Privacy policy

01What we collect

Account data

• Email address
• Password hash (we never store your password itself)
• Whether your email address is verified

Purchase data

• Receipt email
• The product you bought, the amount and currency
• Transaction identifiers and their status

License and activation data

• Your license
• For each Mac you activate: an identifier made for that license (a one-way value, not your Mac’s serial number), the Mac’s model name and a device key
• When each Mac was activated and the day it last checked in. Check-ins record the day, never your IP address.

Support

• What you write to support@lonelyduck.io (or support@saferow.app), and what we answer
• A diagnostics report, if you choose to send one from Canto or Saferow (you see all of it before it goes)

Operational data

• Server logs for the website and the API (IP address, user agent, times)
• Security logs, such as failed sign-ins

02This website

Visit counts

lonelyduck.io counts visits with Umami, which we run ourselves at analytics.lonelyduck.io. The counts stay with us and aren’t shared with anyone, and no cookies are used for them.

• What is counted: for each page you open, its address without anything after a ? or a #, the page’s title, the site you came from (if you followed a link from another site, also without ? or #), your screen size and your browser’s language.
• What is worked out from the request: your browser, operating system and kind of device, and your country, region and city. Your IP address and your browser’s full user-agent string aren’t stored.
• Counting visitors without cookies: Umami keeps a one-way identifier made from the site, your IP address and browser, and a value that changes every month, so the same browser on the same network counts as one visitor for a calendar month.
• Never counted: pages whose address holds a license, a code or a token (activating a license, linking Canto to your account, the order page after checkout, verifying an email, resetting a password, signing in from an app), and published notes.
• Do Not Track and Global Privacy Control are honoured: with either turned on in your browser, the counter doesn’t load.
• Opt out: “Opt out” in the footer of every page turns counting off in this browser. It stores one flag in the browser’s local storage (Umami’s own off switch) so it stays off; “Undo” removes it.
• How long: visit data are kept for up to 25 months, then deleted.

Fonts

The site’s typefaces are served from lonelyduck.io itself. Your browser doesn’t contact Google Fonts or any other font service.

Cookies and storage

The site sets one cookie, and only when you choose a currency on a pricing page (ld_currency, to remember it for a year). Signing in keeps your session in this browser’s local storage, and the site remembers your light or dark choice the same way. None of these are used to follow you around.

03The Canto app

Canto runs on your Mac. Your notes stay there unless you choose a feature that sends them somewhere, and Canto lists every such feature, each with a real switch, in Settings › Memory & privacy › What leaves this Mac. Canto 1.0 has 15:

1. Web search. When a chat or research looks something up, the words of the search go to the search services you set up, under their terms, and pages, including links you paste into a chat, are read from their sites, or through a search service you set up when you choose one to read pages or when a site turns Canto away; that service then receives the page’s address. Pictures or files you ask a chat to save are downloaded from their own sites.
2. Site icons. With Site icons on, the icon of a web source is fetched from that source’s own site when it is shown.
3. Pictures from the web. A picture in a note that points at a website loads from that site when it is shown, and the site receives the picture’s whole address, so it sees that your Mac opened it. With it off, such a picture loads only when you press Load on it. A picture a model writes never loads by itself, whatever this setting says: a chat shows its address before you press Load, and a note keeps it as a link.
4. Pages you link to. With it on, Canto fetches the web pages, videos and PDFs your notes link to, from their sites.
5. Cloud models. Off until you connect a cloud provider (OpenRouter, Ollama Cloud, or Anthropic, OpenAI, Google AI Studio, xAI, Mistral, DeepSeek or Groq with your own key) or add a server that is not on your Mac, and you can turn them off, each provider on its own, in What leaves this Mac. When you send a chat to a cloud model, your question, the chat so far, the notes and files it reads (including files in folders you linked) and pictures you attach, for a model that reads images, go to that provider and to the company that runs the model, under their terms. Unless you change it, Canto asks OpenRouter to use only hosts that keep nothing. While Ollama Cloud models are on, listing them asks Ollama for each model’s settings, which sends only the model’s name; Ollama Cloud connected with your own key receives your chats at ollama.com with that key. Canto never sends notes or files to a cloud model for work you did not start, such as meetings, titles, tags or search. You pay the provider directly; we never receive your notes, your questions or your key. Can send note text.
6. iCloud sync. With sync on, your notes go to your own iCloud account, encrypted on your Mac first with a key only your Macs have. Apple cannot read them and we never receive them.
7. Other apps (MCP). With Canto’s MCP server on, apps you connect can read your notes, and with Pro change them. What they do with your notes is up to those apps. Can send note text.
8. Other apps (links). Apps on your Mac that you allow can ask Canto for the title and canto:// link of the note, canvas or chat you have open; Canto asks you before an app gets them, unless you always allow that app. They never receive a note’s text. What they do with the title and link is up to those apps.
9. Publishing. A note you publish goes to LonelyDuck’s publishing service when you press Publish, and is public at its address until you unpublish it.
10. License checks. Canto Free sends nothing about a license. With Pro, your Mac activates once and then checks in with LonelyDuck about twice a week, sending your license, an identifier for your Mac made for that license, and your Mac’s model, never your notes. Canto also reads an anonymous list of switched-off licenses, so a refunded or released license stops working; you can turn these live updates off.
11. Update checks. At launch and every 6 hours Canto asks GitHub, where its releases are published, whether there is a newer version. You can turn this off and check by hand.
12. Usage data. Off unless you turn it on. It sends LonelyDuck counts of which features are used and anonymous errors, never the text of your notes.
13. Model downloads. Models come from Hugging Face when you choose to download one.
14. Diagnostics. A report is sent only when you press Send diagnostics, after you have seen everything in it.
15. Contact support. When you press Contact support, LonelyDuck’s support page opens in your browser, and its address gives LonelyDuck Canto’s version, your macOS version, your Mac’s model and memory, the kind of problem when Canto knows it (such as a license that stopped working) and, after you sent a diagnostics report, its reference, so the page can fill in your message. It never includes your notes or your license; your message itself goes only when you send it.

Of these, LonelyDuck itself receives only: your license, your Mac’s identifier and model when you activate Pro and about twice a week after that; the notes you publish, until you unpublish them; usage data, if you turn it on; and a diagnostics report, if you send one. Sync goes to your own iCloud account, encrypted on your Mac first, so neither Apple nor we can read it. Answers from models on your Mac, search by meaning, dictation and meeting transcripts all run on your Mac.

What leaves this Mac, in the Canto guide, has each service with where it goes, when, its default and its switch. Canto 0.10.3, the previous stable release, shows its own list in its settings.

04The Tulip app: what leaves your Mac

Tulip reads the library you keep in the Music app on your Mac and keeps its index there. Your library and your music files never leave the Mac. These are the only hosts Tulip contacts, why, and what each receives:

• api.lonelyduck.io · license and updates
  License activation and, while this Mac is activated, renewals (about twice a week), the anonymous revocation list and the Apple Music developer token. Your license, a one-way Mac id (a hash, not your serial number), the Mac’s model name and a device key. Renewals record only the day, never an IP. A Mac on Free or the trial sends nothing about a license.
• lonelyduck.io · license and updates
  The update check: about every 6 hours Tulip reads the release feed (Settings › General › Updates › Check automatically turns it off). A request for the release list, the same from every copy: no install id, nothing about your library. An update downloads only when you press Download.
• lrclib.net · only when you use the feature
  Lyrics. Title, artist, album and duration of the songs you look up.
• musicbrainz.org · coverartarchive.org · archive.org · only when you use the feature
  Release data and album art (Cover Art Archive stores its images on archive.org). Artist and album names, and release ids.
• itunes.apple.com · is1–is5-ssl.mzstatic.com · audio-ssl.itunes.apple.com · only when you use the feature
  Artwork, catalogue search and 30-second previews. The artist, album or song you search for; then the cover images and previews you open.
• api.music.apple.com · js-cdn.music.apple.com · only when you use the feature
  Apple Music’s catalogue, when you use Discover. Your searches; adding to your library also sends your Apple Music authorization.
• authorize.music.apple.com · idmsa.apple.com · appleid.apple.com · only when you use the feature
  Apple’s own sign-in page, only when you connect Apple Music. What you type on Apple’s page goes to Apple. Tulip never sees your Apple ID or password.
• huggingface.co and its download hosts · only when you use the feature
  The Labs sound model, downloaded once when you turn on Labs. A download request. Nothing about your music.
• api.listenbrainz.org · labs.api.listenbrainz.org · only when you use the feature
  Listening history import and similar artists. Your ListenBrainz username (and token, if you add one); artist ids for similar artists.
• ws.audioscrobbler.com · only when you use the feature
  Last.fm, only if you add your own Last.fm API key. Your Last.fm username and your API key.

• Your library and your music files never leave the Mac.
• No IP address or location lookups.
• License renewals record only the day, never an IP.

The hosts marked “only when you use the feature” are contacted only when you use lyrics, artwork, catalogue or listening features, and each runs under its own terms and privacy policy. Settings › Sources › What leaves this Mac in Tulip lists the same.

05The Saferow app and saferow.app

Saferow is a Mac app for your databases, from saferow.app. What the app sends, host by host and field by field, is in What leaves this Mac, next to the app it describes. Your connections, queries, rows and conversations stay on your Mac unless you choose a model in the cloud. This section covers what reaches LonelyDuck: Saferow Pro, sold here, and what saferow.app's own server keeps.

Saferow Pro's license

• Saferow Free involves no license. It never contacts api.lonelyduck.io and sends us nothing about a license.
• Buying: the purchase data in section 01 (your receipt email, the order and its identifiers).
• Activating a Mac: your license, an identifier made for that license from the Mac’s hardware id (a one-way value, not the id itself), the Mac’s model name, and a device key made on that Mac. The key’s private half never leaves the Mac’s Keychain.
• Checking in: Pro on each Mac runs on a 30-day lease. About twice a week Saferow renews it, sending only its activation id and a signature made with that device key. We keep the day each Mac last checked in, never your IP address. Without a connection Pro keeps working until the lease ends, up to 30 days.
• Refunded licenses: Saferow Pro fetches an anonymous, signed list of refunded activations from api.lonelyduck.io and keeps one connection open that only says when the list changes. These requests carry nothing about you, your license or your Mac, are the same for everyone, and aren’t logged; the comparison happens on your Mac.
• Your Macs: Saferow › Settings › License, and Account › Saferow here, list the Macs on your license. Release frees a Mac’s place and that Mac goes back to Saferow Free; its record stays with the license, marked released.
• A refund turns Pro off on the license’s Macs, which go back to Saferow Free. Nothing in Saferow is deleted.
• Licenses from the beta (issued before 17 October 2026) are checked on your Mac by their signature and send nothing.
• Never: Saferow never calls LonelyDuck’s telemetry endpoint (the one Canto’s optional usage data uses), and it sends us nothing about your databases, queries, rows, conversations or the AI models you use. Its licensing talks only to api.lonelyduck.io.

The buy and activate pages are lonelyduck.io pages, so section 02 applies to them; the activate page is never counted, and its license stays after the # in the link, which your browser doesn’t send to a server.

saferow.app and its forms

saferow.app and dl.saferow.app (Saferow’s site, downloads and update feed) are served from a server we rent from DigitalOcean in San Francisco, apart from lonelyduck.io. Its public pages set no cookies and run no analytics script. It keeps:

• An access log: each request’s time, IP address, the address asked for and its headers, such as the user agent and the page that linked there (cookie and authorization headers are written as “REDACTED”). A line is deleted after about 8 days. Counts made from it (visits, downloads, update checks) use a key that changes every day and is never written down, so they hold no address; they are kept 13 months, and download, update and install totals for as long as Saferow exists.
• The 1.0 email (saferow.app/beta/): your address and a link to confirm it. An address not confirmed within 7 days is deleted. When Saferow 1.0 ships every confirmed address gets one email, and then the whole list is deleted. Confirming is your consent; withdraw it by writing to us and the address is deleted.
• Support and Report a Problem: the support form on saferow.app and Help › Report a Problem… in the app send your address, your message and, from the app, the diagnostics you saw and approved before sending (never host names, user names, database names, SQL, keys or passwords). Kept 180 days, as is the record of emails sent, then deleted.
• Who processes it: DigitalOcean (hosting, United States), Resend (the confirmation and support emails, United States) and Google Workspace (the support@ and security@saferow.app mailboxes; a conversation is deleted 180 days after it ends). The server’s nightly backups are kept 14 days and DigitalOcean’s weekly copies about 4 weeks, so a deletion reaches them within that time.

06The Carriel app

Carriel is a Mac app, from carriel.app, for the private things you keep around: API keys, passwords, recovery codes, notes and small files. It keeps them in your pouch, sealed on your Mac before they reach your own iCloud. LonelyDuck never receives your things, their values, their names or their notes. Carriel lists every host it can contact under What leaves this Mac in its Settings, and carriel.app/privacy/ shows the same list.

What reaches LonelyDuck

• The free pouch involves no license. Carriel without the bigger pouch never contacts api.lonelyduck.io and sends us nothing about a license.
• Buying the bigger pouch: the purchase data in section 01 (your receipt email, the order and its identifiers), paid by card through Stripe.
• A Mac using your license: when the license reaches a Mac (you enter it, or iCloud Keychain brings it from your other Macs), that Mac sends your license, an id made for that Mac and that license (a one-way value from the Mac’s hardware id, never the id itself), the Mac’s model (like “MacBook Air · M2”, never the computer’s name), a public key and a signature, and receives that Mac’s 30-day lease. The public key is the Mac’s device key, made on that Mac; its private half never leaves the Mac.
• Checking in: about twice a week after that, right after you enter, release or remove the license on one of your Macs, and when you open Settings › About on a Mac an hour or more after its last check, each Mac that uses your license renews its lease, sending only the id LonelyDuck gave that Mac and a signature made with its device key. The Mac where you acted tells your other Macs through your own iCloud, never through us. We keep the day each Mac last checked in, never your IP address. Carriel Updater, part of Carriel, makes these requests; Carriel has no revocation list or stream to fetch.
• Your Macs: Carriel’s Settings › About › Macs…, and Account › Carriel here, list the Macs that use your license (up to 10); Macs… sends the license. Release sends the license and the id of the Mac it releases, and frees that Mac’s place; its record stays with the license, marked released.
• A refund ends the license; the first of your Macs to check in hears it (or at once, with Check Now), tells your other Macs through your own iCloud, and each becomes a free pouch again. Nothing in your pouch is deleted or hidden.
• Never: Carriel never calls LonelyDuck’s telemetry endpoint (the one Canto’s optional usage data uses), and sends us nothing from your pouch. Its license checks talk only to api.lonelyduck.io.

What the app contacts

• *.icloud.com, *.icloud-content.com, *.apple-cloudkit.com · your pouch, in your own iCloud
  Carriel keeps your pouch in your own iCloud account, in CloudKit’s private database, and the keys that encrypt it in iCloud Keychain. Every thing is encrypted on your Mac before it is sent; values, names and notes never leave your Mac unencrypted. Apple can see how many records there are, their sizes and when they change.
• dl.carriel.dev · updates, at launch and about once an hour
  When Carriel starts, about once an hour while your Mac is awake, and when you choose Check Now, Carriel asks whether a newer version exists. The request holds the version you run and nothing unique to your Mac, and dl.carriel.dev keeps no log of update checks. Carriel checks an update’s signature and Apple’s notarization before installing it. You can have it ask first, or turn update checks off, in Settings › About.
• api.lonelyduck.io · only with the bigger pouch
  When the license reaches a Mac, Carriel Updater sends the license, an id made for this Mac and this license, the Mac’s model (like “MacBook Air · M2”, never its name), a public key and a signature, and brings back this Mac’s 30-day lease. About twice a week after that, right after you enter, release or remove the license on one of your Macs, and when you open Settings › About on a Mac an hour or more after its last check, each Mac sends only the id LonelyDuck gave it and a signature. Macs… sends the license, and Release the license and the Mac it releases. Nothing from your pouch goes with any of them. Carriel without the bigger pouch never contacts it.
• carriel.app, lonelyduck.io, support.apple.com · only when you click a link
  A link you click in Carriel, such as Help, Get the Bigger Pouch… or Find My License, opens in your browser, which connects to that site. Carriel itself sends nothing there.

Nothing else leaves your Mac. Carriel sends no usage data, no analytics and no crash reports of its own, and has no server of its own that learns what is in your pouch. The buy and license pages (/carriel/buy, /carriel/activate) are lonelyduck.io pages, so section 02 applies to them; the license page is never counted, and its license stays after the # in the link, which your browser doesn’t send to a server. Support works by email: never send anything from your pouch.

07Opsty and subtank

Opsty and subtank are free apps from opsty.dev and subtank.dev, separate sites with their own privacy pages (Opsty, subtank).

Opsty makes one network request of its own, the update check: about a minute after it opens, then about once a day and when your Mac wakes, it asks dl.opsty.dev whether there is a new version, with no account and no install id. Settings › Privacy › Check for updates in Opsty turns it off (updates = "off" in its config file); Help › Check for Updates… still asks when you choose it.

This policy covers lonelyduck.io, its store and the apps in the sections above.

08What we don’t collect

• We don’t store your payment card details; Stripe and PayPal handle them.
• We don’t sell personal information, and we don’t run advertising or third-party trackers.
• We never receive your notes, your questions to a model, your music library, your databases or their rows, or your cloud model keys.
• We never receive what is in your Carriel pouch: your things, their values, their names or their notes.

09How we use your data

• Process purchases, deliver licenses and receipts, and provide downloads.
• Keep licenses working on your Macs, and turn them off after a refund or a chargeback.
• Authenticate accounts and keep the platform secure.
• Answer support requests.
• Count visits, to see which pages people read.
• Prevent fraud and abuse.

10Third parties

We use these services to run the store and the apps’ downloads:

• Payment processing: Stripe and PayPal
• Email delivery: SendGrid (verification, license and receipt emails)
• Hosting and infrastructure for lonelyduck.io and its API
• GitHub, where Canto’s releases are published and where Canto checks for updates

And these only when you use a feature that needs them, from your Mac:

• Canto: the search services and cloud model providers you set up, Hugging Face for model downloads, and Apple iCloud for sync
• Tulip: the lyrics, music-data and listening services in section 04
• Saferow: its downloads and updates come from saferow.app and dl.saferow.app (section 05), and the model providers and other services you set up in it are listed in its What leaves this Mac
• Carriel: Apple iCloud for your pouch; its downloads and updates come from carriel.app and dl.carriel.dev (section 06)

11How long we keep it

We keep data as long as we need it to provide licenses, support, accounting and security. Visit data are deleted after 25 months; what saferow.app keeps is deleted when section 05 says. You can ask us to delete your data where the law and running the store allow it.

12Your choices

You can ask to see, correct or delete your personal data by writing to support@lonelyduck.io. For support requests, include your receipt email and, if you have it, the order id. You can opt out of visit counting at any time with “Opt out” in the footer.

Our privacy officer (개인정보 보호책임자) is Deokwon (David) Song, at support@lonelyduck.io.

For purchase policies, see the terms of service and the refund policy.