Privacy policy

01What we collect

Account data

• Email address
• Password hash (we never store your password itself)
• Whether your email address is verified

Purchase data

• Receipt email
• The product you bought, the amount and currency
• Transaction identifiers and their status

License and activation data

• Your license
• For each Mac you activate: an identifier made for that license (a one-way value, not your Mac’s serial number), the Mac’s model name and a device key
• When each Mac was activated and the day it last checked in. Check-ins record the day, never your IP address.

Support

• What you write to support@lonelyduck.io, and what we answer
• A diagnostics report, if you choose to send one from Canto (you see all of it before it goes)

Operational data

• Server logs for the website and the API (IP address, user agent, times)
• Security logs, such as failed sign-ins

02This website

Visit counts

lonelyduck.io counts visits with Umami, which we run ourselves at analytics.lonelyduck.io. The counts stay with us and aren’t shared with anyone, and no cookies are used for them.

• What is counted: for each page you open, its address without anything after a ? or a #, the page’s title, the site you came from (if you followed a link from another site, also without ? or #), your screen size and your browser’s language.
• What is worked out from the request: your browser, operating system and kind of device, and your country, region and city. Your IP address and your browser’s full user-agent string aren’t stored.
• Counting visitors without cookies: Umami keeps a one-way identifier made from the site, your IP address and browser, and a value that changes every month, so the same browser on the same network counts as one visitor for a calendar month.
• Never counted: pages whose address holds a license, a code or a token (activating a license, linking Canto to your account, the order page after checkout, verifying an email, resetting a password, signing in from an app), and published notes.
• Do Not Track and Global Privacy Control are honoured: with either turned on in your browser, the counter doesn’t load.
• Opt out: “Opt out” in the footer of every page turns counting off in this browser. It stores one flag in the browser’s local storage (Umami’s own off switch) so it stays off; “Undo” removes it.
• How long: visit data are kept for up to 25 months, then deleted.

Fonts

The site’s typefaces are served from lonelyduck.io itself. Your browser doesn’t contact Google Fonts or any other font service.

Cookies and storage

The site sets one cookie, and only when you choose a currency on a pricing page (ld_currency, to remember it for a year). Signing in keeps your session in this browser’s local storage, and the site remembers your light or dark choice the same way. None of these are used to follow you around.

03The Canto app

Canto runs on your Mac. Your notes stay there unless you choose a feature that sends them somewhere, and Canto lists every such feature, each with a real switch, in Settings › Memory & privacy › What leaves this Mac. Canto 1.0 has 13:

1. Web search. When a chat or research looks something up, the words of the search go to the search services you set up, and pages, including links you paste into a chat, are read from their sites (or through a search service you set up, when a site turns Canto away).
2. Site icons. With Site icons on, the icon of a web source is fetched from that source’s own site when it is shown.
3. Pictures from the web. A picture in a note or chat that points at a website loads from that site when it is shown, so the site sees that your Mac opened it; no note text is sent. With it off, such a picture loads only when you press Load on it.
4. Pages you link to. With it on, Canto fetches the web pages, videos and PDFs your notes link to, from their sites.
5. Cloud models. Off until you connect a cloud provider (such as OpenRouter) or add a server that is not on your Mac, and you can turn them off in What leaves this Mac. When you send a chat to a cloud model, your question, the chat so far and the notes that chat reads go to that provider and to the company that runs the model, under their terms. Unless you change it, Canto asks OpenRouter to use only hosts that keep nothing. Canto never sends notes to a cloud model for work you did not start, such as meetings, titles, tags or search. You pay the provider directly; we never receive your notes, your questions or your key. Can send note text.
6. iCloud sync. With sync on, your notes go to your own iCloud account, encrypted on your Mac first with a key only your Macs have. Apple cannot read them and we never receive them.
7. Other apps (MCP). With Canto’s MCP server on, apps you connect can read your notes, and with Pro change them. What they do with your notes is up to those apps. Can send note text.
8. Publishing. A note you publish goes to LonelyDuck’s publishing service when you press Publish, and is public at its address until you unpublish it.
9. License checks. Canto Free sends nothing about a license. With Pro, your Mac activates once and then renews with LonelyDuck about twice a week, sending your license, an identifier for your Mac made for that license, and your Mac’s model, never your notes. Canto also reads an anonymous list of switched-off licenses, so a refunded or released license stops working; you can turn these live updates off.
10. Update checks. At launch and every 6 hours Canto asks GitHub, where its releases are published, whether there is a newer version. You can turn this off and check by hand.
11. Usage data. Off unless you turn it on. It sends LonelyDuck counts of which features are used and anonymous errors, never the text of your notes.
12. Model downloads. Models come from Hugging Face when you choose to download one.
13. Diagnostics. A report is sent only when you press Send diagnostics, after you have seen everything in it.

Of these, LonelyDuck itself receives only: your license, your Mac’s identifier and model when you activate Pro and about twice a week after that; the notes you publish, until you unpublish them; usage data, if you turn it on; and a diagnostics report, if you send one. Sync goes to your own iCloud account, encrypted on your Mac first, so neither Apple nor we can read it. Answers from models on your Mac, search by meaning, dictation and meeting transcripts all run on your Mac.

What leaves this Mac, in the Canto guide, has each service with where it goes, when, its default and its switch. Canto 0.10.3, the previous stable release, shows its own list in its settings.

04The Tulip app: what leaves your Mac

Tulip reads the library you keep in the Music app on your Mac and keeps its index there. Your library and your music files never leave the Mac. These are the only hosts Tulip contacts, why, and what each receives:

• api.lonelyduck.io · license and updates
  License activation and renewals (about twice a week), the anonymous revocation list, and the Apple Music developer token. Your license, a one-way Mac id (a hash, not your serial number), the Mac’s model name and a device key. Renewals record only the day, never an IP.
• lonelyduck.io · license and updates
  The update feed. A request for the release list. An update downloads only when you start it.
• lrclib.net · only when you use the feature
  Lyrics. Title, artist, album and duration of the songs you look up.
• musicbrainz.org · coverartarchive.org · archive.org · only when you use the feature
  Release data and album art (Cover Art Archive stores its images on archive.org). Artist and album names, and release ids.
• itunes.apple.com · is1–is5-ssl.mzstatic.com · audio-ssl.itunes.apple.com · only when you use the feature
  Artwork, catalogue search and 30-second previews. The artist, album or song you search for; then the cover images and previews you open.
• api.music.apple.com · js-cdn.music.apple.com · only when you use the feature
  Apple Music’s catalogue, when you use Discover. Your searches; adding to your library also sends your Apple Music authorization.
• authorize.music.apple.com · idmsa.apple.com · appleid.apple.com · only when you use the feature
  Apple’s own sign-in page, only when you connect Apple Music. What you type on Apple’s page goes to Apple. Tulip never sees your Apple ID or password.
• huggingface.co and its download hosts · only when you use the feature
  The Labs sound model, downloaded once when you turn on Labs. A download request. Nothing about your music.
• api.listenbrainz.org · labs.api.listenbrainz.org · only when you use the feature
  Listening history import and similar artists. Your ListenBrainz username (and token, if you add one); artist ids for similar artists.
• ws.audioscrobbler.com · only when you use the feature
  Last.fm, only if you add your own Last.fm API key. Your Last.fm username and your API key.

• Your library and your music files never leave the Mac.
• No IP address or location lookups.
• License renewals record only the day, never an IP.

The hosts marked “only when you use the feature” are contacted only when you use lyrics, artwork, catalogue or listening features, and each runs under its own terms and privacy policy. Settings › Sources › What leaves this Mac in Tulip lists the same.

05opsty and subtank

opsty.dev and subtank.dev are separate sites with their own privacy pages (opsty, subtank); this policy covers lonelyduck.io, its store and the apps sold here.

06What we don’t collect

• We don’t store your payment card details; Stripe and PayPal handle them.
• We don’t sell personal information, and we don’t run advertising or third-party trackers.
• We never receive your notes, your questions to a model, your music library or your cloud model keys.

07How we use your data

• Process purchases, deliver licenses and receipts, and provide downloads.
• Keep licenses working on your Macs, and turn them off after a refund or a chargeback.
• Authenticate accounts and keep the platform secure.
• Answer support requests.
• Count visits, to see which pages people read.
• Prevent fraud and abuse.

08Third parties

We use these services to run the store and the apps’ downloads:

• Payment processing: Stripe and PayPal
• Email delivery: SendGrid (verification, license and receipt emails)
• Hosting and infrastructure for lonelyduck.io and its API
• GitHub, where Canto’s releases are published and where Canto checks for updates

And these only when you use a feature that needs them, from your Mac:

• Canto: the search services and cloud model providers you set up, Hugging Face for model downloads, and Apple iCloud for sync
• Tulip: the lyrics, music-data and listening services in section 04

09How long we keep it

We keep data as long as we need it to provide licenses, support, accounting and security. Visit data are deleted after 25 months. You can ask us to delete your data where the law and running the store allow it.

10Your choices

You can ask to see, correct or delete your personal data by writing to support@lonelyduck.io. For support requests, include your receipt email and, if you have it, the order id. You can opt out of visit counting at any time with “Opt out” in the footer.

For purchase policies, see the terms of service and the refund policy.