Privacy Policy
Last updated 1 November 2026
CortexNotch is built so that your data stays on your Mac. The app does not send us your messages, your notes, your cluster metrics or anything your AI stack produces. This page is the precise version of that claim, including the few things we do receive.
Who is responsible
CortexNotch is operated by a sole proprietor based in Texas, United States, who is the data controller for the information described here. Contact: support@cortexnotch.com.
What we collect, and why
| Data | Why we hold it | Kept for |
|---|---|---|
| Email address | To issue your licence key and contact you about your purchase. | Life of the licence |
| Order reference | To tie a licence to a payment, and to revoke it if refunded. | Life of the licence |
| Licence key | To verify activations and reissue your key if you lose it. | Life of the licence |
| Mac hardware identifier | To enforce the two-machine limit. Sent when you activate. | Until you deactivate |
| GitHub username | Only if you ask for Cortex Stack access, to send the repository invitation. | Until access is withdrawn |
| Update check details | When the app checks for updates (about every six hours) it sends its build number, your Cortex Stack version, your macOS version, and a one-way hash of the hardware identifier. We use these to know which versions are in use and how many installs are active. Your country is derived from the connection; your IP address is not stored. | 180 days after the last check |
| Server logs | Security and abuse prevention on the licence service. | Short-term |
The hardware identifier is your Mac's platform UUID, read from the operating system. It identifies the machine, not you. We use it to count activations against your licence, and in hashed form to match update checks to those activations. The hash cannot be turned back into the identifier.
What we never receive
- Your card details. Payment is handled entirely by Stripe. Card numbers never reach our servers.
- Your messages or notifications. CortexNotch reads Messages and Contacts locally, on your Mac, to draw the notch. None of it is transmitted.
- Your cluster and AI data. Prompts, responses, models, notes, voice audio and cluster metrics stay on your hardware. The AI stack runs locally and is not connected to us.
- Usage analytics. There is no telemetry, no analytics SDK, and no crash reporting that phones home.
The only routine network calls the app makes to us are licence activation and update checks. If you never activate, we hold nothing about you beyond your purchase record.
Legal bases (UK and EU users)
- Performance of a contract — issuing and validating your licence, and providing repository access.
- Legitimate interests — preventing licence abuse and keeping the service secure.
- Legal obligation — retaining transaction records where tax law requires it.
Who else processes your data
| Provider | Role | What they receive |
|---|---|---|
| Stripe (incl. Link) | Merchant of record and payment processor | Your payment details, billing address, email |
| GitHub | Repository hosting | Your GitHub username, only if you request Stack access |
| Cloudflare | DNS, edge security and email routing | Request metadata; email sent to our support address |
We do not sell your personal information, and we do not share it for advertising. We have never received a government request for user data; if that changes, we will say so here where the law permits.
International transfers
Our providers operate in the United States and elsewhere. Where data is transferred out of the UK or EU, those providers rely on Standard Contractual Clauses or an equivalent mechanism.
Your rights
Wherever you live, you may ask us to show you what we hold, correct it, delete it, or send it to you in a portable format. Email support@cortexnotch.com and we will respond within 30 days.
If you are in the EU or UK you also have the right to object to processing, to restrict it, and to complain to your local data protection authority. If you are in California, you have the right to know, delete, correct, and to not be discriminated against for exercising those rights — we do not sell or share personal information as those terms are defined by the CCPA.
Deleting your data means your licence can no longer be validated or reissued, so we will confirm before doing it.
Security
Licence records are held in an encrypted-at-rest database on infrastructure we control. Licence tokens are signed with an Ed25519 key that never leaves our systems. Access to the production environment is limited to the operator.
Children
CortexNotch is not directed at children under 13, and we do not knowingly collect their data.
Changes
If this policy changes materially we will update the date above and, where the change affects existing customers, email you.