Conserius
Privacy policy
Eyva Privacy Policy
Effective date: 12 October 2026 · Last updated: 12 October 2026
This policy explains what happens to personal data when you use Eyva™, the assistant for macOS, your Eyva account and our website. It is written to be read in full.
1. The short version
- Eyva runs on your Mac. Your conversations, memory, notes, files, and what the microphone, camera and screen pick up are processed and stored on your Mac. We cannot see them and keep no copy.
- Cloud replies are off until you turn them on. Eyva starts in local-only mode. In that mode no conversation content is sent to any cloud AI model.
- Cloud replies are not offered to accounts in the EU/EEA, the UK or Türkiye yet; Eyva runs fully on your Mac there. See section 9.
- When cloud replies are on, the turns Eyva sends to the cloud are masked on your Mac first: personal details it detects are replaced with placeholders, recognisable passwords and keys stop the send altogether, and topics it recognises as sensitive are not sent at all. The masked turn goes through our relay to our AI provider, Anthropic. Masking is good, not perfect.
- Everything that leaves your Mac is recorded on your Mac first, and Eyva only connects to destinations on its own fixed list.
- No analytics, no advertising trackers, no automatic crash reports.
- We hold only your account: email address, plan, signed-in Macs and usage counts. Your card details are held by the payment provider, not by us.
- We do not sell or share your personal data and do not use it for advertising.
- Eyva is for adults — you must be 18 or over.
2. Who we are
The controller of the personal data in sections 5 and 6 is Conserius Inc. ("Conserius", "we", "us"), a Delaware corporation, Delaware file number 10775510. Our legal address is in care of our registered agent: Conserius Inc., c/o Legalinc Corporate Services Inc., 131 Continental Dr, Suite 305, Newark, DE 19713, USA.
- Privacy contact: privacy@conserius.com
- General support: support@conserius.com
- Security reports: security@conserius.com
Representatives. We have not appointed a representative in the EU (GDPR Art. 27) or in the UK (UK GDPR Art. 27), and we are not registered with Türkiye's data controllers' registry (VERBİS). That is why cloud replies and paid plans are not offered to accounts in those places yet (section 9): Eyva runs fully on your Mac there, and data that stays on your Mac is never processed by us. We will appoint a representative, and update this policy, before cloud replies are offered there.
For data that stays on your Mac (section 3), you are in control; we never receive it.
3. What stays on your Mac
Eyva keeps its data in your macOS user account, in Eyva's folder under ~/Library/Application Support/Eyva/. Its main database is sealed with a key kept in your macOS Keychain.
| Data | What Eyva does with it | Leaves your Mac? |
|---|---|---|
| Conversations, memory, notes, people you mention, settings | Stored in Eyva's database on your Mac | Only the masked text of a cloud turn, if cloud replies are on (section 4) |
| Your voice | Turned into text by macOS's on-device speech recognition | No |
| Camera, screen and what Eyva overhears in the room | Used for the task you asked for. The context it keeps is deleted after 24 hours | No |
| Files you point Eyva at | Read where they are; written only where you allow | Only text you or a cloud turn send (section 4) |
| Your location, if you allow it | Used for the question that needs it | Only as rounded coordinates to a weather or map service you switched on (section 6) |
| Faces you ask Eyva to recognise | A template stored on your Mac; not compared after 365 days | No |
| Crash records | Six fields — which part of Eyva stopped, the error's name or code, the minute it happened, a stack trace that names only Eyva's own program files, the build number, the macOS version — the 20 most recent, older ones dropped | No. After a crash Eyva asks; you can read the whole record and send it to us from your own mail app, or delete it |
| The record of every network connection | What Eyva connected to, when, and a fingerprint of what was sent | No |
| Your answer to "Are you 18 or older?" | Kept to decide whether Eyva may hold conversations on this Mac (section 12) | No |
You control this data. You can export it to a file you choose (Settings), and you can ask Eyva, in the conversation, to erase everything it holds. After an erasure, Eyva's nightly backup copies remain for 7 days before they are cleared. Because we cannot see this data, we cannot back it up, recover it or delete it for you. The Uninstall page lists every file Eyva leaves on your Mac and how to remove it.
4. Cloud replies — what leaves your Mac, and how
4.1 When
Only when you have turned local-only mode off, and only where cloud replies are offered (not in the EU/EEA, the UK or Türkiye yet — section 9). Then Eyva may send a turn to the cloud when it is hard, needs care or code, or when you ask. Otherwise it answers on your Mac. A free account includes 5 cloud replies a day; paid plans include a monthly allowance.
4.2 What happens on your Mac first
- Passwords, keys and tokens Eyva recognises stop the send. They are never masked and sent — the whole turn stays home. No setting turns this off.
- Sensitive topics stay home. Eyva is built so that special categories of personal data — about health, beliefs, sex life and similar — are not sent to the cloud. A turn Eyva recognises as about health, money or another sensitive topic, and anything that came from your mail, messages, contacts, notes, health data, browser history or password vault, is not sent to the cloud at all. Eyva recognises sensitive topics from a fixed list of words in English and Turkish, so it can miss some.
- Personal details are masked. Names, contact details, identity and account numbers, addresses and similar details Eyva detects are replaced with placeholders that are new for every request, so the same person never gets the same placeholder twice. Personal dates are cut down to the year. The key that turns placeholders back into real values stays on your Mac, encrypted, for at most 24 hours.
- You see a preview whenever at least one item was masked, before anything is sent.
- Every attempt is recorded before it is sent. The record on your Mac keeps a fingerprint of the exact bytes, not the bytes themselves, so you can check what went out.
When the answer comes back, real values are put back for display only. What Eyva stores keeps the masked form.
4.3 What masking cannot do
Masking is pseudonymisation, not anonymisation, so a masked turn is still personal data and we treat it that way:
- Detection is below 100%. Some details will be missed.
- Context can identify. A masked sentence can still point to a person through details like a job, a place or a rare event.
- It protects against the cloud, not against malware on your Mac.
- Images, screenshots and audio are not sent to the cloud in this version: an image attached to a turn is refused before sending, and screen, camera and picture content is never sent.
4.4 The route
Over an encrypted connection (TLS) from your Mac to our relay, which runs on Cloudflare, and from there to Anthropic's API, under our own account. Our relay checks your plan, reserves the cost of the turn, forwards it, and returns the answer. It does not store or log the content of turns. It records, per turn: your account id, the model, token counts, cost and time — the usage ledger that meters your allowance.
4.5 What Anthropic keeps
Anthropic processes cloud turns for us as our processor, under its Data Processing Addendum, and may not train its models on them. According to its own pages as last checked on 23 September 2026: inputs and outputs are deleted within 30 days; if a request is flagged by its safety systems, it may be kept for up to 2 years; and longer where the law requires.
5. Your account and payments
| Data | Why | Legal basis (EU/UK GDPR) |
|---|---|---|
| Email address, account id | To sign you in and run your plan | Contract (Art. 6(1)(b)) |
| A six-digit sign-in code | To sign you in. Stored only as a salted hash; valid 10 minutes; deleted once used | Contract (Art. 6(1)(b)) |
| Your signed-in Macs (at most two) and their sessions | To limit a plan to your own Macs | Contract (Art. 6(1)(b)) |
| Plan, status, period dates, the amount paid | To provide the plan you bought | Contract (Art. 6(1)(b)) |
| Usage ledger and allowance counters | To meter cloud replies | Contract (Art. 6(1)(b)) |
| Masked content of cloud turns (passes through, not stored by us) | To produce the cloud reply you asked for | Contract (Art. 6(1)(b)) |
| Billing records: payment events from the payment provider (paid, renewed, refunded, disputed), the amounts, and your billing country | Accounting and tax records | Legal obligation (Art. 6(1)(c)) |
| The country your connection comes from (from Cloudflare) | To apply where cloud replies and plans are offered (section 9) | Legal obligation (Art. 6(1)(c)) |
| Security records: sign-in attempts, the per-hour count of code requests, refused requests | To keep accounts safe and prevent abuse and fraud | Legitimate interests (Art. 6(1)(f)) — see below |
| Messages you send us | To answer you | Contract, or legitimate interests where you are not a customer |
| Optional features: premium voice, web search, the street map and the other services in section 6, and a crash record you choose to send us | Only what the feature needs | Consent (Art. 6(1)(a)). Each is off until you turn it on, and you can turn it off at any time |
Our balancing for legitimate interests. Our interest is keeping accounts safe and the service free of abuse and fraud. The data used is the least that serves it — counts, times and the outcome of a sign-in, never the content of what you ask — it is kept only as long as section 8 says, and you can object at any time by writing to privacy@conserius.com. We consider that this does not override your interests or rights.
Payments are handled by Stripe (Stripe, Inc., or Stripe Payments Europe, Limited, depending on your region), which sells paid plans as the merchant of record and processes your card, billing address and tax details as an independent controller under its own privacy notice. We pass it your account id and email when you start a checkout, and receive the facts above — never your card number.
6. Other services Eyva contacts from your Mac
These connections go directly from your Mac, only when you use the feature, and only to hosts on Eyva's list. We are not the recipient; each service gets your IP address and what the feature needs, under its own terms. The optional ones are off until you turn them on, and turning one on is your consent to that connection.
| Feature | Service | What it receives | When |
|---|---|---|---|
| Local AI model download | Ollama registry (registry.ollama.ai, files served from Cloudflare R2) | Your IP address and the file request | Once, when you approve installing the local model |
| On-device search model download | Hugging Face (huggingface.co, hf.co) | Your IP address and the file request | Once, on first run |
| Web search | Brave Search API | Your search query, with your own Brave key | Only if you add a key; a query containing anything the privacy checks catch is refused, not sent |
| Quick fact lookups | DuckDuckGo, Wikipedia | The query | When you ask |
| Street map | OpenFreeMap (tiles.openfreemap.org) | Map-tile requests, with no cookie | Off until you turn the map on |
| Weather, place search, elevation, satellite imagery, domain lookups, connection speed test | MET Norway; Photon (Komoot); AWS-hosted elevation tiles; NASA GIBS and POWER; domain registries (RDAP); Cloudflare speed test | Coordinates rounded to two decimals, or the place or domain you asked about; the speed test sends no data | Each is off until you turn it on |
| Reading a web page | The site you named | A normal page request | Only for a site you named in that turn |
| Premium voice | Inworld, through our account (section 7) | The text of a reply, one sentence at a time | Not active in version 1.0. When it is offered, it will be off until you turn it on, and only replies that came from the cloud and contained nothing masked and nothing sensitive will be eligible, up to a daily limit |
7. Who receives data (our processors and other recipients)
| Recipient | Role | Purpose | Data | Location | Their terms |
|---|---|---|---|---|---|
| Anthropic PBC | Processor | Produces cloud replies | Masked turn text, the instructions and tool list Eyva sends | United States | https://www.anthropic.com/legal/commercial-terms · DPA: https://www.anthropic.com/legal/data-processing-addendum |
| Cloudflare, Inc. | Processor | Hosts our relay (Cloudflare Workers) and its database (Cloudflare D1) | Account data (section 5); masked turns in transit; IP address | Cloudflare's global network | https://www.cloudflare.com/privacypolicy/ · DPA: https://www.cloudflare.com/cloudflare-customer-dpa/ |
| Stripe (Stripe, Inc. / Stripe Payments Europe, Limited) | Independent controller (merchant of record) | Checkout, payment, tax, receipts | Email, account id, plan; your card and billing details, which it collects itself | United States; Ireland | https://stripe.com/privacy |
| Resend (Plus Five Five, Inc.) | Processor | Sends your sign-in codes | Your email address and the code | United States | https://resend.com/legal/privacy-policy · DPA: https://resend.com/legal/dpa |
| Inworld AI | Processor (sub-processor for business customers) — not active in version 1.0 | Premium voice: turns reply text into speech | Reply text, one sentence at a time | United States | https://inworld.ai/privacy |
| Google LLC (Google Workspace) | Processor | Our company mailbox | Messages you send us | United States | https://workspace.google.com/terms/dpa_terms.html |
| Brave Software, Inc. | Independent — contacted from your Mac with your own key | Web search | Your query | United States | https://search.brave.com/help/privacy-policy |
| Hugging Face, Inc. | Independent — contacted from your Mac | Model download | IP address | United States | https://huggingface.co/privacy |
| Ollama | Independent — contacted from your Mac | Model download | IP address | United States | https://ollama.com/privacy |
| OpenFreeMap | Independent — contacted from your Mac | Map tiles | IP address, tile requests | Not published by the service | https://openfreemap.org (no separate privacy terms are published) |
| Authorities | — | Only where the law requires it | — | — | — |
About Inworld. The premium voice is not active in version 1.0. It will be offered only after Inworld has confirmed to us in writing how it uses and retains the text it receives, only with your consent, and with its audio marked as AI-generated (see the AI Disclosure).
We tell you in the app before we add a new recipient of cloud-turn content.
8. How long we keep data
| Data | Kept |
|---|---|
| Sign-in codes | 10 minutes; deleted once used |
| Sign-in code send log (your email, the time) | 1 day |
| Sessions | End after 30 days unused, and 180 days after you sign in however often used |
| Account, Macs, sessions, plan, allowance counters, your acceptance of these terms | While your account exists; deleted when you delete it |
| Billing records — usage ledger, payment events, pay-as-you-go purchases, withdrawal requests | 7 years from the end of the fiscal year they belong to, or longer where a specific tax law requires; then deleted. When you delete your account they are kept under a random id that does not name you |
| Content of cloud turns | Not stored by us. Anthropic: section 4.5 |
| Messages you send us | 2 years after the last message in the conversation |
| Data on your Mac | Until you delete it; see section 3 and the Retention Schedule |
The full schedule is in our Retention Schedule.
9. Where cloud replies are offered, and international transfers
Not yet in the EU/EEA, the UK or Türkiye. As of version 1.0, cloud replies are not offered to accounts in the EU/EEA, the UK or Türkiye, and neither are paid plans; Eyva runs fully on your Mac there, in local-only mode, and none of your conversation content reaches us. The app says so under Settings → Account & plan: "Cloud replies are not available in Türkiye yet; Eyva runs fully on this Mac." in Türkiye, and "Cloud replies are not offered in your region yet; Eyva runs fully on this Mac." in the EU/EEA and the UK. We will offer them there only once we have appointed the representatives the GDPR and the UK GDPR require (section 2) and, for Türkiye, settled a lawful route for transfers abroad under KVKK Art. 9 and registered with VERBİS. We will update this policy before that happens.
Elsewhere. We are based in the United States, and so are Anthropic and our other main providers. Where a transfer to the United States needs a safeguard, we rely on the Standard Contractual Clauses in each provider's data processing terms. Masking on your Mac is an additional safeguard. You can ask us for a copy of the safeguards.
10. Your rights
Everyone. You can ask us what data we hold about you and for a copy; to correct it; to delete it; and to restrict or object to its use. Write to privacy@conserius.com. You can also delete your account yourself in the app, under Settings → Account & plan → Delete account: it lists what is deleted and what is kept under a random id (the billing records in section 8) before you confirm. A subscription that still renews must be cancelled first. We answer free of charge within one month, and may ask you to confirm you own the account email. Data on your Mac is already in your hands (section 3).
EU, EEA, UK and Switzerland (GDPR / UK GDPR). You also have the right to data portability, to withdraw consent at any time without affecting earlier processing, and to complain to a data protection authority — for example where you live or work. We have no establishment in the EU or the UK, so there is no single lead authority for us; you may complain to the authority of your choice.
Türkiye (KVKK, Law No. 6698). Under Article 11 you may ask whether your data is processed, for information about it, its purpose and whether it is used for that purpose, who it is transferred to in Türkiye or abroad, its correction or deletion and notice of that to recipients, to object to a result against you that arises only from automated analysis, and compensation for damage from unlawful processing. Apply to us first; we answer within 30 days. If you are not satisfied, you may complain to the Personal Data Protection Board (KVKK).
California residents. The California Consumer Privacy Act's thresholds do not apply to us today, but we follow it voluntarily. In the last 12 months we have collected these categories of personal information: identifiers (email address, account id, device ids); commercial information (plan, purchases, usage); approximate location (the country your connection comes from); and the content of cloud turns, masked, in transit only. We collect them from you and from our payment provider, for the purposes in section 5, and disclose them to the processors in section 7 for those purposes. We do not sell or share personal information for cross-context behavioural advertising, and have not done so in the last 12 months. We do not use sensitive personal information to infer characteristics about you. You may ask to know, delete and correct your personal information, and you will not be discriminated against for doing so. You may use an authorised agent. Write to privacy@conserius.com.
11. Security
Masking and credential blocking happen on your Mac before anything is sent. Traffic to our relay and to Anthropic is encrypted in transit. Sign-in codes are stored only as salted hashes. Access to the relay and provider accounts is limited to the Founder of Conserius Inc., with two-factor authentication. No system is perfectly secure; if a breach affects you, we tell you and the authorities as the law requires. To report a vulnerability, see our Security Policy.
12. Children
Eyva is for people aged 18 and over. We do not knowingly create accounts for anyone younger. If you believe someone under 18 has an account, write to privacy@conserius.com and we will delete it.
On first launch Eyva asks whether you are 18 or older. Your answer is kept only on your Mac, in Eyva's data folder; we do not receive it, and Eyva asks for no ID and no date of birth. If you answer that you are under 18, or tell Eyva so later, Eyva stops holding conversations on that Mac.
13. Automated decisions
Eyva does not make decisions about you that have legal or similarly significant effects. Whether a turn is answered on your Mac or in the cloud is decided automatically, and you can override it.
14. Changes
If we change how personal data leaves your Mac — a new AI provider, or new kinds of data sent to the cloud — we tell you in the app before it applies. Other changes are posted here with a new date.
15. Contact
Conserius Inc., c/o Legalinc Corporate Services Inc., 131 Continental Dr, Suite 305, Newark, DE 19713, USA · privacy@conserius.com.
© 2026 Conserius Inc. Eyva™ is a trademark of Conserius Inc.