Privacy Policy

This Privacy Policy explains what the CARAPACE software and website at carapace.info do and do not collect, and what we do with the little information that does reach us. It applies to the Linux installer, the macOS application, the iOS application, and the carapace.info website.

1. What we don't collect

CARAPACE is a self-hosted personal AI operating layer. The whole point is your data doesn't leave your hardware.

• We do not run a server that receives your conversations, prompts, transcripts, images, or camera frames. Those go directly between your phone and the gateway you operate (Mac, Linux, or Pi).
• We do not log your API keys. They live in your phone's Keychain or in configuration files on your own machine.
• We do not require accounts, sign-in, or email. The iOS app and the macOS app do not have a login screen.
• We do not run analytics SDKs, advertising SDKs, or tracking pixels. There is no Segment, no Mixpanel, no Google Analytics, no Meta Pixel, no Amplitude — none of it.
• We do not sell, rent, or share personal data. There is nothing to sell.

2. What does flow over the internet

Running CARAPACE involves some network activity by design. Here's what goes where:

• Your phone ↔ your gateway. Chat, voice, and camera traffic moves directly between your iPhone and the gateway you're paired with, typically over your local network or your Tailnet. We never sit in the middle of this path.
• Your gateway ↔ AI providers. When you use Google Gemini, Anthropic Claude, OpenAI, xAI, or other AI providers, your gateway sends your prompts to the provider you configured using the API key you supply. Those providers operate under their own privacy policies. We recommend reviewing them — we don't control what they do with prompts.
• App updates and installer. Downloading the macOS DMG or running the Linux installer fetches files from carapace.info (hosted on Cloudflare). Those requests are standard web-server logs (IP address, user agent, timestamp) and are retained briefly by Cloudflare for abuse prevention. We don't correlate them to identities.
• iOS app downloads and IAP. Installing the iOS app and any in-app purchase goes through Apple, under Apple's privacy policy — not ours. See section 3.

3. In-app purchases

The iOS app offers one-time, non-subscription in-app purchases that unlock how many gateways a single iPhone can pair with (Household, Power, Corporate). These purchases are processed entirely by Apple using your Apple ID.

• We do not receive your name, email, payment method, or billing address from Apple.
• We do not receive the exact dollar amount you paid — Apple handles pricing, taxes, and refunds.
• The iOS app asks Apple's StoreKit API which products you currently own on this Apple ID, to unlock the corresponding device cap. That check happens on-device; the answer is cached locally in the iOS Keychain and UserDefaults.
• Family Sharing propagation (if enabled) and refunds are handled by Apple; we honor whatever StoreKit reports.

If you want a refund, request it through Apple directly (Settings → Apple ID → Subscriptions → Report a Problem, or reportaproblem.apple.com). We don't have access to the transaction and can't issue refunds on Apple's behalf.

4. Data stored on your own hardware

The iOS app stores the following locally on your iPhone:

• The list of gateways you've paired with (nickname + URL + auth token), in the iOS Keychain and UserDefaults.
• Your API keys if you've entered any, in the iOS Keychain.
• Conversation history cache, to avoid re-fetching on every app open. This is local-only.
• App preferences (camera quality, wake word, voice selection, theme).
• Optional diagnostic logs if you enable the Debug Console. These are never transmitted unless you explicitly share them.

The macOS app and Linux installer store config, tokens, and cached conversations on the machine where they run. Deleting the app (or the config directory) removes the data.

5. Microphone and camera

The iOS app requests microphone access for voice features and camera access for vision features. These only activate when you explicitly start a voice session or open a camera view. Audio and video frames are streamed directly from your phone to your gateway — we don't receive or proxy them.

An optional "wake word" setting keeps the microphone armed in low-power passive mode so the app can hear "Hey Claw." Local detection only — no audio is sent anywhere until the wake word fires and you start a session.

6. Cookies and local storage

The carapace.info website uses no tracking cookies. The only storage is first-party, same-origin localStorage used to remember UI preferences (e.g. which carousel card you scrolled to). No third-party scripts (other than Tailwind CSS and Google Fonts, both delivered via CDN) run on the site.

7. Children

The CARAPACE iOS app is not directed at children under 13. We do not knowingly collect data from anyone, but because the app processes inputs (voice, text, camera) that may be sensitive, younger users should use CARAPACE through a parent's Apple ID under Apple Family Sharing, which applies parental controls and purchase approvals.

8. Third-party services we rely on

Running the service requires us to rely on a handful of third parties. None of them receive your prompts or conversations:

• Apple — App Store distribution, StoreKit in-app purchases, iCloud Keychain (for your own device, at your option). Apple's privacy policy governs this layer.
• Cloudflare — CDN and static hosting for carapace.info and the installer. Standard edge logging.
• GitHub — source code hosting and the issue tracker. If you open an issue, everything you paste becomes public. We don't control GitHub.
• AI providers you configure — Google, Anthropic, OpenAI, xAI, or others. Your gateway talks to them directly with API keys you provide. Their policies govern how they handle your prompts.

9. Your rights

Because CARAPACE is self-hosted, most of your data is already in your hands — there's no "data export" request to make of us for your conversations. If you have questions about specific data you believe we hold (for example, installer logs tied to an IP address), contact us at the address below and we'll respond within 30 days.

If you're in a jurisdiction that grants rights to access, correct, or delete personal data (GDPR, CCPA, etc.), those rights apply to the limited data we do have. The main practical exercise of those rights is: request deletion, which will be honored to the extent any data exists to delete.

10. Security

We take reasonable technical and administrative measures to protect the limited data we do hold. That said, no system is perfectly secure. Because the architecture keeps your conversations off our servers, a breach of our servers would not expose your AI interactions. Breaches of your gateway (your Mac, your VPS, your Pi) are out of our control — securing that hardware is your responsibility.

If we become aware of a security incident affecting data we hold that relates to you, we will notify affected users to the extent required by applicable law.

11. Changes

If we update this Policy, the new version will always be at carapace.info/privacy/, with a fresh Effective Date at the top. Material changes will also be announced in the iOS app's Settings → About section and on the website. Continued use of the Software after an update means you accept the updated Policy.

12. Contact

Privacy questions, concerns, or data-deletion requests: open an issue at github.com/mikeypaepke-gif/carapace-site/issues (public) or reach us privately through the contact form at carapace.info.