Privacy Policy
What Clankie does with your data.
Two ways to run Clankie
On your own Mac. The Clankie service runs on your Mac. Your Mac holds the conversations, terminal sessions, paired devices, and the grants each device has. The public gateway at api.clankie.bot is a relay that carries traffic between the phone and your Mac.
Hosted Clankie. The same service runs on a private machine we operate for you. The hosted sections below cover your account, that machine, the AI credits we provide, payments, and deletion.
Both use the Clankie app for iPhone and iPad and the same gateway. Where this policy says “your Mac”, the same applies to your hosted machine unless a hosted section says otherwise.
What the app keeps on your phone
The app stores two records in the iOS Keychain. Both are marked device-only, so neither syncs to iCloud Keychain nor migrates to another device:
- The pairing session — the device session token, the device id your Mac assigned, the session expiry, your Mac's route, and the name your Mac reports for itself.
- The notification registration — a registration id, a random key that authorizes turning delivery off, a counter, and this device's Apple push token.
Messages, terminal output, and fleet state live on your Mac. The phone displays them and keeps no copy anywhere else. Three display preferences — menu density, skin, and the commons viewport — sit in ordinary app storage.
What pairing sends
You scan a one-time QR code or paste the secure pairing link shown on your Mac. That link gives the app a secret used to encrypt traffic to your Mac; the secret is not sent to the gateway. The app sends the pairing request, a fixed device label (Clankie mobile), and the platform (ios) inside that encrypted connection, so the Mac can list and revoke the device with clankie devices. It sends nothing else: no advertising identifier, no model or OS version, no contacts, and no location.
What passes through the gateway
The gateway relays traffic between the phone and your Mac. It stores no message content, terminal bytes, or authorization headers, and writes none of them to a log. Its own log lines carry an opaque host id, a request id, the HTTP status, the response byte count, a duration, and connect and disconnect events. Those lines, and the app diagnostics below, go to our log store in AWS CloudWatch and are kept for 30 days.
The web server in front of the gateway keeps a standard access log: client IP address, user agent, request line, TLS parameters, status, size, and duration. That log stays on the gateway machine, rotates by size, and is not shipped anywhere.
Application traffic is end-to-end encrypted between the phone and your Mac, including conversations, controls, delivered files, and terminal traffic. TLS also protects the connections to the gateway, which runs on AWS. The gateway can see routing identifiers, ciphertext sizes and timing, but cannot decrypt application content. Notification delivery retains the routing metadata described below. Pairing keys do not provide forward secrecy: disclosure of a pairing key can expose previously recorded traffic for that key. Re-pairing rotates device keys.
Diagnostics
While Share diagnostics is on (Settings → This device; it is on by default), the app sends connection health to the gateway: pairing, reconnect, wake, send-to-acknowledgement, first-reply and terminal-frame timings, each with an outcome and an error code, plus your Mac's opaque host id, a device reference, the platform and the app version. They never carry message text or terminal content. They are sent only for pairings through the gateway, not for pairings on your local network, and are kept for 30 days. Turn the switch off to stop them.
Notifications
Notifications are optional. If you allow them, the app sends its Apple push token, its registration key, and your Mac's opaque host id to the gateway, which stores them so it can address a notification to your device. The token never reaches your Mac.
A notification carries no message content. Your Mac asks the gateway to wake a device for a conversation; the gateway sends a fixed alert reading New message along with the host and conversation ids, and the app then fetches the thread from your Mac over its normal authenticated connection. Apple sees the push token, the app's topic, those two ids, and the timing.
Turning notifications off in the app clears delivery: the push token and device id are erased. The gateway keeps the registration id, a hash of the registration key, and the counter, so that a stale request cannot switch delivery back on.
Camera and photos
The camera is used only to scan the pairing QR code, and only while that scanner is open. Frames are not stored, written to disk, or sent anywhere; the app reads the decoded text and discards everything else.
Live conversations currently accept text, so their composer does not offer photo selection.
Sign-in email
An email address is used only for sign-in codes and as your account identity: for your Mac's remote access, and for a hosted Clankie account. You type it into Clankie on your Mac or into the hosted account page; the phone app never asks for, stores, or sends an email address. One-time codes come from Amazon Cognito through Amazon SES from no-reply@clankie.bot. The address is held by Cognito. The gateway and our account service keep only the pseudonymous account identifier from a verified sign-in, never the address itself.
Hosted Clankie
Your account
Our account service keeps what it needs to run your plan: your pseudonymous account id, your Stripe customer and subscription ids and their status and dates, your plan and its limits, your AI credit balance and purchases, the ids of your machine and its storage, routing details, your machine's running state and its active hours and data use, and a history of changes to your subscription and machine. It never holds your conversations, files, repositories, browser sessions, model keys, pairing secrets or card details.
Your machine
Your hosted Clankie runs on its own virtual machine with its own storage volume, in Amazon Web Services' US East (N. Virginia) region. The volume holds his settings, memory, conversations, files, repositories and credential broker, and is encrypted at rest with AWS-managed keys. The machine accepts no inbound connections and runs no SSH server; you reach it through the app and the gateway. When it's idle it sleeps, and the volume stays as it was.
AI models and credits
With AI credits, your Clankie's model requests (the text and any images he sends to think and reply) pass through our model relay at api.clankie.bot to OpenAI, using our account. The relay checks and meters each request and records its cost against your credits. It does not store or log the content of requests or replies. It asks OpenAI not to store responses, and identifies your machine to OpenAI only by a pseudonymous id, never your account id or email. OpenAI processes those requests under its own terms.
With your own key or subscription, your machine sends requests straight to the provider you chose, under that provider's terms. If a provider is already connected to your Clankie, its key is stored only on that machine. Our services never see it, and those requests don't count against credits.
Payments
Payments are handled by Stripe. We never see or store your card. We give Stripe our pseudonymous account id with your customer record, and keep the Stripe ids and subscription status listed above. Invoices and receipts stay with Stripe, which also keeps them for tax records.
Logs and records
Apart from the web server access log described above, our services write log lines with ids, codes and numbers — never message content, prompts, replies, email addresses or IP addresses. Account-service and model-relay lines are kept for 90 days; gateway and machine health lines for 30 days. Billing and usage records (amounts, dates and states, with no content) are kept for accounting.
When a subscription ends
If you cancel or a payment fails for good, your machine is stopped and a snapshot of its storage is kept so you can pick up where you left off if you come back. You can ask us to delete it at any time.
Deleting your Clankie
Request deletion from your account page. We cancel your subscription, then delete your machine, its storage and snapshots, and your sign-in account within 24 hours of your request. Afterwards, Stripe keeps your invoices for tax records, and billing and usage records without content, and log lines, remain until they expire as described above.
Service providers
Hosted Clankie relies on Amazon Web Services (machines, storage, sign-in through Cognito, email through SES, logs, and the gateway), Stripe (payments), OpenAI (the AI used with credits), and Apple (notifications). Data is stored in the United States.
No tracking
The app has no tracking, no advertising, and no analytics, attribution, or crash-reporting SDKs, and it sends nothing to any host except api.clankie.bot and your own Mac. The only third parties involved are the AWS services named above and Apple, for notification delivery. The app's iOS privacy manifest declares no tracking. It declares the two identifiers the notification registration involves — a device identifier and a user identifier — and the diagnostics above, all collected for app functionality only.
The website
The home page counts visits without cookies: each page view sends our account service its path, the referring site, and any utm_ campaign tags. To count unique visitors, it hashes your connection's address and browser with a key that changes every day and is never stored; the address and browser themselves are not kept. The count is kept for 90 days. Like every request to api.clankie.bot, the ping also appears in the web server access log described above.
The home page also sends a first-party analytics beacon to jcvolpe.me for page views, engagement, and outbound clicks. Each event carries a random visitor id in localStorage, a session id in sessionStorage, the path, the referrer, any utm_ parameters, screen and window size, pixel ratio, browser language, and time zone. There are no cookies and no third parties. The film on the home page loads from clankie.bot only when you press play. This page and the support page send nothing.
Your choices
- Revoke a device on your Mac with
clankie devices revoke; it loses access immediately. - Turn notifications off in the app to clear its delivery registration at the gateway.
- Turn off Share diagnostics in the app to stop sending connection health.
- Delete the app to stop it using its stored credentials, and revoke the device on your Mac to end that device's access.
- Delete a hosted Clankie and its account from your account page.
- Ask for removal of a Mac remote-access account through the contact below.
Children
Clankie is not directed at children under 13.
Changes
When this policy changes, the effective date above changes with it.
Contact
Open an issue at github.com/Volpestyle/clankie/issues.