Privacy policy
Short version: everything the app captures stays on your device unless you sign in and turn sync on. Synced content is encrypted on the device with keys the relay never receives. The relay keeps what it needs to deliver envelopes between your devices, and deletes them once delivered or after 30 days. No advertising, no analytics, no sale of data.
1. What the app stores on your device
- Clipboard history (text, images, links, files you copy), screenshots and annotations, voice recordings and their transcripts, notes, and references to files you open.
- AI tab: the conversations you have in the tab, kept as items in the same local store as clips and notes (with sync on they sync sealed, like everything else). The agent's working folders live under
~/Library/Application Support/Clavarius/ai/. - Settings, the log file, and local crash reports (an uncaught exception writes its backtrace to
crashes/inside the container; nothing is sent).
All of this is in ~/Library/Containers/com.clavarius.mac/ on the Mac and in the app's own storage on the iPhone. The local database is not encrypted by the app; it relies on the device's disk encryption (FileVault on the Mac, data protection on the iPhone). Deleting the app's container deletes the data.
2. What leaves your device, and when
| What | To whom | When |
|---|---|---|
Version check: a GET for appcast.json (your IP address and user agent reach the server log) | api.clavarius.com | Once a day, and on "Check for Updates" |
| Account sign-in: email, password (over TLS; stored as a hash), device name and platform | api.clavarius.com | Only when you create an account or sign in |
| Synced items as sealed envelopes: ciphertext, channel name, size, timestamps, source and recipient device ids | api.clavarius.com | Only after sign-in, for the channels you sync |
| Voice recordings | Groq (api.groq.com), under your own API key | Only if you enter a Groq key in Voice settings. Without a key transcription runs on the device. |
| AI tab prompts, the context you attach, and the agent's tool activity | The AI vendor of the agent you chose (Anthropic, OpenAI or Google), through that vendor's own CLI on your Mac, under your own sign-in | Only when you send a message in the AI tab. Clavarius servers are not involved. |
| Answers to questions sent to your Mac through the relay (Relay MCP) | api.clavarius.com, then the app you connected | Only for apps you authorized, per request. See the threat model: these are readable by the relay while in flight. |
| iPhone crash reports: stack trace, device model, OS version, app version | Sentry (EU data center) | Only when the iPhone app crashes. No user identifiers, no content, no performance traces. |
The Mac app sends no crash reports and no usage statistics. There is no advertising identifier and no tracking.
3. Account
An account is needed only for sync. The auth server keeps your email, a password hash, a random 32-byte salt used by your devices to derive the first encryption key, short-lived pairing tokens (for adding a device by QR code; they expire and are consumed once), and, for apps you connect through OAuth, the app's name, hashed authorization codes and hashed refresh tokens with their scopes.
4. The relay
The relay keeps, per account: your devices (id, the device's own name such as "Max's MacBook", platform, capabilities, online state, last seen, public keys), sealed envelopes waiting for delivery (recipient device, channel name, kind, ciphertext, attached blob, size, the time your device created it, expiry), each device's read position, pending remote-procedure requests (source and target device, plugin, method, payload, time-to-live), the list of connected apps and the device they route to, and two settings (relay mode, keep backup).
If you turn on "keep backup", the relay also keeps a sealed copy of your history so a new device can restore without another device online. That copy is ciphertext; its size and growth are visible to the operator.
What the operator can read, and what not, is stated in full in the threat model.
5. Retention
- Envelopes: deleted once every live device has fetched them (with a 24-hour grace period), and in any case 30 days after they were posted. Attached blobs: 30 days.
- Remote-procedure requests: the payload is erased the moment the request is answered, cancelled or expired; expired rows are swept hourly.
- Pairing tokens: two minutes, consumed once. OAuth authorization codes: minutes, used once. Sign-in tokens: one hour (access), 30 days (refresh).
- Server logs (IP address, path, user agent, time): rotated daily, kept 14 days.
- Backup copy ("keep backup"): kept until you turn the setting off or delete the account.
- Everything about an account: deleted when the account is deleted.
6. Third parties
- Hetzner Online GmbH (Finland) hosts api.clavarius.com and this website.
- Sentry (Functional Software, Inc., EU region) receives iPhone crash reports.
- Groq, Inc. receives voice recordings only when you enter your own Groq key.
- Anthropic, OpenAI or Google receive AI tab prompts under your own account with them, through their own software on your Mac. Their terms and privacy policies apply to that traffic.
- Apple: TestFlight and the App Store, where you install from there.
No data is sold or shared for advertising. No third party gets content from your account; the relay cannot give what it cannot read.
7. Your rights
- Export: your data is on your devices, in a SQLite database and plain media files in the container; there is nothing on the relay you cannot regenerate from a device.
- Deletion: Settings, Sync, "Delete account" removes the relay data and then the account, in that order (if the relay purge fails, the account is kept and you see an error). Or write to support.
- Access and correction: write to support; we answer within 30 days.
- You may complain to your local data protection authority.
8. This website
No cookies, no analytics, no resources from other domains. The download page reads the version list from the same server. The web server logs IP address, path and user agent for 14 days.
9. Children
Clavarius is not directed at children under 16, and the relay does not knowingly hold accounts for them.
10. Changes
Changes to this policy are dated at the top. A change that widens what leaves your device is announced in the app's update notes before it takes effect.