Changelog.

What Canto Sends, and What It No Longer Does

• The installation check-in is gone. Until now, Canto sent a small message to our server at launch and every 5 minutes: an installation ID, the app and macOS versions, and your license key if you had one. It ran even if you had turned usage statistics off, and nothing in Canto told you about it. That was wrong, and it's removed.
• License checks every 6 hours, not every 10 minutes. Canto still checks, so a refunded or revoked license stops working, but it asks far less often.
• Activation asks less. Activating a license no longer looks up your public IP address or your city through third-party services, and license requests no longer include your Mac's name or macOS build. On its next license check, Canto replaces the Mac name we had stored with "Mac".
• Update checks every 6 hours, plus once at launch, instead of every 5 minutes.
• Usage statistics can't be tied to your license. If you opted in, they no longer carry a value derived from your license key.

What still leaves your Mac: license checks (only if you have a license); without a license, a check of how many free AI tries are left (an id for this Mac, the app version and the platform, when Canto opens and when your Mac comes back online); update checks; and the things you turn on or send yourself — Sync, Publishing, web search, cloud models, diagnostics reports, and usage statistics if you opted in.

Chat Receipts Tell the Truth About Cloud Models

The context receipt under a Canto Chat answer said Privacy: Local only whenever no web search ran — even when the answer came from a cloud model, such as an Ollama cloud model. In that case your question, and the notes Canto read for it, went to that service.

The receipt now says where the answer was made: Local only, Cloud model, Model on your network, or Model on a remote server, and whether the web was used. Answers from before this update are relabeled too.

Undo for Delete

The trash icon on a sidebar item moved it to the Trash in one click, and for notes and notebooks said nothing at all. Now Canto says Note moved to Trash with the note's title and an Undo button, and the same for notebooks, canvases and chats. Deleted items still go to the Trash, where they stay until you empty it.

The Trash window now closes with Esc.

Security Fixes

• Keychain. Saving a key or password in the Keychain no longer passes it through a command shell, so a value with special characters can't run a command, and secrets no longer show up in the list of running processes. Your existing Keychain items stay where they are, and you won't see new Keychain prompts.
• Development settings are ignored in the installed app. Settings meant for development, such as loading the interface from a local test server, could change how the installed app behaved if another program launched it that way. The installed app now ignores them.
• MCP automation needs your token. If you turned on the MCP automation tools, the installed app ran them without checking the access token. It now requires the token set in Settings.
• Your database key is kept. If Canto couldn't find your database where it expected — for example, a data folder on a disk that wasn't connected — it replaced the database's encryption key, which would have left the real database unreadable. It now keeps the key.
• Updated components. The editor, and the components that clean pasted content, read PDFs and parse web pages, are on their latest fixes.

A New Icon

A plume tucked under a notebook's band. The menu bar icon follows it and adapts to light and dark menu bars. On macOS 26 and later, the app icon follows the system's icon styles.

Getting Ready for Canto 1.0

This release changes how Canto's updates are signed so the next major version can arrive as a normal update. Nothing changes for you now.

Close this tab whenever you're ready — it won't appear again.