Privacy Policy

Scope

This policy covers the Apertura app for macOS, the Apertura app for Windows, the backend services at api.notch-os.com and updates.notch-os.com, and this website. It does not cover third-party services you point Apertura at yourself, such as a webhook endpoint you configure for the Guardian anti-theft feature, or a weather/AI provider we call on your behalf as described below.

Apertura is built to keep as much as possible on your device. The sections below describe every path where data leaves your machine, in plain terms, with no category left undocumented.

License activation

When you activate a license (or start a free session), the app sends a request to api.notch-os.com containing:

• The license key you entered (paid tier only; free sessions use a generated placeholder, not a real key).
• A device fingerprint: a one-way SHA-256 hash. On Mac it is computed from your Mac's hardware platform UUID, the app's bundle identifier, and your Mac's model identifier. On Windows it is computed from a random identifier generated on first launch and stored locally — not from any hardware serial number. Only this hash is sent; the values it was built from are not.
• A device label: on Mac, your computer's name (e.g. "Jordan's MacBook Pro"); on Windows, your PC's hostname.
• The app version and OS version string.
• On Mac only, if your device has a Secure Enclave, an additional public key used to cryptographically bind a paid session to that specific device. The corresponding private key never leaves the Secure Enclave.

Every later request to the relay (chat, device list, deactivation) repeats the device fingerprint so the backend can recognize your device, but never repeats the license key itself once activation has completed and a session token has been issued.

The session token issued after activation is stored in the macOS Keychain (Mac) or through Windows' own encrypted credential storage (Windows), not in a plain file.

We do not collect your name, email address, phone number, or billing address as part of license activation. If you purchase through a payment processor, that processor (see Third-party components) handles your payment details directly; we receive only the information needed to recognize which product tier you purchased.

AI features and the relay

Apertura's AI features (chat, screen reading, clipboard macros, attachments) work in one of two ways, and you can see which one is active in Settings:

On-device

When on-device AI is selected, your prompts are processed entirely on your machine using a local model that runs on your device. Nothing about the conversation is sent anywhere. The model file itself is downloaded once from our update servers and verified with a cryptographic signature before use; that download does not include any of your content.

Relay-assisted

When relay-assisted AI is selected (the default for paid tiers, and available for free-tier use), your conversation is sent to our backend at api.notch-os.com, which forwards it to a backing AI model to generate a response. We deliberately do not name the specific backing provider on this page because the backend is provider-neutral and the provider can change; [NEEDS HAN: decide whether to publicly name the backing AI provider(s), and if so, which ones, since this is a business decision rather than something fixed in the app's code].

What is included when you use relay-assisted AI:

• The visible messages in your current conversation (sent with each new turn, so the model has context).
• Content you explicitly attach: clipboard text (only when you run an AI clipboard macro, never automatically), on-screen text captured by "Read my screen" style features (extracted text only, not a screenshot image), or text extracted locally from a file or image you attach. Original file bytes, screenshots, and images are not uploaded — only text extracted from them on your device.

What our backend does not do with relay-assisted AI content: it does not write your prompt or the model's response to a database or log file. Only metadata needed for billing and abuse prevention is recorded — your device fingerprint, a token count, the model name, and your plan tier. See Retention and deletion.

Separately, if you use an AI agent tool that searches the web or fetches a URL, that request goes directly from your device to the search provider or the site you asked it to fetch — it does not pass through our relay, and is subject to that provider's own privacy practices.

[NEEDS HAN: confirm whether EU/UK users should be offered a formal right-to-erasure process for AI usage metadata; no deletion-on-request mechanism currently exists beyond the automatic retention windows described below]

Weather

The weather module works differently on each platform:

• macOS: if you grant location permission, Apertura uses your Mac's location services (city-level, not continuous precise tracking) to fetch weather directly from Open-Meteo, a third-party weather data provider, using your coordinates. If you deny or have not granted location permission, Apertura falls back to estimating your location from your IP address via a third-party IP-geolocation lookup. Weather results are cached on your device and refreshed roughly every 15 minutes.
• Windows: there is no GPS/precise location request. You type a city name, which is sent to Open-Meteo's geocoding service to resolve coordinates, which are then used to fetch the forecast. Your chosen location is saved locally on your PC.

In both cases, weather requests go directly from your device to Open-Meteo (and, on Mac with location denied, to the IP-geolocation service); they do not pass through the Apertura backend, and no device identifier or license information is attached to them.

Software updates

Apertura checks for updates automatically:

• macOS uses the open-source Sparkle updater, checking updates.notch-os.com roughly every hour. Update packages are cryptographically signed and verified before installing.
• Windows uses the electron-updater library against the same update server. Updates download automatically but are not installed without a passing signature check; the app does not silently downgrade your version.

An update check tells our server your app version, OS, and architecture so it can offer the right package — this is standard behavior for any auto-updating desktop app and is not tied to your license or device fingerprint. [NEEDS HAN: the Sparkle and electron-updater libraries may send additional standard HTTP request metadata (such as a User-Agent string) as part of their normal operation; this is default third-party library behavior we have not separately overridden, and should be confirmed against each library's own documentation before this section is finalized]

Crash reports and analytics

Apertura does not include any crash-reporting SDK (such as Sentry or Crashlytics) or any analytics/usage-tracking SDK (such as Mixpanel or Amplitude) in either the macOS or Windows app. We do not know when the app crashes on your machine unless you tell us.

The Stats module (system CPU, memory, GPU, thermal, disk, battery, and network information) runs and stores its history entirely on your device, for your own viewing. It is not transmitted to us. If you use the optional remote-fleet-monitoring feature to check on your own other machines, that connection goes directly between your devices (for example over your own Tailscale network or SSH configuration) and never touches our servers.

One local network feature checks your device's public IP address against a third-party service (ipify.org) periodically, purely to display it to you in the Stats panel; this value is not sent to Apertura's servers.

What stays on your device

The following features store data only on your device and never transmit it to Apertura's servers as part of normal operation:

• Clipboard history: stored locally. It is only ever included in an AI request when you explicitly run an AI action on it (see AI features and the relay) — it is never read automatically or in the background.
• Notes: stored locally. The AI chat can write a note when you tap to save something it found, but nothing reads your existing notes and sends them anywhere automatically.
• Screenshots: captured and saved locally using the operating system's own screenshot mechanism; not uploaded anywhere by Apertura.
• Camera preview (used for the notch's camera utilities): shown locally only, with no AI processing and no network transmission of the video feed.

Two narrow exceptions are worth calling out explicitly, because they are the only paths by which this local content can leave your device:

• If you manually attach a screenshot, note export, or other file to an AI chat message, the text Apertura extracts from that file is sent to the AI relay like any other attachment (see AI features and the relay). This only happens when you choose to attach the file.
• The optional Guardian anti-theft feature can send a notification (a title, message, timestamp, and a yes/no flag for whether a photo was captured) to a webhook address you configure yourself — for example your own ntfy.sh, IFTTT, or Zapier endpoint. The photo itself stays on your device and is never included in that notification. Guardian only sends anything if you have both enabled it and configured a webhook address.

Retention and deletion

We do not currently offer a self-service "delete my data" request flow. [NEEDS HAN: decide whether to add a data-deletion request process (e.g. a contact-based request handled manually) before publishing this policy, particularly for EU/UK users under GDPR/UK GDPR]

Third-party components

Apertura uses a small number of third-party services and open-source components to work:

• Open-Meteo — weather and geocoding data (see Weather).
• ipapi.co — IP-based location estimate, used only as a macOS fallback when precise location is unavailable.
• ipify.org — used locally to display your own public IP address in the Stats panel.
• Sparkle (macOS) and electron-updater (Windows) — open-source update-checking libraries.
• A payment processor for purchases — [NEEDS HAN: name the payment processor(s) actually in production use, e.g. Lemon Squeezy, and link to its privacy policy].
• The AI relay's backing model provider(s) — [NEEDS HAN: see the AI features section above].

Each of these third parties processes only the data described in the relevant section above, and is subject to its own privacy policy for anything beyond that.

Security

License session tokens are stored using your operating system's secure credential storage (macOS Keychain, or Windows' encrypted credential storage), not in a plain text file. Where your device supports it, Mac paid sessions are additionally bound to your device's Secure Enclave. Backend administrative access is protected by a single secret token and is unavailable at all if that token is not configured; no password-based admin login exists. No system is perfectly secure, and we cannot guarantee absolute security.

Children

Apertura is not directed at children, and we do not knowingly collect data from children. [NEEDS HAN: confirm the target minimum age for this product/jurisdiction, e.g. 13 or 16, for the final policy language]

Changes to this policy

This is a draft. When finalized, we will note the effective date at the top of this page and describe how we will notify you of material changes. [NEEDS HAN: decide the notice mechanism for future changes, e.g. in-app notice, changelog entry, or email if we ever collect one]

Contact

[NEEDS HAN: provide a contact email or address for privacy questions before this page is published]