Draft, not yet reviewed by a lawyer. Blanks are filled in after incorporation and before launch.

App privacy notice

Last updated: 2026-10-20

What the Mac app does on this Mac. Processing on the web and server (Philote Cloud) is in the web "Privacy Policy".

In short

• Your work data never leaves this Mac — your prompts and the AI's answers, code, file and project names, window titles and folder paths. There is no sign-up, no crash reporting and no advertising ID.
• We exchange only what it takes to run the app. Philote asks philote.app whether a new version is out (once a day) and whether there are notices (every few hours). Those requests carry no values (the version, and which notices apply to you, are decided on this Mac), so only your IP address reaches us; turn them off in Settings → Behavior → "Update notices". Updates are downloaded from philote.app and swapped in only when you press Update on the board. And once a day it sends anonymous usage counts (see "Anonymous usage counts" below).
• After buying, you sign in with your purchase email. Then, and once a week after that, your purchase email, an anonymous value for this Mac and this Mac's name go to philote.app (see "After you buy and sign in" below).
• Everything Philote keeps is in ~/.philote on this Mac, a folder only your macOS user account can open.
• With AI handoff on, the first lines and file names of other AI sessions' work go into a new Claude Code session and from there to Anthropic (below).

Anonymous usage counts

• What: for each finished day, how often each feature was used (times the board was opened, switches and whether they landed in the right place, uses of features such as shortcuts and settings), how many AI sessions were running when you opened the board by kind (Claude Code, Codex, Cursor, Gemini) and by where they ran (VS Code, Terminal and so on), the app and macOS versions, your language, and whether you are on the trial or bought it.
• Never sent: your work data (prompts, answers, code, file and project names, window titles, paths), your purchase email, or your device ID.
• Whose it is: only one random number, created on this Mac when you install, is attached. It is not linked to your purchase email or device ID.
• Why: to see which features are used and where people get stuck, so we can fix them. We only look at the numbers in aggregate.
• When and how long: once a day, finished days only. We keep them on our server for 400 days, then delete them. The last 90 days also stay on this Mac in ~/.philote/usage.json.
• Turning it off: Settings → Behavior → "Share anonymous usage stats". Once off, nothing more is sent.

What it reads on this Mac

• Conversation files Claude Code and Codex save on this Mac (~/.claude/projects, ~/.codex/sessions) — only the part added since the last reply, and the full text is not copied anywhere.
• The list of open windows VS Code and Cursor keep — for "window open" and switching windows.
• With "Watch Cursor" on, the list and titles of the chats Cursor saves on this Mac.
• Running programs — whether Claude Code, Codex or the ChatGPT app is still running (process ID and start time). While the board is open, to find a slot's "Test page", it also lists running programs (ps), the ports they opened (lsof) and their working folders.
• Addresses and titles of open browser tabs — only if you allow it on the board. When a project has a dev server running, the board first explains why and lets you choose. If you allow, browsers that are already running are asked every 15 seconds while the board is open. Only tabs on a localhost port the project opened are shown as "Test page"; the rest are not kept. After you allow, macOS asks once more for each browser; if you decline there, test pages just don't appear. You can turn this off in Settings › Behavior.
• The git remote and the package.json homepage of folders you added as slots — for the GitHub and home icons. Clicking the GitHub icon asks GitHub for the current branch's pull request with the gh command (when gh is installed and signed in).
• When you tap a project, it asks your terminal, editor or browser for its windows through macOS Apple Events. macOS asks your permission the first time.

What it writes on this Mac

• Session status — which AI is working or waiting in which folder, and the first line of your question.
• Work history — only for folders you added as slots: first lines of questions and replies, and names of changed files.
• Your slots, their order and names, ignored folders, and settings.
• Handoff log — a copy of what was handed to a new session.
• App log — a record of what the app did, for troubleshooting. It can contain folder names.
• Usage counts — per day, how often the board was opened, how many switches and how far each got, shortcut clicks, and how many projects had AI running at once. No project names, paths or questions.
• When you connect the AI tools (it asks first): Philote hooks in the Claude Code and Codex settings (and Gemini CLI's, if it is installed), and one line in your shell profile (~/.zshrc and the like) with the path of the wp command.

How long it keeps things

• Work history: 90 days by default. Choose 30 days, 90 days, 1 year or forever in Settings → Behavior.
• Handoff log: 30 days (or less if work history is kept for less).
• App log: when it passes 1MB, one previous copy is kept and a new one starts.
• Usage counts: 90 days.
• Removing a slot deletes that folder's work history. Delete ~/.philote after removing the app and everything is gone.

AI handoff

While it is on (it is on at first), when a new Claude Code session starts in a folder you added as a slot, what other AI sessions did in that folder in the last 72 hours — first lines of questions and replies, changed file names, what is running now — is put into that session as its first message, in 700 characters or less.

That message becomes part of the Claude Code conversation and goes to Anthropic. Work done in Codex can carry over into Claude Code this way. How Anthropic handles the conversation follows the terms and privacy policy of your Claude plan. Turn it off in Settings → Behavior → "AI handoff".

After you buy and sign in

• What is sent: your purchase email, an anonymous value for this Mac (the hardware ID mixed with our own text — it can't be turned back into the hardware ID or linked to other services' values), and this Mac's name (so you can recognize it in your list of Macs).
• When: when you sign in, once a week after that (to renew your license), and when you sign out. If our server can't be reached, the license you have keeps working for 60 days.
• Why: to confirm you bought it and to count up to 3 Macs per person. Payment records are with Paddle; we ask Paddle whether that email has a purchase (and that it wasn't refunded).
• Who handles it: your list of Macs and sign-in codes are kept on our server on Google Cloud (Oregon, United States), and requests pass through Cloudflare (United States). Sign-in code emails are sent by Resend (United States). To stop abuse of code requests, a mixed (hashed) value of your IP address is kept for one day.
• How long: Macs not heard from for 90 days stop counting and are deleted after 180 days. Signing out, or removing a Mac at philote.app/account, deletes it right away. To delete everything including your email, contact us below.

If you connect a server

Turn off "Use without a server" in the menu and sign in, and session status, the first line of your question (120 characters), work summaries, tasks and commit records go to that server. Also sent: this Mac's name, the path of the conversation file (it contains your macOS user name), the folders open in your editors (for "window open" and the switch buttons), and, with "Watch Cursor" on, Cursor chat titles. Full AI conversations do not (unless a project turns on transcript storage). Summaries are made with the AI key you entered on this Mac, and for that the conversation goes to that AI provider (Anthropic, OpenAI or Google).

Philote Cloud follows the web "Privacy Policy". A server your team runs itself (say, a colleague's Mac on the same Wi-Fi) is managed by whoever runs it.

Questions

App terms · App refunds · Terms of Service (Cloud) · Privacy Policy