Four walls, not one promise.
Privacy here isn't a policy you have to trust — it's four separate things the app is built to make impossible. Here's each one, and how it's held in place.
A login never becomes text.
You only ever type a key or password into the app's own native fields — never into a widget, never into a chat. It goes straight into the macOS Keychain, encrypted, in a store kept well away from any code.
fields: secret_key (value hidden)
A widget can't phone home.
Each widget runs locked in a sandbox with no access to your Mac and no internet of its own. The only way it can reach the outside world is one gateway inside the app — logged, time-limited and size-capped — so every request is accounted for.
Sign in once. We keep the session, never the secret.
Some services have no public way in — just a login. So you sign in once, yourself, in a window that belongs to the app. We keep only the resulting session, fenced to that service. Your password is never stored, and never seen.
“Habit Streak” wants to post an update to your account on stripe.com. This will change data on your behalf.
It builds the widget, then steps away.
This is the part people ask about most, so plainly: the AI helps make the widget. It never sees what's inside it. It works from your description and the names of your fields — your real numbers are fetched and shown on your Mac long after its job is finished.
What actually happens when a widget asks for data.
Not the principles — the mechanics. Here is every step a single number takes, from the widget asking for it to the moment it's on your screen.
The widget asks — but can't fetch it itself
A widget never has a line to the internet. When it needs fresh numbers it hands the request to the app's gateway and waits — it can't reach anything on its own.
The gateway checks it's allowed
Before anything leaves your Mac, the gateway confirms this widget was granted this connection and that the address is on its allow-list. A request to anywhere else is simply refused.
It's sent from your Mac, with the sealed session
The gateway makes the call straight to the source, attaching the encrypted login or session from the Keychain — and quietly re-unlocks it if it had expired. The credential is used, never revealed, and the trip never passes through us.
It's drawn on screen, then it's gone
The reply comes straight back to the widget and is drawn onto it. Nothing is copied off, nothing is logged with its values, nothing is sent on. Next refresh, the exact same path runs again — all on your Mac.
At no point — not while a widget is being made, not while it's running — can we or the AI read your logins or your data. There's no moment where it's exposed, because it never goes anywhere it could be.
Straight answers.
Built to keep your world yours.
Make something useful without handing your data to anyone — including us.