Draft — not yet in effect

Privacy Policy

Effective [EFFECTIVE DATE]

The short version

• Your notes stay on your Mac. Terra's servers never receive your notes, the names of your Libraries, your file paths, or anything about how you use AI.
• To run your account, our servers keep your email address, your passkeys' public keys, the names of your Macs, your subscription status, and sign-in logs that include IP addresses.
• Paddle sells Terra to you and handles payment. We never see your card.
• No tracking. Terra has no telemetry, crash reporting, analytics or ads. We don't sell or share your personal information.
• Services you connect. If you connect an AI provider or another service, Terra sends data straight from your Mac to that service, under that service's terms. We don't receive it.

1. Who we are

[ENTITY] ("we") makes Terra, and is responsible (the "controller") for the personal data this policy describes.

• Contact: [CONTACT EMAIL], [ADDRESS]
• EU representative: [EU REPRESENTATIVE]
• UK representative: [UK REPRESENTATIVE]

This policy covers:

• the Terra app for Mac;
• your Terra account;
• the [DOMAIN] website and its sign-in, account and pricing pages;
• emails between you and us.

2. What our servers keep

Our account service runs on Supabase. It keeps:

Licence checks. Terra asks our server for a signed licence when it starts, every 12 hours while it's running, and after you sign in. The request identifies your account and the Mac it comes from, and includes Terra's version number. Like any server, ours sees your IP address. This is how Terra knows your plan. If it can't check for 14 days, it opens your notes read-only.

What our servers never receive:

• your notes or attachments;
• the names of your Libraries or folders, or any file paths;
• your AI prompts, conversations or usage;
• your API keys.

3. Payments

Paddle is the merchant of record: it sells Terra to you, takes payment, charges tax and sends receipts. Paddle collects your billing and payment details itself, as an independent controller under its own privacy notice.

When you start checkout, we send Paddle your verified email address and your Terra account id, so the purchase is linked to your account. Paddle then tells us your subscription status. We never receive your card details.

4. Our website and sign-in pages

• The website. The [DOMAIN] website uses no cookies, analytics, tracking pixels or third-party embeds. Its fonts are served from our own site.
• Sign-in, account and pricing pages. They keep your session in memory only. Nothing about your sign-in is saved in cookies or browser storage, and leaving the page ends the session.
• Two third-party scripts, only where they're needed:
  • Cloudflare Turnstile checks that a real person is signing in;
  • Paddle.js runs checkout on the pricing page.

  Both may store or read data on your device that they need in order to work, and may process your IP address and browser details, under their own privacy notices. We don't need your consent for these, because they're strictly necessary for signing in and checkout.

• Server logs. Our web host, [WEB HOST], logs each request (IP address, browser details, the page and the time) to keep the site running and secure. Our legal basis is legitimate interests.

5. Emails

• Sign-in codes, sent through [EMAIL PROVIDER]. They contain only the code.
• Subscription emails: receipts (from Paddle), yearly reminders, reminders before renewals, and notices of price changes.
• Product news, only if you've opted in separately. Every such email has an unsubscribe link, which takes effect immediately.
• Our emails contain no tracking pixels.

6. Support

If you email us, we keep your message, your email address and anything you attach, so we can help you. Screenshots can show your notes, so send only what you're comfortable sharing. We keep support emails for 24 months after our last reply. Our legal basis is legitimate interests, or contract when the question is about your subscription.

7. Feedback from the app

[Keep this section only if the feedback relay ships. See Decision 10.]

Help → Send Feedback… sends us a report only when you press Send. A report includes:

• your title and text;
• Terra's version, your macOS version and your Mac's chip type;
• if you tick the box, up to 200 lines of the current session's log, which can include note titles;
• any screenshots or videos you choose to attach.

Reports are stored as issues in our private GitHub repository, and attached files are stored with Cloudflare R2. [Describe how files are protected in the built version.] We keep reports for 12 months and files for 90 days. Our legal basis is your consent, which you give each time you send.

Terra also keeps a log of the current and previous session on your Mac, at ~/Library/Logs/Terra/.

8. What stays on your Mac

Your Library is a folder of ordinary files that you choose. Terra reads and writes it on your Mac. We don't have a copy, so we can't recover it for you.

Terra also keeps this data on your Mac.

In your Keychain. This is your login keychain, which is never synced to iCloud. It holds:

• your Terra sign-in: a refresh token, your account id and email address, this Mac's device id, and your licence;
• the keys and tokens for the AI providers and integrations you connect.

Removing an AI provider in Settings doesn't delete its key yet.

In your Library's hidden .terra folder:

• your AI chats, until you delete them;
• copies of a note's full text from before and after each change an agent makes, kept until you delete that chat. Notes over 512 KB aren't copied.
• a log of agent changes (which note, which tool and the outcome, but no note text);
• a log of integration activity, which includes the email address of each account you connected. Neither log is trimmed yet.
• your AI provider settings, but not the keys;
• caches of link previews, of remote images you've opened, and of page snapshots. They stay when you delete a note.
• the text of tasks you've deleted, including ones you deleted permanently.

In Terra's Application Support folder: a journal of recent changes to each Library, kept for 30 days or 100,000 events.

In Spotlight. So you can find notes from macOS search, Terra adds each note's title, about 300 characters from its start, its tags and when it last changed. This is always on. Notes in Trash stay searchable until you delete them permanently.

For widgets: your Library's name, up to 20 tasks due today, and the titles of up to 10 recently changed notes. Text you send to Terra from a widget or a Shortcut passes through the same place, and is deleted once Terra has read it.

Website data:

• cookies and other site data from websites you open inside Terra (§9);
• the addresses and titles of your open web tabs.

Link previews. When a note shows a link preview, the site's name and description are saved with the note.

Terra writes no log files. It doesn't add its own encryption to any of these files; it relies on macOS. We recommend turning on FileVault.

When you delete a note:

• It moves to Terra's Trash.
• After 30 days in the Trash (the default, counted from the note's last change), it's removed the next time you open the Trash.
• Emptying the Trash, which asks you to confirm, or deleting a note from inside the Trash, which doesn't ask, removes the note's file permanently. Its attachments and its .terra.json companion file stay in the Trash folder for now.
• Copies can remain after that:
  • in your git history, if you use version history;
  • in caches, AI chats and agent copies;
  • in the widget snapshot;
  • in your own backups, such as Time Machine.

9. What leaves your Mac when you use a feature

Terra contacts these services only when you use the matching feature, or after you've connected them. Each one gets the data straight from your Mac and handles it under its own terms and privacy policy. We don't receive the data, and these services don't work for us.

AI providers

• Nothing goes to an AI provider until you add one and allow it. Terra then shows you the provider, who pays it, and that your prompts and selected content may leave your Mac.
• The providers you can add:
  • Ollama, which runs models on your Mac, or on another computer you point it at. With Ollama on your own Mac, nothing leaves it.
  • OpenAI;
  • Anthropic (Claude, with an API key);
  • Google Gemini, through AI Studio or Vertex AI;
  • OpenRouter.
• What a provider can receive:
  • your request, plus any notes or files you attach (up to 60,000 characters each) and images (up to 8 MB);
  • in chat, the titles and short excerpts of up to 8 notes that seem relevant, up to 8,000 bytes in all;
  • whole notes the assistant reads with its tools. In "Ask" mode Terra asks you first; in "Approve for me" and "Full access" it doesn't.
  • with AI in the editor, up to 12,000 characters of your selection or note;
  • each chat reply, a second time. If your default provider is allowed to work in the background, Terra sends it the reply to pick out names and topics.
  • with Enrich on capture (off by default), the captured page or a video's transcript, up to 240,000 characters.
• Web pages the assistant asks for. The assistant can ask Terra to fetch a web page. Terra asks you first, unless you've chosen Full access. The site sees your IP address. Terra also loads the icons of sites the assistant cites, even when link previews are off.
• Model lists. When you open the chat, Settings or a spreadsheet, Terra asks each provider you've added for its current list of models.
• Terra sends your text as it is. It doesn't remove names, secrets or other personal details first.
• Providers' rules differ. Check your provider's data and retention policy before you use it with sensitive notes.
  • Some free plans let the provider use your prompts to improve its products. Google's free Gemini API tier is one example.
  • OpenRouter passes your requests to other model providers, chosen for speed. Terra doesn't currently ask OpenRouter to avoid providers that keep or train on data.

Search

• Cloud embeddings. If you turn on semantic search with OpenAI, Gemini or OpenRouter, Terra asks you to confirm. It then sends that provider the text of all your notes (but not their properties), your later edits, and the searches you make.
• Local embeddings. The first time you use them, and after you approve, Terra downloads its embedding model from Hugging Face. Hugging Face sees your IP address and which file is downloaded, but none of your notes.

Agents

• Codex. If you connect a copy of Codex you've installed, Terra runs it on your Mac. Codex sends your request, and any notes it reads, to OpenAI under your own Codex sign-in.
• Hermes Agent (from Nous Research). If you connect it, Terra sends your request to Hermes on your Mac, and Hermes passes it to the model provider you've set up in Hermes.

Dictation. Chat dictation uses macOS speech recognition. If macOS can recognise your language on the device, the audio stays on your Mac. If it can't, the audio goes to Apple, just as it does with macOS Dictation. Video transcripts for capture are always made on your Mac.

Integrations

• Granola: with your Granola API key, Terra fetches your meeting notes from Granola and saves them as notes.
• Atlassian (Jira and Confluence): after you sign in, Terra reads Jira and Confluence through Atlassian's service, and updates Jira issues when you ask it to.
• GitHub and Slack: with a token you paste, Terra fetches the issues, pull requests, gists, messages and threads you embed.
• Updates. Terra checks connected services for updates regularly while it's open.
• Disconnecting. Terra keeps these tokens in your Keychain. Disconnecting deletes the token and Terra's cached copies, but doesn't cancel the access on the service's side, so revoke it there too. Notes Terra created from a service stay in your Library.

Version history. If you turn on version history and push to a remote, everything you've committed goes to that remote: notes, attachments and the Trash folder. Terra uses your own git sign-in, and commits and pushes only when you ask.

Capture and lookups

• Capturing an article fetches the page from its own website. Terra extracts the text on your Mac.
• Enrich (off by default) sends the captured page, or a video's transcript, to your AI provider, which tidies it up and files it.
  • For videos from supported sites, Terra downloads the yt-dlp tool from GitHub, and updates it weekly, to fetch the video's details and subtitles.
  • If a video has no subtitles and is 20 minutes or shorter, Terra downloads its audio and transcribes it on your Mac.
• Lookups:
  • a DOI goes to doi.org, which passes it to the agency that registered it, such as Crossref;
  • an ISBN goes to Open Library;
  • an arXiv id goes to arXiv.

Maps. Map views and place cards load map images from OpenFreeMap, which sees your IP address and the area shown.

Link previews (on by default). When a note shows a link, Terra fetches the linked page, its icon and its preview image, and the site sees your IP address. You can turn link previews off in Settings → Privacy. Remote images inside notes load only when you click them.

Websites inside Terra

• AI chat sites. You can open claude.ai, ChatGPT or Gemini in a pane inside Terra.
  • These are the vendors' own websites, and what you type goes to the vendor under your account with them.
  • Terra adds no scripts to these sites, and doesn't store or forward anything from them.
• Web tabs. Sites you open in Terra's browser see what they'd see in any browser, including that you're using Terra. A page you leave open may reload when Terra next starts.
• Site data. Both can keep cookies and other site data on your Mac, as any browser does. There's no button in Terra to clear it yet.

Licence checks (§2) are the only connections to us that Terra makes on its own. Terra doesn't check for updates and doesn't send telemetry.

10. What we don't do

• No telemetry, usage tracking, crash reports or analytics.
• No ads, and no selling or sharing of personal information, including "selling" and "sharing" as California law defines them.
• We don't give your personal information to others for their marketing.
• We don't profile you.
• We don't train AI on your data; we never receive it. Providers you use have their own rules (§9).

11. Who we share data with

• Service providers that run Terra for us, under contracts that let them use the data only on our instructions:
  • Supabase (accounts);
  • Cloudflare (bot protection);
  • [EMAIL PROVIDER] (email);
  • [WEB HOST] (the website);
  • [MAILBOX PROVIDER] (support email);
  • [GitHub and Cloudflare R2 (feedback), if §7 applies].

  The full list, with locations, is at [DOMAIN]/subprocessors.

• Paddle, as described in §3.
• Authorities, when the law requires it, or to protect people's rights, safety or security.
• A buyer or successor, if [ENTITY] is sold or merged. We'll tell you first, and this policy will keep applying to your data.
• Anyone else, only with your permission.

12. Where your data is stored

We're based in the United States. Our account service runs in Supabase's US region. When personal data comes to us from the EU, the UK or Switzerland, our vendor agreements use the European Commission's standard contractual clauses, the UK Addendum and the Swiss equivalent.

13. How long we keep data

14. Security

• No passwords. You sign in with a passkey, or with a single-use code that expires after 10 minutes.
• Sign-in tokens stay protected. They live in your Mac's Keychain and in memory, never in the app's web view or in our logs.
• Your licence is cryptographically signed.
• Our vendor accounts require multi-factor sign-in.

No system is perfectly secure. If a breach affects your personal data, we'll tell you and the authorities as the law requires.

15. Your rights

Wherever you live, you can ask us to:

• give you a copy of your personal data, in a format you can take elsewhere;
• correct it;
• delete it;
• limit how we use it, or object to it, including where we rely on legitimate interests;
• withdraw any consent you've given, at any time.

Email [CONTACT EMAIL]. We'll reply within one month. To protect your account, we may confirm a request by sending a code to your account email.

If you're in the EU, EEA or UK, you can also complain to your data-protection authority; in the UK, that's the ICO. We'd appreciate the chance to help first.

Your notes are on your Mac, so you control them directly. We can't access, export or delete them for you.

16. Deleting your account

• Email [CONTACT EMAIL] from your account's email address, and we'll delete your account within one month. [Replace with the web flow at [DOMAIN]/account once it ships.]
• Deleting your account cancels your subscription. It deletes your account, your Macs and your subscription records from our servers.
• Backup copies are gone [7] days later. Sign-in logs expire on their normal schedule.
• Paddle keeps billing and tax records as the law requires.
• Your notes stay on your Mac. To remove them, delete your Library folder.
• Signing out of Terra removes your Terra sign-in from your Keychain.

17. Children

Terra is for people 16 and older. We don't knowingly collect data from anyone younger, and we delete accounts we learn belong to someone under 16.

18. California

• We don't sell or share personal information (§10).
• "Do Not Track" and Global Privacy Control. We don't track you across websites or apps, so there's nothing for these signals to switch off. We don't let other companies collect information about your activity across sites through Terra. Turnstile and Paddle.js (§4) process data only to provide bot protection and checkout.
• You can see and update your email address on your account page, and ask us about anything else at [CONTACT EMAIL].
• We don't share personal information with others for their direct marketing.

19. Changes to this policy

We'll post any change here with a new effective date. If a change is significant, we'll email account holders before it takes effect.

20. Contact

[ENTITY], [ADDRESS], [CONTACT EMAIL]