Privacy Policy

The Browser

Web browser · iPhone and iPad

What stays on your device

Your browsing history, bookmarks, reading list, open tabs, favourites, quick links, settings, start-page layout, saved passwords, and any downloaded on-device AI models live only on your device — and, if you turn on iCloud Sync, in your own private iCloud. They are never sent to us or anyone else. Saved passwords and any AI provider keys you enter are held in the device Keychain, not in plain settings.

Requests you initiate

Like every web browser, The Browser makes network requests to fetch the things you ask for. These go directly from your device to the service involved and never pass through us:

• Web pages load from the sites you visit.
• Searches — and, if you enable them, search suggestions — go to the search engine you choose. Suggestions are always off in Private tabs.
• Site icons (favicons) are fetched from each site itself where possible; when a site offers none, the address is sent to Google’s public favicon service to find one.
• “Ask the Browser” searches the web to answer you: it queries Mwmbl, DuckDuckGo, Ecosia and Wikipedia — and Brave Search if you add a key — then fetches the result pages it cites so it can read them.
• Voice search sends your recording to Apple’s speech recognition. It stays on your device where the device supports on-device recognition, and goes to Apple’s servers where it does not.
• Translation downloads language packs from Mozilla’s servers the first time you use a language pair.
• On-device AI models are downloaded from Hugging Face when you choose to install one.
• Browser extensions are downloaded from addons.mozilla.org or the Chrome Web Store when you install one.
• The optional start-page photo picker sends your search term to Openverse — and, as a fallback, Wikimedia Commons — to find freely-licensed images.
• Any content blocklist you add is fetched from the URL you provide.

AI features

On-device AI — summaries and “Ask about this page” using a downloaded model or Apple Intelligence — runs entirely on your device. No page content leaves it, so it works even in Private tabs. If you point The Browser at an AI server you run yourself (Ollama, or another OpenAI-compatible endpoint), the text of the page is sent to that server — including from Private tabs, because that address is yours rather than a third party’s. Optional cloud AI works only if you add your own provider API key; then, and only then, the text of the page you ask about is sent directly from your device to that provider to generate a reply. We never receive or see it, and cloud AI is automatically disabled in Private tabs.

Translation

Page translation runs on your device. It uses Bergamot, an offline open-source engine bundled with the app, and falls back to Apple’s on-device translation where that is available. The first time you use a language pair, Bergamot downloads that language pack from Mozilla’s servers; after that it works offline. The text of the page itself is never sent anywhere. The optional developer API fallback ships inert and does nothing unless a key is supplied.

Private tabs

Private tabs record no history and no search suggestions, are kept out of the normal on-disk browsing cache, and disable cloud AI — for browsing that leaves no trace on your device. An AI server you host yourself is not treated as cloud AI and stays available in Private tabs, so page text is still sent to the address you configured.

Content blocking

The built-in ad and tracker blocker and the cookie-consent handling run locally in the browser engine to strip ads, trackers, and consent pop-ups as you browse. Any blocklist you add is fetched from the URL you provide.

Browser extensions

You can install Firefox and Chrome extensions. They are downloaded from addons.mozilla.org or the Chrome Web Store at your request. An extension runs inside the browser with the permissions its manifest asks for and can see the pages you give it access to — it is third-party code, and we neither review nor vouch for it. Remove one at any time in Settings ▸ Add-ons.

Third-party services

The services you choose to use — the sites you visit, your search engine, Google’s favicon service, the sources “Ask the Browser” searches, Apple’s speech recognition, Mozilla’s translation packs, Hugging Face, the extension stores, Openverse/Wikimedia, and any cloud AI provider you key in — each have their own privacy policies and terms, which govern how they handle the requests your device sends them. The open-source components bundled in the app are listed under Settings ▸ About ▸ Open-Source Licenses.

Deleting your data

Clear your history, cache, and cookies any time in Settings ▸ Clear Browsing Data. Deleting the app removes its on-device data, including downloaded AI models. AI provider keys and saved passwords are held in the device Keychain, which iOS can preserve across deleting and reinstalling an app — remove them in Settings first if you want them gone for good.

Kaffe Time

News reader · iPhone and iPad

What stays on your device

Kaffe Time keeps its reading data in the app on your device: the papers you follow and how you arrange them; the stories you have read, saved, or snoozed, and your reading activity; facts you tell it to remember and conclusions it draws from your reading; the article text, summaries, and briefs it has saved; and your settings and conversation history.

The detailed reading log never leaves the device. When the log is next written, events older than 14 days are reduced to daily counts, and counts older than 56 days are removed. Turning off Watch what I read clears the log. Memory facts stay until you delete them. iOS may include the app’s data in your device backup, depending on your backup settings.

Memory sync in iCloud

When you pull down to refresh Memory while signed in to iCloud, Kaffe Time syncs your memory facts — with where they came from, their evidence, and their dates — through the private iCloud database of your own Apple Account. It also syncs markers for facts you deleted, so they do not reappear on another device. Nothing else is synced: not the reading log, saved stories, followed papers, or conversation history. Sync never runs in the background, and we cannot see the records in your private iCloud.

Requests you initiate

• Feeds, article pages, and images load from the publishers you follow, as ordinary web requests that the site can see, including your IP address. Articles open in a private reader that keeps nothing between visits and blocks listed third-party resources. The Open the articles themselves switch controls whether whole articles are fetched automatically; with it off, Kaffe Time is a plain feed reader.
• While Looking is on, at most once a day, it searches for papers you might like: a phrase made from a language, a country, and a subject in your papers goes to DuckDuckGo, and to Ecosia if needed.
• On-device models, voices, and translation packs are downloaded from Hugging Face or Mozilla’s translation servers when you ask for one, or first use a language pair. What you translate or listen to is not part of the download.
• Serve & connect works only when you start it. A client you pair on your network can then ask Kaffe Time for news, summaries, and memory. A remote MCP server you add receives connection and tool-call data, and Kaffe Time asks before each remote call unless you have marked that tool as trusted.

AI, speech, and translation

Briefs, answers, read-aloud, and translation run on your device. Cloud model settings are off by default, and choosing a provider sends nothing by itself; any call to a cloud provider asks for your approval first and shows what would be sent.

Deleting your data

Delete a single fact in Memory, or use Forget everything to clear the facts on this device, its reading log, and its Ask thread; facts not yet synced from another device may still arrive later. The next successful Memory sync removes deleted facts from your iCloud as well. Deleting the app removes its data from the device but not its records in your iCloud, so delete facts and sync before removing the app if you want them gone everywhere.

Wspr

Meeting recorder · iPhone and Mac

What stays on your device

Recordings, transcripts, recaps, notes, and chats are stored on your iPhone and Mac. Questions you ask about a meeting, and their answers, are kept with that meeting on the device and are not synced; deleting the meeting removes them. Recordings you import are copied in, and the original file is never changed.

Microphone, audio, and calendar

• The microphone records only when you start a recording.
• On a Mac, Wspr captures a call’s audio when you choose to record it. On iPhone, with your permission, it captures audio playing on the phone during a meeting so remote voices can be transcribed.
• With calendar access, Wspr reads meetings from the calendars on your device to suggest recordings and remind you before they start. It never changes your calendar.

Transcription and AI

Transcription runs on your device, using Apple’s on-device speech recognition and speech models you download. Recaps and chat use the model you pick: a model downloaded to your device from Hugging Face and checked against known hashes before it loads, Apple Intelligence on supported devices, or an Ollama server you run yourself. With Ollama, your question and transcript excerpts are sent to that server — never the audio.

Sync between your devices

Recordings sync between your iPhone and Mac through the private iCloud database of your own Apple Account, not a server of ours. You can also choose to sync through your Mac over your local network, or through a storage location you pick: a folder (including a cloud-storage folder or a network drive) or your Jottacloud account, signed in with a personal login token kept in the device Keychain. Wherever you choose, your meetings are stored there under that provider’s terms.

AI apps on your Mac

On a Mac, you can let AI desktop apps you use read meetings through Wspr’s local MCP connection. It is off for every meeting until you turn it on for that meeting, and works only for apps you set up with the access token Wspr gives you. Once an AI app reads a meeting, what it does with that text — including sending it to its own servers — is governed by that app’s privacy policy.

Tidy Lite

Disk cleaner · Mac

No network at all

Tidy Lite never connects to the internet. It runs in the Mac App Store sandbox without permission to make network connections, so it cannot send anything anywhere, even by mistake. It contains no third-party code or services.

What it looks at

To show you where your storage went, Tidy Lite reads how your disk is laid out and how much space each part uses; the names, sizes, and dates of folders where old macOS installs and developer tools pile up, including the Preboot volume and, if you allow it, the Library folder you choose; the names of local Time Machine snapshots; and your Software Update settings, where macOS lets it. The results stay in memory while the app is open, and are never saved.

What it remembers

When you choose your Library folder, Tidy Lite remembers that choice as a bookmark in its own preferences, so it does not ask again. macOS may also keep ordinary window settings, such as size and position. To remove all of it, delete the app and its container folder, ~/Library/Containers/com.camilobotero.tidy.appstore.

The Recovery script

If you ask Tidy Lite to help remove an unused boot folder, it saves a small script where you choose. The script contains three technical IDs for your disk volumes, a macOS version number, and a size — not your name, your files, or any account details. Tidy Lite never runs it; you do.

Kobito

AI agents · iPhone, iPad and Mac · coming soon

What stays on your device

Your lanes — what you write, your agents’ replies, and the results of the tools they use — are kept in the app on your device, along with your crew of agents, the facts they remember, your skills, your approval rules, and your settings. API keys and server tokens are held in the device Keychain, not in plain settings. None of it is sent to us.

Sync between your devices

Kobito syncs lanes, agents, memory, skills, and settings between your iPhone, iPad, and Mac through the private iCloud database of your own Apple Account, not a server of ours, and we cannot see the records in it. API keys and server tokens move through iCloud Keychain. Sign-ins to connected services, device permissions, and the local connector stay on each device.

AI models

Each lane uses the model you choose. Apple’s on-device model, the default, runs on your device and sends nothing anywhere. If you choose a cloud provider — OpenRouter, Anthropic, OpenAI, Google Gemini, Groq, xAI, DeepSeek, or Mistral — what the lane’s agent works with goes directly from your device to that provider to generate replies: what you write, the facts it remembers, and the results of its tools, such as calendar events or web pages. That provider’s own privacy policy applies. Kobito asks once for each provider before it sends anything, and you can withdraw that in Settings ▸ Models. Connecting OpenRouter opens OpenRouter’s own sign-in page, which gives Kobito a key for your account. With a server you run yourself, such as Ollama or LM Studio, lanes go to the address you set.

What agents can use

• Web pages an agent reads are fetched directly from your device, as ordinary requests the site can see, including your IP address.
• With your permission, agents can use Calendar, Reminders, Contacts, and your location, and schedule notifications on the device. Steps that read your personal information or change your data ask for your OK each time, unless you change that rule in Settings ▸ Approvals; anything destructive always asks.
• MCP servers you add receive the tool calls your agents make to them, with the sign-in or token you gave them. Searching the official MCP Registry sends your search term to registry.modelcontextprotocol.io.
• If you connect Outlook, you sign in on Microsoft’s own page, and agents then search, read, draft, and send email in that account directly from your device. Sending asks for your OK unless you change that rule. Signing in to GitHub works the same way, through GitHub.
• Drafts of emails, messages, and posts open in the app you pick, such as Mail or Gmail, and you decide whether to send them.

Other AI apps

AI apps on your Mac or Wi-Fi network, such as Claude Desktop or Cursor, can use your crew through Kobito’s local connector. It is off until you turn it on, answers only while Kobito is open, and works only for apps you give the access key Kobito shows. Using Kobito from Claude.ai or ChatGPT on the web needs a connector server at a public address, which you run yourself; we do not operate one. While it is on, Kobito sends that server a summary of each lane — its title, agent, status, latest activity, and latest reply — and picks up the tasks, messages, and questions those apps send. Once another AI app reads your lanes, what it does with them is governed by that app’s privacy policy.

Deleting your data

Delete a lane and Kobito erases it on this device and in your iCloud, and your other devices remove it too. The facts your agents remember are listed in the app, and you can delete any of them. Deleting the app removes its data from the device but not its records in your iCloud or the keys in iCloud Keychain, so delete lanes and remove keys in the app first if you want them gone everywhere.