Privacy Policy
Sky (“we,” “us”) is a macOS notch copilot. This Privacy Policy explains what information we collect, what stays on your Mac, and what is sent to Sky’s servers when you Ask, dictate, or Act.
Summary
- Screen context is captured and stored locally on your Mac until you interact with Sky
- When you Ask, we send compressed text context and your prompt to our mothership gateway — not continuous video
- Temporary screenshots used for vision are deleted after the request
- Provider API keys never leave our servers; they are not embedded in the desktop app
- You can pause capture and delete local data anytime from the notch
Information we collect
Account information
When you sign up, we collect your email address and authentication identifiers through Supabase (our auth provider). If you use Google sign-in, we receive basic profile information permitted by that provider (typically name and email).
Device information
We assign a device identifier stored locally on your Mac to associate sessions and enforce usage limits. Session tokens are stored in the macOS Keychain.
Usage & metering
We log request counts per user per day (Ask, Flow, Act) to operate the service and prevent abuse. We do not sell this data.
When you Ask or use voice
When you submit a question or hold the mic:
- Your prompt and relevant local context (app name, window title, accessibility text) are sent to Sky mothership
- If text context is insufficient, a one-time compressed screenshot may be captured, sent for that request, and deleted locally afterward
- Voice audio is sent to mothership for transcription when you use voice input; it is not retained after processing unless required for debugging with your consent
When you Act
Act plans send your intent and metadata to mothership, which returns a validated action plan. Executing actions (e.g. composing email) happens on your Mac only after you Confirm in the notch. An audit log of confirmed actions is stored locally in Application Support.
What stays on your Mac
- Screen captures on app/window focus (event-driven, not uploaded continuously)
- Accessibility text extraction and OCR fallback
- 24-hour ring buffer in local encrypted SQLite
- Act audit log (JSONL in Application Support)
- Session credentials in macOS Keychain
What we send to Sky mothership
- Ask / Flow: compressed text context, your prompt, and optionally a single downscaled JPEG for vision
- Voice: audio for transcription
- Act plan: intent and metadata; server returns validated action JSON
- Auth: email, OAuth tokens (via Supabase), device id
- Metering: anonymized request counts
What we do not collect or send
- OpenAI, Anthropic, Natural, or Stripe secret keys (these remain on our servers)
- Continuous full-screen video streams
- Content from blocklisted apps (banking, password managers, and similar sensitive categories)
Third-party services
We use trusted processors to operate Sky:
- Supabase — authentication and account management
- AI providers (e.g. OpenAI, Anthropic) — process prompts and context to generate responses; governed by their policies and our data-processing agreements
- Natural.co — payment actions (Tier 4), proxied through mothership; never called directly from your Mac
These providers process data only as needed to deliver the feature you requested.
Retention
- Local data: retained in the 24h ring buffer until overwritten, or until you delete all data from Sky
- Server logs: retained for a limited period for security, debugging, and metering, then deleted or aggregated
- Account data: retained while your account is active; delete your account by contacting us
Your choices & controls
- Pause capture anytime from the notch
- Delete all local data (SQLite buffer and related files) from settings
- Revoke macOS permissions in System Settings
- Skip microphone during onboarding if you prefer typing only
- Confirm gate: no send, pay, or external action without your explicit approval
Security
We use encryption in transit (TLS), secure credential storage (Keychain on device), and access controls on mothership. No system is perfectly secure; report issues to security@getsky.app.
Children
Sky is not directed at children under 18. We do not knowingly collect personal information from children.
International users
Sky is operated from the United States. If you use Sky from other regions, your information may be processed in the U.S. and other countries where our providers operate.
Changes to this policy
We may update this Privacy Policy. We will post changes on this page and update the “Last updated” date. Material changes may be communicated in-app or by email.
Contact
Privacy questions or data requests: privacy@getsky.app