Privacy policy

In short

• Your projects stay on your Mac. Lupy does not keep project files in its own cloud.
• When you give a task to an AI provider, the text of that task goes to that provider. Lupy shows you what went where.
• You do not need an account today; once subscriptions open you will need one (see "Account, subscription and devices" below). There are no ads and no tracking.
• Anything that leaves your Mac (an email, a calendar invite) waits for your approval.

What stays on your device

Your project files, memory notes and the access keys of the accounts you connect stay on your Mac. Account access keys go to the Mac's own Keychain; if the Keychain is not available, Lupy shows an error and does not fall back to a plain file. Secrets (passwords, keys) are masked in memory notes, and raw email content is not saved.

What goes to which provider

Lupy sends a task to the provider you chose or to the next suitable one (for example Claude, Codex, Gemini). What is sent is the text of the task and the files it concerns. From that point the provider's own privacy terms apply; Lupy does not control them.

For every task Lupy shows a "What went where" line: which provider got it and the file names found in the task text (secrets masked). File names are read from the task text, so if a file was sent without being named there, the line cannot show it; in that case it says "unknown". You can mark a provider as "do not send" for a project; today this mark only warns, it does not block the task. Blocking is planned as separate work.

If you have a second account, an important task can get a "second opinion" from a different provider; then the same question goes to two providers.

Phone link and notifications

Messages between your phone and your Mac are encrypted end to end. Notifications carry no content: the screen shows a generic "New notification" and the real text opens on your phone. The relay runs on your Mac; the paired device's identifier and public key, the Mac's identifier and public key, the notification address (token) and the day of the last connection are kept in a file on your Mac, not on our server. To set up the connection, your Mac's identifier and network address are announced to a free public discovery and relay service (iroh/n0); message content reaches it end-to-end encrypted. That service's IP-address and logging details are not yet verified. [DOĞRULA]

The phone link and notification delivery are not public yet; this section is written to apply when they open.

Phone (iOS) app: where your data stays

• The phone app works by pairing with your Mac; chats, approval cards and outputs come from the Mac to the phone through a free public relay service (iroh/n0). The service cannot read this traffic; it passes on opaque bytes only. [DOĞRULA]
• Device keys on the phone are kept only in the iPhone's Keychain; they are not written to a file, to app settings or to a log.
• Approving from the phone is switched off for now: you see approval cards on the phone, and you give the approval on the Mac. A message you type on the phone does not count as an approval.
• The phone app has no account sign-up, advertising identifier, location, tracking or usage measurement.

This section was written from reading the code; it has not yet been tried on a real iPhone or against the real server. [DOĞRULA]

Microphone and speech

If you turn on voice conversation, the Mac's microphone is used only while it is on. Your speech is turned into text with Apple's speech recognition. We do not write your voice to a file; while you speak it is held in memory only long enough to be turned into text. If your Mac does not support on-device recognition, or you turn on "Transcribe more accurately" under Settings > General > Voice, the audio may go to Apple's servers; we do not know how long Apple keeps it. [DOĞRULA] The resulting text is sent to the chosen provider like any other message. Replies are read aloud with a voice built into your Mac.

Your own Claude key

Entering your own Claude key on the phone is designed but not built yet: the key would stay on your phone only, would not be sent to us or to the relay service, and usage would be billed to your Anthropic account. Login with a Claude.ai subscription is not supported. [DOĞRULA]

Email and calendar

If you connect Gmail, Lupy asks for read-only access only; calendar access is asked for separately and is also read-only. For now Lupy does not send email and does not add, change or delete calendar events. Raw email is processed on your Mac, the card shows sender, subject and a one-sentence summary, and the message text is not saved. Your email and calendar content does not go to a Lupy server; it is read from your Google account. If you ask from your phone, the assistant's reply (including sender, subject and event title) is sent to your paired phone; raw email text is not sent. The reply travels from your Mac to your phone encrypted, through a free public relay service (iroh/n0); that service's IP-address and logging details are not yet verified. [DOĞRULA] You can disconnect with one click, which also revokes the permission at Google. This connection has not yet been tried with a real Google account. [DOĞRULA]

Account, subscription and devices

Status: sign-up, login and paid subscription are not public yet. This section describes the planned design and is written to apply when they open.

• Login: login with Google and Apple is now connected to the app, but it is off by default and stays off until release day; it has not been tried with a real account yet. The account identity token that comes back from login is written to your Mac's Keychain; when you sign out it is deleted and your license document stays. At login the server is sent your device ID and the platform name ("macos" or "ios"); the identity token goes in the request header. What these providers will pass to us (name, email and so on) is not yet verified. [DOĞRULA]
• Payment: payment will be taken through Stripe; Stripe collects the card details, and our app and server do not see or store the card number. What Stripe shares with us (e.g. email) will be verified once the live account is set up. [DOĞRULA]
• Subscription record: for each account the server keeps the subscription status (active, payment overdue, cancellation pending, expired, paused, revoked) and period end dates. A connection to Firebase (Firestore) for permanent storage is written; until a live Firebase account is connected, the server keeps this record in memory only while it runs. [DOĞRULA]
• License key: it is written to your Mac's Keychain, not to a plain file. It holds an account identifier, the plan name, a device identifier, the expiry date and the offline grace period, and where present the end of the update entitlement and the latest build number. To renew it the app sends the device identifier to the server; the identity token of the account you signed in with goes in the request header. This part is connected to the app; if no server address is set no request is made at all, and it stays switched off behind a gate until release day. [DOĞRULA]
• Devices: when you add a device the server records its identifier, its type (Mac, iPhone, iPad), the name you typed (up to 80 characters), and the first and last time it was seen. When you remove a device the record is not deleted; it stays marked "removed" with a time. Today there is no limit on the number of devices or on swapping them. How the device identifier is generated is not verified. [DOĞRULA]

License renewal

Status: The license renewal request is written in the app; but if no server address is set, or you have not signed in to your account, no request is made at all, and login stays off until release day. Publication happens on the same day as the app behaviour. [CONFIRM: release day]

To know whether your license is valid, Lupy sends a short renewal request to our server. The request goes out in three cases: while checking whether your license became active after you come back from the payment screen, after your first login, and by itself in the background. The background renewal is asked for when less than 24 hours remain on your license (or when it has run out but is still inside the offline grace period); the app checks for this every 6 hours, tries again after at least 1 hour if an attempt fails, and shows you nothing. [DOĞRULA: these values are constants in the app code; whether the cloud license flag is on in the release build was not measured] The request carries only:

• Your device ID. On first use on this Mac, Lupy makes a random code. It is not linked to your serial number, your hardware or your name. The request body holds only this code; your email address and the app version are not in the body. [DOĞRULA: verified in code for the Mac; iPhone and iPad device IDs not measured]
• The identity token of the account you signed in with. It goes in the request header (Authorization); it is read from your Mac's Keychain and never written to the body or a log. If you have not signed in, no request is made. Which fields the token holds (e.g. email) is decided by the sign-in provider. [DOĞRULA: not measured with a real provider] The only header the app sets itself is this one; the HTTP library's standard headers (e.g. content type) go as well.

In return the server sends a small signed license document (plan, subscription state, expiry date). The document is stored in your Mac's Keychain.

Why: To check that the license belongs to your account and device, and to check whether the subscription continues and which versions you are entitled to. We do not use this data for advertising or tracking, and we do not sell it. [LAWYER: legal basis / statement of purpose]

What is NOT sent with this request: your chat messages, project files, prompts, provider keys, email and calendar content. [DOĞRULA: the renewal body holds only the device ID, verified in code]

Payment and subscription management: when you press "Buy", the server is sent the plan you chose (monthly or lifetime); "Manage subscription" is called with an empty body; in both the account identity token goes in the header. The server returns a Stripe payment or management address and Lupy opens it in your browser. Lupy does not see the card details. [DOĞRULA]

New-version check: when you press "Check for updates", Lupy downloads a version-information file. This request has no body; no device ID, account token or version is sent. If no address is set the check is off and no request is made; no check runs by itself when the app opens. [DOĞRULA]

Login record: when you sign in, your device ID and platform name (macos or ios) are written to the server; the identity token goes in the header. [DOĞRULA: not tried with a real login]

Unavoidable trace: As with every internet request, the server sees the IP address the request came from and its time; our host may write this to a technical log. [CONFIRM: whether the log is kept and for how long] These logs are not used for anything other than the license [CONFIRM]. The app's own code writes no request or IP log [DOĞRULA: code reading]; the host's log cannot be measured by reading code.

Who processes it: The request is processed on [Google Firebase], which we use as server infrastructure; the subscription information that comes from our payment provider Stripe is linked to your account. [LAWYER: naming of processors, notice of transfer abroad (KVKK), standard contractual clauses (EU)]

How long it is kept: Your account, device and subscription records are kept while your account is open; when you delete the account they are deleted, and the trace that remains is described in «Deleting an account and the trace that stays». The retention period for technical logs of renewal requests: [PERIOD — CONFIRM, LAWYER].

If something fails: If the renewal request cannot get through (no internet, server down), Your license document and its state do not change, and Lupy keeps working with the last valid document; only while you are on the wait screen after payment are you told, in a plain sentence. The document works for its validity period and a grace period [PERIODS — CONFIRM, after the price decision]. Today the end-of-period gate is applied only to the new-version check (in a frozen state that request is not sent); no other cloud feature closes because of it. The planned behaviour is this: if renewal is still not possible when that ends, Lupy does not lock; your core work keeps running and features that need the cloud close. [DOĞRULA: the gate exists only in the new-version check; design stage for other cloud features]

Your rights: You can ask for access to, correction of, and deletion of your account and device records at hey@justblastgames.com. [LAWYER: KVKK article 11 / GDPR rights text, response period]

Keeping and deleting

When you press "forget" on a memory note, the file and its index line are deleted from this Mac for good (backup copies, such as Time Machine, excluded) and cannot be restored. Personal memory notes are deleted the same way. Whether copies in your Mac's own backups are removed is not verified. [DOĞRULA] When you disconnect an account, its access key is deleted from the Keychain.

Deleting an account and the trace that stays

When you delete your account, your account, subscription and device records on the server are deleted. Two things stay: an "account deleted" event line that carries no account identifier (only the type and the time), and a permanent mark of the deleted account. The mark is not the account identifier itself but a one-way digest made with a secret key; if the key is thrown away the mark cannot be tied to any account. The mark exists so that a deleted account cannot add a device; for a deleted account this request gets an "account deleted" answer. How long the mark is kept is not decided yet (a legal decision). [DOĞRULA]

Subscription event records from before the deletion carry the account identifier and are not cleaned up by this deletion; the clean-up period is not decided yet. You can delete the account yourself in Settings; this request goes to the server with no body and the identity token in the header (the sign-in section stays closed until release day). [DOĞRULA: not tried against a real server]

Problem reports and the crash pack

If Lupy closes unexpectedly it asks you at the next start. The problem pack is prepared only on your Mac and is never sent anywhere by itself; you copy it and send it wherever you choose. The pack holds: the Lupy version, the operating system and processor type, whether the last run closed unexpectedly, the latest crash records (up to 5) and the last 200 log lines. While it is prepared, password-like and key-like values, email addresses and your home folder path are hidden. The hiding looks for known patterns; read the pack before you send it. The records sit in files that only your user can read, and at most 10 crash records are kept. There is no remote crash collection.

Tracking and cookies

The app has no advertising, tracking or usage-measurement library. This website uses no cookies; you pick the language with the TR/EN link at the top; the page does not read your browser language and does not save your choice. The fonts on this site come from the site's own server (local Geist), so your browser does not connect to Google or any other outside server for them. Whether the hosting service keeps server logs is not verified. [DOĞRULA]

Waitlist and contact

When you join the waitlist your email program prepares a message to hey@justblastgames.com; your address and what you write reach us only if you send it.

Using your rights

For your rights over personal data and how to apply, see the KVKK notice.

Who runs this

Company name, address and registry number: [DOĞRULA]