Skip to content

Privacy Policy

Effective date: October 21, 2026

1. Introduction

ModelPiper is built to run AI on your own Mac. Local models run on your device, and your prompts, files and model outputs stay there unless you choose a feature that sends them somewhere else. Some parts of the Service do contact our servers or services you pick. This Privacy Policy explains what is sent, why, who receives it, what we keep and for how long, and what you control.

This policy covers all ModelPiper products: the ModelPiper website and web application, the ToolPiper macOS app, the VisionPiper screen capture app, the AudioPiper audio mixer app, the MediaPiper browser extension, and the PiperMesh and PiperMesh Network services (collectively, the "Service"). "We", "us" and "our" mean ModelPiper.

2. What ToolPiper Sends

Running a local model needs no account and sends nothing to us. ToolPiper makes the following connections, each for its own purpose and each described in its own section:

  • Updates and downloads. ToolPiper checks our release feed for updates, keeps its built-in models up to date, and downloads the models you ask for (Section 5).
  • License checks and daily activity. When you're signed in, ToolPiper checks your license with our server. Once a day it also reports that it was used, with its version and release channel, whether or not you're signed in. When you're signed in, the daily total is counted under your plan. You can turn daily activity reporting off (Section 4).
  • Optional analytics. Usage counts that help us improve ToolPiper, on by default and easy to turn off (Section 6).
  • Benchmarks you submit. Performance measurements you choose to contribute (Section 7).
  • PiperMesh. Connections between your own devices if you use private access, and required service reports if you enroll a Mac as a PiperMesh Network relay or inference provider (Section 8).
  • Services you choose. Cloud AI providers, remote servers, accounts you connect and tools you run (Section 9).

The license, activity, analytics, benchmark and service reports described in this policy never contain your prompts, files, audio, screen captures or model outputs. Offline or blocked reporting never disables local use or updates.

3. Account Information

  • Account data. If you create a ModelPiper account, we store your email address and any additional email addresses you add. You sign in with a one-time code sent to your email, or with Google (Section 10), which also gives us your Google account identifier, display name and profile photo URL.
  • Subscription data. If you subscribe, our payment processor (Apple, for Mac App Store purchases, or Stripe, for purchases through our website) sends us a record confirming your entitlement. We keep your plan, billing period and subscription status. We do not receive or store your payment method, full card number or billing address. Stripe assigns a customer identifier that we associate with your account, and we share your email address and account identifier with Stripe to create it.
  • Device records. When you sign in to ToolPiper on a Mac, we create a device record for that Mac under your account, described in Section 4.
  • Email. We send sign-in codes, receipts and account messages through our email provider (Section 15). We keep a record of addresses that have unsubscribed, bounced or belonged to a deleted account, stored as a one-way hash, so we don't email them again.
  • Support correspondence. If you email us, we keep the email so we can respond and follow up.

4. License Checks and Daily Activity

4a. License checks

When you sign in to ToolPiper on a Mac, we create a device record for that Mac. It holds the Mac's hardware identifier, so a license can't be copied to another machine, and the Mac's computer name, so you can recognize it in your account.

When you're signed in, ToolPiper checks your license with our server (api.modelpiper.com) about every six hours, when you come back to the app after a while, and when you sign in, change plans or restore access. The check identifies your account and this Mac's device record. We keep the device's most recent IP address and check time, and ToolPiper's version, on its device record to prevent license misuse and help you recover access. If a device's IP address changes between checks, our server also logs the old and new addresses with the hardware identifier to detect license sharing. ToolPiper uses the same sign-in to ask our server whether PiperMesh (Section 8) is set up for your account.

We record sign-ins and account security events, such as adding a device or an email address, with the IP address and browser or app details, and delete those records after 90 days. A device record stays until your account is deleted, including after you remove the device from your account.

4b. Daily activity

Once a day, ToolPiper reports that it was used. The report contains the date, ToolPiper's version and release channel, and how many days have passed since its previous report (anything over 30 days is grouped together). It contains no account, device or installation identifier, and no prompts, files, model names or browsing history.

When you're signed in, the daily count travels with your license check, so that request identifies you as described above. We store the count only as a total across all users, not linked to your account. When you're signed in, the daily total is counted under your plan. When you aren't signed in, ToolPiper sends only the daily count, with no account or device identifier. We keep these daily totals for 400 days and use them to count how many ToolPiper installations are in use each day, week and month, and on which versions.

To limit abuse, our server uses the network address of a signed-out report briefly, in memory only, and does not store it. Like any request to our API, these reports also pass through our hosting provider's request logs (Section 15).

When it starts. Daily activity reporting starts with the ToolPiper version that shows a daily activity notice on its Home screen; earlier versions don't send it. ToolPiper starts recording only after it has shown that notice, and it never records days from before the notice. Until they are sent, it keeps at most today and the seven days before on your Mac, and discards older unsent days.

Your choice. Daily activity reporting is on by default. You can turn it off at any time in ToolPiper under Settings → Activity. Turning it off stops recording and sending immediately and deletes the unsent days stored on your Mac. It is separate from optional analytics (Section 6): turning either one off does not change the other. Missing or blocked reports never disable local use, updates or your license.

5. Updates and Downloads

ToolPiper checks our update feed at releases.modelpiper.com about every six hours and downloads updates from there. Update checks send no account, device or installation identifier. Updates are never forced: you choose when to install them.

ToolPiper also downloads its built-in models, such as the model it uses to search its tools and your documents, from releases.modelpiper.com. ToolPiper downloads them on its own when it starts without them, and after that keeps the models you already have up to date when it starts. These downloads also carry no identifier. As with any download, the servers that deliver these files see your IP address.

When you browse or download AI models, ToolPiper connects directly to the third-party model host you choose, for example Hugging Face (huggingface.co), to search and download model files. The speech recognition and speech output models are downloaded from Hugging Face on their own when ToolPiper starts with no voice set up, and some vision components the first time you use them. The host may log your IP address and search queries under its own privacy policy.

6. Analytics

6a. Optional ToolPiper analytics

ToolPiper versions that include optional analytics show a "Help improve ToolPiper" item on the Home screen. These analytics are on by default. You can turn them off from that item or in Settings → Analytics.

They measure which MCP tools are used, how often paid features are requested and how upgrade prompts are answered, grouped by your plan (Free, Pro, Studio, Max, Team, or not signed in), to help us improve features and upgrade options. Each count carries ToolPiper's version and a random analytics ID created on your Mac for this purpose. It is not your account, email or device identifier and is not derived from your hardware. You can see and reset it in Settings → Analytics, and turning analytics off deletes it. Counts never include tool inputs, results, prompts or files. When you open an upgrade link from ToolPiper while analytics is on, the link carries the analytics ID, and our website sends PostHog a separate count when that page opens and when you start checkout, under the same ID and without your account, email, payment details or website analytics identity. If you sign in with Google on the way, the ID is held in a sign-in cookie for up to ten minutes and cleared when you return. Like any page address, these links also pass through our hosting providers' request logs (Section 15). We compare purchases only as daily totals, never by analytics ID. Turning analytics off cannot recall a link you have already opened. ToolPiper does not save these counts to disk, apart from the analytics ID itself, and we do not keep a copy on our own servers. Once a day our server also sends PostHog totals of active installations and signed-in accounts by plan, and of website downloads, upgrade-page visits and purchases; these totals carry no identifier for you or your Mac. PostHog, our analytics provider, stores the submitted counts. Turning analytics off stops new collection and sending and discards unsent counts. It does not remove counts already delivered to PostHog.

PostHog keeps these counts in a project used only for ToolPiper analytics, separate from our website analytics, on its servers in the United States. We set that project to discard IP addresses and to add no location data, and no person profile is created for any count. PostHog's servers still see the IP address each connection comes from, as any server does, but it is not stored with the counts. PostHog keeps the counts for up to 7 years, the period its paid plans set.

Optional analytics are separate from daily activity reporting (Section 4) and from the reports a PiperMesh Network service requires (Section 8). Turning analytics off does not affect either one.

6b. Website and account analytics

Our website (modelpiper.com) uses PostHog to understand how visitors use it and how people sign up and subscribe. PostHog records the pages you visit, clicks and errors, together with your IP address, and stores an identifier in a cookie and in your browser's local storage. It does not record replays of your sessions. When you sign in, we link these website events to your account email.

When ToolPiper opens our website, for example to upgrade or sign in, the link includes a random identifier for that ToolPiper installation and the feature you came from, and the website records them with these events. Our server also records account and billing events, such as sign-ins, account creation, connecting ToolPiper to your account, purchases, renewals, cancellations, refunds and failed payments, in PostHog under your account email. Our website analytics never receive the ToolPiper analytics ID. The upgrade-link counts in Section 6a are sent separately and are not linked to your website analytics identity, your account or your payment.

The web app built into ToolPiper does not run website analytics. You can limit website analytics with your browser's privacy settings or a content blocker, or ask us about the data linked to your account (Section 19).

7. Benchmarks You Submit

ToolPiper can measure how fast a model runs on your Mac. Measuring stays on your Mac, and nothing is submitted unless you choose to contribute a result. Submitted benchmarks never include your prompts, files or outputs.

Earlier ToolPiper versions could publish a benchmark score to our public leaderboard after showing a disclosure. Those submissions contain your Mac's hardware configuration (chip, core counts, memory and macOS version), the model and settings tested and the measured results, with an Apple App Attest check that the result came from ToolPiper. They contain no account identifier, and we keep them as part of the leaderboard's data.

ToolPiper versions that support identified benchmark contribution show a disclosure describing exactly what is sent before you contribute. Those submissions are linked internally to your registered ToolPiper installation and, when you're signed in, to your account and device, so we can check that results are genuine and track a Mac's performance over time. Our server also receives connection details such as your IP address. We keep private raw measurements for up to 90 days and accepted results long term. Public benchmark results omit installation, account and device identifiers.

8. PiperMesh and PiperMesh Network

8a. Private access

PiperMesh lets your own devices reach your ToolPiper on another Mac. When you use it, we store each device's name and type, its public keys, the network addresses it reports so your devices can find each other, its last IP address and, for phones, a push notification token. These records stay until you remove the device or your account is deleted. Whether your devices are online is kept in memory only and expires about 90 seconds after a device stops reporting.

When someone asks to pair a device with your ToolPiper, we keep their email, display name and device details for 24 hours, and a log of pairing attempts with the requester's email for 30 days. If you block someone, we keep their email until you unblock them. To find a direct connection, your devices may contact a public STUN server run by Google, which sees their IP address. When a direct connection isn't possible, traffic passes through our relay, which forwards end-to-end encrypted data it cannot read and keeps no copy. Using private access does not enroll your Mac as a service for other users and gives us no control over your Mac.

8b. PiperMesh Network services

If you enroll a Mac as a PiperMesh Network relay or inference provider, its existing account, device, installation and PiperMesh identities are linked for required health reporting and service management. Health reports include approved operating conditions and service counters, including approved loaded-model registry IDs and runtime version for inference providers. They do not include prompts, files, audio or workload outputs from your own use. These reports can travel with a license check and the daily activity count, but keep their own permissions and retention. The enrollment screen lists the reporting fields, the management permissions you grant, resource limits and how to pause or leave the role before you enroll. An inference provider processes the jobs assigned to it.

We keep raw health reports for 30 days, derived summaries for as long as the enrollment lasts plus 90 days, service command records for 90 days, and security and operator-access audit records for 400 days. Turning optional analytics off does not stop these required reports; leaving the role does.

9. Services You Choose

Cloud AI providers. If you connect a cloud AI provider (such as OpenAI, Anthropic or Google Gemini), a cloud speech-to-text service or another remote server, your prompts, audio and the data in your conversation are sent from your Mac to that service. ToolPiper adds the API key stored in your macOS Keychain to the request on your Mac, and the request goes to the service you chose, not through our servers. Each provider handles your data under its own privacy policy, which you should review.

Tools you run. Tools that you, or an AI assistant you connect to ToolPiper, choose to run, such as web search or page lookups, contact the sites and services they use from your Mac.

Connected accounts. Services you connect through ToolPiper, such as Google Search Console, are covered in Section 11. Data from a connected service becomes part of a conversation you start, so if that conversation uses a cloud AI provider, the provider receives it.

10. Sign in with Google

You may create or sign in to a ModelPiper account using your Google account. When you do, Google sends us a limited profile from your Google account so we can create or look up your account. This section covers account sign-in only. Connecting Google services such as Search Console to ToolPiper is a separate flow, covered in Section 11.

10a. What We Receive From Google

When you sign in with Google, Google sends us:

  • Your Google account identifier (sub), a stable pseudonymous id we use to recognize you on subsequent sign-ins
  • Your verified Google email address
  • Your display name, if your Google profile has one
  • Your Google profile photo URL, if your Google profile has one

We request only the openid, email and profile OAuth scopes, which are the minimum required to identify your account. We never receive your Google password, your contacts, your Drive files, your Gmail, your Calendar or any other Google service data.

10b. How We Use It

We use Google sign-in data only to create your ModelPiper account, sign you in on return visits, address account-related emails to you, and display your name and avatar in your account view. We do not share Google sign-in data with third parties for marketing, and we do not use it for any purpose unrelated to operating your account.

10c. Where It Lives

Account data is stored in our Postgres database at api.modelpiper.com, operated on our behalf by Railway in the US-West region.

10d. Sign-in Sessions

Once signed in, your browser holds a signed session cookie (mp_session) from api.modelpiper.com so you stay signed in. The cookie is HttpOnly, Secure and SameSite=Strict, lasts one hour, and contains a JWT that names your user id and email. During a Google sign-in, we briefly set state cookies to defend against CSRF; they expire after ten minutes and are deleted as soon as the flow completes.

10e. Revoking Access

You can revoke ModelPiper's access to your Google identity at any time at https://myaccount.google.com/permissions. Revoking removes future Google sign-in capability but does not by itself delete your ModelPiper account. To delete your account and the data associated with it, contact us at privacy@modelpiper.com.

11. Google Services Connected via ToolPiper

ToolPiper can connect on your behalf to Google services such as Google Search Console so you can ask questions about your own Google data from chat. These connections are entirely separate from "Sign in with Google" (Section 10).

11a. How the Connection Works

You explicitly initiate every connection by clicking Connect in the ToolPiper OAuth pane. ToolPiper opens your browser to Google's consent screen, where you choose whether to grant access. ToolPiper never initiates an OAuth flow without your explicit click and never connects in the background.

11b. Which Google Scopes We Request

We request only the scopes for features you have explicitly chosen to connect. As of this policy's effective date:

  • https://www.googleapis.com/auth/webmasters.readonly: read-only access to your Google Search Console properties, used by ToolPiper's gsc_* tools to surface your search analytics in chat

We will update this list as we add support for additional Google services. We will never silently request additional scopes; every new scope requires a fresh consent click from you.

11c. Your Google API Data Never Reaches Our Servers

Google API data fetched by ToolPiper (including Search Console queries, click and impression data, indexing data, sitemaps and any other content returned by Google APIs) flows directly from Google's servers to ToolPiper on your Mac, where it is used in your chat session. Your Google API data is never transmitted to, stored on, processed by, logged on or routed through any ModelPiper server, including api.modelpiper.com. If you ask about that data in a conversation that uses a cloud AI provider you chose, the relevant data is sent from your Mac to that provider as part of your request (Section 9).

11d. Where the OAuth Tokens Live

The access token and refresh token issued by Google are stored in the macOS Keychain on your Mac, under ToolPiper's keychain access group. They are never transmitted to any ModelPiper server. ToolPiper refreshes expired tokens by talking directly to Google's token endpoint from your Mac.

11e. Limited Use of Google User Data

ModelPiper's use and transfer to any other app of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Specifically:

  • We use Google user data only to provide and improve the user-facing features that the user explicitly connected (for example, the Search Console tools in ToolPiper chat)
  • We do not use Google user data for serving advertisements, including retargeted or personalized advertising
  • We do not transfer Google user data to third parties except (a) as necessary to provide or improve a user-facing feature that the user requested, such as sending it to a cloud AI provider the user chose for that conversation, (b) to comply with applicable law, or (c) as part of a merger, acquisition or sale of assets with prior notice to affected users
  • We do not allow humans, including ModelPiper employees or contractors, to read Google user data, except (a) with the user's explicit consent for specific data, (b) for security purposes such as investigating abuse, (c) to comply with applicable law, or (d) where the data has been aggregated and de-identified for internal operations. Because Google API data is never transmitted to our servers (Section 11c), in practice no ModelPiper personnel has the ability to read it

11f. Revoking Access

You can disconnect a Google service from inside ToolPiper at any time by opening Settings → OAuth and clicking Disconnect on the relevant provider row. You can also revoke ToolPiper's access from your Google account at https://myaccount.google.com/permissions. Either action invalidates the token immediately; ToolPiper's next request to Google will fail and surface a reconnect prompt in chat.

12. VisionPiper: Screen Capture and Recording

VisionPiper is a companion macOS application that provides screen capture and recording capabilities. This section describes how VisionPiper handles screen recording data.

12a. Features That Use Screen Recording

VisionPiper uses the macOS Screen Recording permission (via ScreenCaptureKit) to provide the following features:

  • Region capture: capture a still image of a user-selected screen region
  • Screen recording: record a user-selected screen region to a local .mp4 video file
  • GIF conversion: convert a recorded screen region to a local animated GIF file
  • Live streaming: stream a user-selected screen region over a local WebSocket connection (localhost only) for display in a browser tab on the same machine

12b. What Data Is Captured

VisionPiper captures screen content only from user-selected regions and only when explicitly initiated by the user. The user defines the capture region by dragging a selection rectangle on screen. VisionPiper never captures the full screen without the user's explicit selection and consent. No metadata about other applications, windows or desktop content outside the selected region is collected.

12c. Purpose of Screen Recording Data

Screen recording data captured by VisionPiper is used for the following purposes, all initiated by the user:

  • Saving screenshots of a selected region to a folder the user chooses, and copying them to the clipboard
  • Recording workflows and screen activity for the user's own reference
  • Creating animated GIF and WebP images from recorded screen regions
  • Extracting text from a captured region, performed entirely on-device using the operating system's built-in text recognition
  • Streaming a screen region to a local browser tab for real-time preview

12d. Third-Party Sharing

VisionPiper never transmits a captured image or recording off the device. It makes no outbound internet connections, and it has no AI provider integration of any kind.

If the user separately installs ToolPiper and chooses to send a capture to it, ToolPiper may forward that image to an AI provider the user has configured (such as OpenAI, Anthropic or Google), and only when the user explicitly initiates an analysis request. That transmission goes from the user's machine to the provider; it is never routed through our servers. The user has full control over whether, when and to which provider any captured data is sent. Nothing in that path is reachable from VisionPiper alone.

12e. Storage and Retention

Screenshots, recordings and exported GIF, WebP and MP4 files are written to the folder the user chooses in the standard macOS folder picker. VisionPiper retains access to that one folder across launches by storing a security-scoped bookmark for it, and to nothing else. If the user has not yet chosen a folder, files fall back to the application's own sandbox container on the same Mac. No screen capture data is uploaded to our servers or to any cloud storage. Users may delete their captured data at any time by removing the files from their local filesystem.

13. AudioPiper: Audio Capture and Recording

AudioPiper is a companion macOS application that provides multi-source audio mixing and recording capabilities. This section describes how AudioPiper handles audio data.

13a. Features That Use Audio Recording

AudioPiper uses macOS audio permissions to provide the following features:

  • Microphone recording: capture audio from the user's selected microphone input
  • System audio capture: capture system-wide audio output
  • Per-application audio capture: capture audio from a specific application using Core Audio Taps
  • Multi-source mixing: combine multiple audio sources into a single recording
  • Audio trimming and export: trim recorded audio and export to standard audio formats

13b. What Data Is Captured

AudioPiper captures audio data only from sources explicitly selected by the user. The user chooses which audio sources to enable (microphone, system audio or specific applications) through the application interface. AudioPiper never records audio from sources the user has not explicitly selected and enabled. No background or ambient audio is captured without the user's knowledge and consent.

13c. Purpose of Audio Recording Data

Audio data captured by AudioPiper is used for the following purposes, all initiated by the user:

  • Recording audio from selected sources for the user's own reference
  • Mixing multiple audio sources for podcast production, meeting notes or workflow documentation
  • Trimming and exporting audio files in standard formats

13d. Third-Party Sharing

AudioPiper never transmits a recording or live audio off the device. It makes no outbound internet connections, and it has no AI provider integration of any kind.

AudioPiper does expose a local HTTP server and a WebSocket audio stream on the loopback interface (127.0.0.1, by default ports 10001 and 10002). Both are bound to the loopback interface only and are not reachable from another machine. If the user separately installs ToolPiper on the same Mac, ToolPiper may read a recording from that local server when the user explicitly initiates a capture. ToolPiper transcribes audio on the device with on-device speech recognition by default. Audio is sent to a cloud speech-to-text service only if the user adds one to ToolPiper and chooses it (Section 9).

13e. Storage and Retention

All audio data is stored locally on the user's Mac under ~/Library/Application Support/AudioPiper/. Recordings and exported audio files are saved to the application's local support directory or to a location chosen by the user. No audio data is uploaded to our servers or any cloud storage. Users may delete their audio data at any time by removing the files from their local filesystem.

14. How We Use Information

We use the information described in this policy only for the purpose stated where it is described:

  • Operate your account and authenticate you (including via Google sign-in, if you chose that option)
  • Check licenses, prevent license misuse and help you recover access
  • Count active installations by day, version and release channel, from daily activity totals
  • Understand how the website, sign-up and purchases work, and improve features and upgrade options, from analytics
  • Verify, publish and track benchmark results you submit
  • Connect your own devices, and operate PiperMesh Network services you enroll
  • Process subscription payments and entitlements
  • Send sign-in codes, receipts and account messages, and product announcements only with your consent
  • Respond to support requests or inquiries

We do not sell or rent your personal information, and we do not share it with third parties for their marketing.

15. Service Providers

Railway, for hosting. Our API and database are hosted on Railway in the US-West region. Railway processes account, license, subscription and service data on our behalf as a data processor. Railway's request logs record the IP address, path and status of each request to our API, including license checks and daily activity reports. Our application logs, also kept by Railway, record the recipient address of emails we send and the license-sharing checks described in Section 4a. Railway keeps these logs for a limited period set by our plan.

Cloudflare, for the website, downloads and backups. Our website runs on Cloudflare, which processes your IP address to deliver it and keeps request logs. Update, download and built-in model files are served from Cloudflare storage, and encrypted database backups are stored there.

Resend, for email. Resend delivers the emails we send, such as sign-in codes and receipts, and receives the recipient address and message content to do so.

Stripe, for website purchases. Subscription purchases made through our website are processed by Stripe. Stripe receives your payment method and billing details directly, and your email address and account identifier from us; we receive a customer identifier and a confirmation of your entitlement. Stripe's handling of your payment data is governed by Stripe's Privacy Policy.

Apple, for App Store purchases. Subscription purchases made through the Mac App Store are processed entirely by Apple. Apple's handling of your payment information is governed by Apple's Privacy Policy.

PostHog, for analytics. PostHog receives website analytics and account events (Section 6b), and optional ToolPiper analytics, upgrade-link counts and our server's daily totals (Section 6a). We do not send Google user data, Google API data, your prompts, your pipeline data or your model outputs to PostHog.

Google, as an identity provider. If you sign in with Google, Google's handling of your authentication is governed by Google's Privacy Policy. The specific data we receive is listed in Section 10.

Services you choose. Cloud AI providers, connected Google services, tools you run and model hosts such as Hugging Face receive data directly from your Mac under their own privacy policies (Sections 5, 9 and 11).

16. Local Storage and Cookies

Cookies and browser storage for modelpiper.com. We use:

  • mp_session: your signed-in session token from api.modelpiper.com (HttpOnly, Secure, SameSite=Strict), set after you sign in
  • mp_oauth_state and mp_oauth_state_to: short-lived CSRF defenses set during a Google sign-in and deleted as soon as it completes; mp_oauth_state_to holds the page to return to, which can include the analytics ID of an upgrade link (Section 6a), for up to ten minutes
  • A PostHog analytics cookie and local storage entry holding a random identifier, used for the website analytics in Section 6b

We do not use advertising cookies or cross-site tracking cookies.

Browser local storage. The ModelPiper web application uses browser localStorage to persist your pipeline data, configurations and preferences. None of this is transmitted to our servers.

Local disk on your Mac. ToolPiper stores data on disk under ~/Library/Application Support/, including downloaded model files, exported logs and the small daily activity record described in Section 4. API keys and OAuth tokens are stored in the macOS Keychain, not in plain-text files.

Browser extension storage. The MediaPiper browser extension uses browser.storage.local to save your settings, discovery cache and saved items. This data is not synced to any cloud service.

17. Data Security

For the data we hold, we use industry-standard security measures to protect against unauthorized access, alteration or destruction. Database backups are encrypted. Staff access to identified service records is limited to the people who operate those services and is audited.

Communication between the companion apps (ToolPiper, VisionPiper, AudioPiper) and the web application on your Mac stays on localhost and uses per-session bearer tokens (32 bytes of cryptographic randomness, scoped to the local machine). No application data leaves your machine through these local channels.

OAuth tokens for connected services (including Google) are stored exclusively in the macOS Keychain on your Mac and are never transmitted to our servers.

18. Data Retention

  • Account, email and subscription records: for as long as your account exists, and for a reasonable period after closure to meet legal, accounting and tax obligations
  • Account deletion records: when we delete an account at your request, we keep a record that it was deleted: the account identifier, a one-way hash of each address, the Stripe customer identifiers and the dates, with no address. We use it to show the deletion happened and to repeat it if we restore a backup
  • Device records: until your account is deleted, including after you remove a device (Section 4a)
  • Sign-in and account security events: 90 days (Section 4a)
  • Daily activity totals: 400 days; they contain no identifiers (Section 4b)
  • Optional ToolPiper analytics and upgrade-link counts: up to 7 years at PostHog; they carry a random analytics ID, not your account, and we keep no copy (Section 6a)
  • Other analytics events: kept by PostHog under our plan (Section 6b)
  • Benchmark submissions: the periods in Section 7
  • PiperMesh records: the periods in Section 8
  • Hosting and application logs: the limited period set by our hosting plan (Section 15)
  • Data on your devices: until you delete it

Deleted records can remain in our encrypted database backups until those backups expire.

19. Your Rights and Choices

You can turn off daily activity reporting in ToolPiper under Settings → Activity, and optional analytics under Settings → Analytics, at any time and at no cost. Depending on where you live, you may also have the right to:

  • Access the personal data we hold about you
  • Correct inaccurate personal data
  • Delete your personal data
  • Object to or restrict the processing of your data, including website analytics linked to your account
  • Data portability: receive your data in a structured, machine-readable format

To exercise these rights, including deleting your account, contact us at privacy@modelpiper.com. We will respond within 30 days. Daily activity totals carry no identifier, so we cannot find the totals that came from your Mac. Optional analytics counts carry the analytics ID shown in Settings → Analytics; send it to us and we will ask PostHog to delete the counts recorded under it.

If you are a California resident, you have additional rights under the CCPA, including the right to know what personal information is collected and the right to opt out of its sale. We do not sell personal information.

20. Children's Privacy

The Service is not directed to children under 13. We do not knowingly collect personal information from children. If you believe a child has provided us with personal information, please contact us so we can take appropriate action.

21. Changes to This Policy

We may update this Privacy Policy from time to time. We post changes on this page with a new effective date, and when a change affects what ToolPiper sends, ToolPiper shows a notice before the new reporting starts. Changes apply from their effective date. Information collected before a change stays governed by the policy that applied when it was collected.

22. Contact

If you have questions about this Privacy Policy or your data, please contact us at privacy@modelpiper.com.