Your content is not our source of data.

What Does This Mean? processes on device by default; every step that would take content off the device requires your explicit consent. This website never receives your ledger, AI API keys, official subscription tokens, or app selections.

Design principle

First reduce what can be collected, then protect what remains. A feature never asks for a permission it does not need.

What we process

Only the text, follow-up, or single image you actively share is processed — plus, when and only when you choose Explain clipboard contents from the Mac menu, whatever is on the clipboard at that moment. Each entry also records which app you were in (for example "Terminal"); it is written to the ledger on your device, and **when you use a cloud AI it is sent along with your question** as a hint about where the text was captured. It is not sent when you use the Apple on-device model. Everything runs on device by default; an image leaves the device only with your explicit per-share consent (see Images and OCR). macOS does **not** poll or watch the clipboard in the background — it reads once, when you ask. iOS does not request Photo Library access.

Apple on-device models

When selected, explanation happens on a supported Apple Intelligence device. The app requires no AI account and does not reroute content to a third party.

Third-party APIs

Only after you choose an API provider will locally masked text go to its official HTTPS endpoint. API usage is billed separately from chat subscriptions and follows that provider's retention terms.

Official macOS clients

The Mac app only launches the official client you choose. It never reads browser cookies, CLI sessions, OAuth tokens, or AI credentials from Keychain.

Where API keys are stored

An API key you voluntarily provide on iOS lives in ThisDeviceOnly Keychain for the app and Share Extension. It never enters iCloud, the ledger, UserDefaults, analytics, or logs.

The ledger and deletion

Masked completed answers stay on your device: an App Group container on iPhone, the Application Support folder on Mac. Delete one, clear all, or export JSON; we hold no cloud copy to delete. **Your own backups do cover it, though** — if iCloud Backup is on, the ledger goes up with the backup; on Mac, Time Machine backs it up. That copy is in your Apple account or on your drive, not with us; adjust it in your system backup settings. The ledger is not inside iCloud Drive's sync scope.

Images and OCR

On-device by default: the original image is resized, read, and classified only in Share Extension memory, and the model receives masked text plus limited visual signals. Only after your explicit consent for that share does an image—with location and other metadata removed—leave the device, sent to a cloud AI you configure yourself and governed by that service's data policy; the consent covers that one share only, and this app writes the image to neither the ledger nor its own logs.

What we hold when you buy a licence

If you bought the paid Mac licence, we hold: a **digest** of the email you paid with (not the address), a **digest** of the licence key (not the key — we cannot reconstruct it, which is why we cannot recover it for you), the public key and fingerprint of each activated Mac, the device nickname you chose, the time and amount of payment events, and an audit trail of licence operations. The signing key used to issue licences is held in AWS KMS in the Tokyo region. We keep this data for as long as your licence is valid; to have it deleted, email us and we will do it by hand (payment records are kept for the period tax law requires). We never receive or store your card number — that stays with Stripe. Nobody using the free Apple on-device model generates any of this.

Website data

This site has no login, API-key form, cloud ledger, ads, or behavioral analytics. Language switching stores one necessary preference cookie, wdtm_locale, limited to zh-Hant, en, or ja and expiring after 180 days. You can remove it at any time in browser site-data settings. Hosting infrastructure may retain essential technical request records for security and availability.

How future features will change

Before adding sign-in, sync, an API proxy, a cloud ledger, or analytics, we will update the data flow, retention policy, and consent—never enable them silently.

Contact

Need help or found a security issue?

Email cso@titapex.com. Never post real keys or private content in a public issue.