can opt out of this sharing as described in §7 and §10.

5.5 Known limitations of AI output

AI outputs may be wrong. They may be biased. They may invent facts, citations, or sources ("hallucinate"). They may reflect the biases of the data on which the underlying model was trained. They are not a substitute for professional advice. You should not rely on Tusk Central AI output for medical, legal, financial, tax, psychological, safety-critical, or other consequential decisions. The Terms of Service include a no-reliance clause that you should read.

§6 — Recipients, processors, subprocessors, and AI providers

We disclose your personal information only as described below. We do not sell your personal information for money, but some sharing of personal information with advertising partners may meet the broad definitions of "sale" or "share" used in California, Connecticut, Virginia, Colorado, and other state privacy laws — see §6.5 and §10.

6.1 Service providers and processors

We have a Data Processing Addendum (DPA) — or an equivalent contractual data-handling commitment — in place with each of the providers listed above.

6.2 OAuth providers

If you sign in with Google, Apple, or Discord, we receive only your account identifier and email address. We do not receive your password and we do not receive any data from those services beyond the authentication signal you authorize.

6.3 Advertising partners

TUSK shows advertising. Where you have consented (or where you have not opted out, in jurisdictions whose laws use opt-out), TUSK may share with advertising partners certain identifiers (IP address, device or advertising identifier, page-context information). Search queries and Tusk Central AI prompt content are shared with advertising partners.

A current list of advertising partners is maintained at https://tuskcentral.ai/ad-partners and is updated when partners change.

6.4 Upstream AI model providers

When you submit a prompt to Tusk Central AI and select a particular model, the prompt content and the resulting output are processed by the upstream provider that operates that model. Each provider has its own privacy and data-handling policy; the table below summarizes the providers TUSK currently routes to and links to each provider's relevant policy.

When you select a model whose provider operates outside the United States, your prompt is transferred internationally to that provider for processing. See §11 (International transfers).

6.5 "Sale" and "share" under U.S. state privacy law

Some sharing of identifiers, online activity, and search-query and prompt content with advertising partners (§6.3) constitutes a "sale" or "share" under California's CPRA, "targeted advertising" under Connecticut, Virginia, Colorado, and other state privacy laws, and equivalent terms under additional state laws. We disclose this sharing here, we honor opt-outs (see §10), and we honor Global Privacy Control signals on browsers that send them.

6.6 Other recipients

We may also disclose personal information:

• To enforce our Terms of Service (which include the acceptable-use rules at §§4 and 5.7) or this Privacy Policy.
• To respond to lawful requests from government authorities, including law enforcement and national security authorities, in any jurisdiction where we are subject to legal process. We require valid legal process and we challenge overbroad requests where appropriate.
• To investigate and prevent fraud, security incidents, abuse of the Service, or threats to safety.
• To advisors, auditors, insurers, and counsel under appropriate confidentiality obligations.
• In connection with a merger, acquisition, financing, restructuring, sale of assets, or bankruptcy, with notice to you where required by law.

We do not disclose personal information to data brokers.

§7 — Cookies, SDKs, and tracking technologies

7.1 Scope

This section describes the cookies, similar storage technologies (such as local storage, session storage, IndexedDB), pixels, beacons, and software development kits (SDKs) used by TUSK.

7.2 Categorization

We classify all tracking technologies into four categories. Strictly necessary technologies do not require your consent. Functional, analytics, and advertising technologies are loaded only after you grant consent (or, in U.S. states whose law uses opt-out, only until you opt out).

7.3 Inventory

The inventory below is current as of the effective date of this Policy. Engineering maintains a live, machine-generated inventory, reviewed quarterly.

7.3.1 Strictly necessary

7.3.2 Functional

7.3.3 Analytics

7.3.4 Advertising

The current list of advertising partners is published at https://tuskcentral.ai/ad-partners and is updated when partners change.

7.4 Microsoft Clarity — additional disclosure

Microsoft Clarity records interactions on TUSK pages, including mouse movements, clicks, scrolls, and a visualization of the page as you saw it. Clarity is configured to mask all input fields by default, to exclude pages we have identified as sensitive (account settings, payment flows, support-ticket content), and to redact text that the SDK identifies as potentially sensitive. Clarity loads only after you accept analytics cookies. Microsoft processes the data as a separate service provider; the Microsoft privacy policy is at https://clarity.microsoft.com/privacy.

7.5 How to manage your preferences

You can manage your tracking preferences in three ways:

1. Consent banner. When you first visit TUSK, a consent banner offers "Accept all", "Reject non-essential", and "Customize". You can re-open the banner from a "Cookie Preferences" link in the footer of every page.
2. Global Privacy Control. If your browser sends a Global Privacy Control (GPC) signal, we treat it as (a) a request to opt out of "sale" and "share" of personal information (CCPA/CPRA and equivalent state laws), and (b) where applicable, a request to limit the use of sensitive personal information.
3. "Do Not Sell or Share" link. A persistent footer link leads to a one-click opt-out for the advertising category.

Browser-level controls are also available: you can block or delete cookies through your browser settings. Blocking strictly necessary cookies will break the Service.

7.6 State-specific opt-out mechanics

Residents of states whose laws use the "right to opt out of sale or share" model have that right as set out in §10. California residents specifically have the right to limit the use and disclosure of sensitive personal information. We honor a correctly transmitted GPC signal as a valid opt-out.

7.7 Canadian residents (outside Quebec)

Canadian residents outside Quebec are presented with a consent banner that requires opt-in for non-essential cookies and similar technologies. The lawful basis for analytics and advertising cookies is your consent, which you can withdraw at any time through the consent banner.

§8 — Children

8.1 TUSK is for adults

TUSK is offered only to individuals who are 18 years of age or older. We do not direct TUSK at, and do not knowingly accept users from, anyone under 18.

The 18+ age floor applies in all Available Markets and is independent of the lower minimum ages used by other services. TUSK uses 18 as a single, simple, conservative age threshold.

8.2 How we enforce the age floor

We rely on: a clear age-restriction notice in the Terms of Service and registration flow; an age self-attestation at account creation; app-store age ratings of 17+ / mature; commitments from payment-card and OAuth providers that apply minimum-age controls; and removal of any account we discover belongs to a person under 18.

We do not perform age verification by scan, document check, or biometric estimation. The 18+ floor is enforced by self-attestation, which is the industry standard for adults-only services.

8.3 If we learn we have collected personal information from someone under 18

If we discover or are informed that we hold personal information about someone under 18, we will: delete the information promptly; close the account; notify the parent or guardian if we have a means to contact them; and not retain the information beyond what is necessary to confirm deletion.

Parents or guardians who believe their child has used TUSK may contact support@tuskcentral.zendesk.com. We will respond within 14 days and act within 30 days after confirming the matter.

§9 — Retention

We retain personal information only as long as we need it for the purpose for which we collected it, with the periods set out below. After the retention period, we delete the information or de-identify it.

We may retain personal information beyond these periods where we are legally required to, where we need it to defend legal claims, or where you have asked us to keep it.

§10 — Your rights

You have rights over your personal information. The specific rights you have, and the way you exercise them, depend on the jurisdiction you live in.

10.1 Rights available across all Available Markets

Subject to verification of your identity and to limited exceptions in the laws of each jurisdiction, you may request access to the personal information we hold about you; request correction of inaccurate personal information; request deletion of your personal information; request a copy of your personal information in a portable format; and withdraw any consent you have given.

To exercise any of these rights, use the form at https://support.tuskcentral.ai/hc/en-us/requests/new or write to the address in §17. We will verify your request and respond within the timeframe required by your jurisdiction's law (and in any event within 45 days).

10.2 California residents (CCPA/CPRA)

In addition to the rights in §10.1, you have the right to know the specific pieces of personal information we have collected, the categories of sources, the business or commercial purposes, and the categories of third parties with whom we have shared the information; the right to opt out of the sale or sharing of your personal information (use the "Do Not Sell or Share My Personal Information" link in the footer or send a GPC signal); the right to limit the use and disclosure of sensitive personal information (use the "Limit the Use of My Sensitive Personal Information" link in the footer); and the right to non-discrimination for exercising these rights.

We process consumer requests within 45 days, with a possible 45-day extension. You can authorize an agent to make a request on your behalf with a written authorization.

10.3 Other U.S. state residents

Residents of Connecticut, Virginia, Colorado, Texas, Utah, Oregon, Montana, Iowa, Tennessee, Indiana, New Jersey, Delaware, New Hampshire, Maryland, Minnesota, and other states with comprehensive consumer privacy laws have rights comparable to those in §10.1, plus the right to opt out of targeted advertising, sale, and (in most states) profiling for decisions producing legal or similarly significant effects. We do not engage in profiling of that kind, but the opt-out is available through the "Do Not Sell or Share" link in the footer.

State-specific notes:

• Connecticut. As of July 2026, we disclose under the CTDPA amendment that we do not use your inputs to train large language models.
• Texas. Our compliance with Texas TRAIGA prohibitions on AI is reflected in the acceptable-use rules at Terms §§4 and 5.7.
• Colorado. Tusk Central AI does not make consequential decisions and is therefore not subject to Colorado AI Act §6-1-1701 et seq. obligations as to TUSK.

10.4 Canadian residents (PIPEDA) — outside Quebec

This Policy is offered to Canadian residents outside the Province of Quebec. TUSK is not offered to Quebec residents, and we use country-level and Canadian region-level geo-restriction to block access from Quebec.

Canadian residents outside Quebec have the right to access, correct, and request deletion of personal information; to withdraw consent; to challenge our compliance with PIPEDA; and to file a complaint with the Office of the Privacy Commissioner of Canada at priv.gc.ca. Provincial privacy commissioners in British Columbia, Alberta, and other provinces may also have jurisdiction over complaints relating to organizations operating in their province.

§11 — International transfers

Our infrastructure is hosted in the United States. If you are a Canadian resident outside Quebec, your personal information is transferred to the United States for processing. Some of your personal information may also be transferred to additional countries when you select an upstream AI model that operates outside the United States (see §6.4). The destination countries currently include France (Mistral).

The transfer mechanism for Canadian users (outside Quebec) is cross-border transfer permitted under PIPEDA with notice and contractual safeguards. We use vendor DPAs and this Privacy Policy as notice.

If a destination country's legal regime materially changes — for example, if a new sanctions, export-control, or data-localization regime applies to a route in this section — we will update this Policy and, where required, notify users.

§12 — Security

We protect personal information using industry-standard technical and organizational measures, including encryption in transit (TLS 1.2 or higher) and at rest (AES-256), role-based access control, multi-factor authentication for administrative access, structured logging, separated production and non-production environments, and a formal incident-response process. We retain personal information only for the periods stated in §9, which limits the impact of any single incident.

We cannot, and do not, guarantee that any information system is impenetrable. If a security incident affects your personal information, we will notify you in accordance with §13 and applicable law.

§13 — Breach notification

If we determine that a security incident has affected your personal information, we will notify you and the relevant authorities in accordance with the laws of your jurisdiction. The applicable timelines include:

• California, most U.S. states. Without unreasonable delay, consistent with state breach-notification statutes.
• PIPEDA / Canada (outside Quebec). As soon as feasible, where there is a real risk of significant harm. We will also notify the Office of the Privacy Commissioner of Canada and maintain records of breaches as required by PIPEDA.

§14 — Marketing communications

We send marketing communications only to people who subscribe to the TUSK newsletter (Beehiiv). The newsletter is opt-in. Each newsletter contains a one-click unsubscribe link. We do not send marketing SMS messages.

We honor CAN-SPAM (U.S.) and Canada's Anti-Spam Legislation (CASL).

§15 — Copyright and DMCA

If you believe content available through TUSK infringes your copyright, send a notice to our DMCA Designated Agent. The procedure and contact details are in §8.5 of the Terms of Service.

§16 — Changes to this Policy

We will post the updated Privacy Policy with a new effective date. For material changes, we will notify you by email (if you have an account or have subscribed) or through an in-product banner at least 30 days in advance. Continued use of the Service after the effective date of an updated Privacy Policy constitutes your acknowledgment of the updated terms.

We maintain a public changelog at https://tuskcentral.ai/privacy-policy showing every material change to this Policy.

§17 — Contact us

Postal address (and address of the operating entity):
Virtual World Computing, LLC
5383 Hollister Avenue, Suite 120
Santa Barbara, CA 93111, USA

General privacy contact: support@tuskcentral.zendesk.com

California consumer privacy requests: https://privacy.ca.gov/ or support@tuskcentral.zendesk.com

Canadian privacy contact (outside Quebec): support@tuskcentral.zendesk.com

§18 — Changelog

End of Privacy Policy v1.0.