Macchiato (“the app”) is a chat client for communicating with an AI agent that you run and connect yourself. This policy explains what we collect, why, and your choices. Macchiato is operated by SUPERMIND PTE. LTD. (“we”, “us”).
What we collect
We collect only what we need to provide the service:
- Account: your email address (used for passwordless sign-in via a one-time code) and an account identifier.
- Your conversations: the messages you exchange with your agent, including text, and any images, audio (voice messages), and files you choose to attach. These are stored so your history is available across your devices.
- Device / push: a push notification token and basic device identifier, so we can deliver notifications you enable.
- Connector status: if you link an agent using the Macchiato connector, it periodically reports basic operational health — whether it is running and connected, software versions, and its most recent error — so the app can show whether your agent is reachable and help diagnose problems. This does not include the contents of files or anything else on your machine.
We do not collect your location, contacts, health, or financial information, and we do not include third-party advertising, analytics, or tracking SDKs.
How we use it
We use this data solely to operate the app: to sign you in, sync and display your conversations, deliver notifications, and provide support if you contact us.
We do not:
- sell your messages or personal data;
- use your messages to target advertising;
- use your messages to train machine-learning models.
Your agent and AI providers
Macchiato is a relay: it carries your messages to an AI agent that you run and connect. When you send a message, its content — text, and any images, audio, or files you attach — is delivered through our servers to that agent, which runs on your own computer under your control.
To generate a reply, your agent may in turn send your message content to a third-party AI provider that you have configured — for example Anthropic (Claude) or OpenAI — using your own account and API keys with that provider. That processing is governed by the chosen provider’s own terms and privacy policy; those providers state that they do not use API/business content to train their models. Macchiato itself does not select an AI provider or send your data to any AI service on its own — your agent does, according to your configuration. If you would rather no message content reach a third-party AI provider, connect an agent that runs a local model, or do not connect an agent.
Service providers
We run Macchiato on a small number of infrastructure providers that process data on our behalf, only to provide their service to us:
- Fly.io — hosts our servers and database (Sydney, Australia).
- Tigris — object storage for attachments and for our encrypted database backups.
- Apple — delivers push notifications to your devices.
- Resend — sends the sign-in code emails.
- Sentry — error monitoring for our server and web app.
None of them may use your data for their own purposes. Because we use these providers, your data is stored in Australia and may be processed in other countries; where the law requires it, we take steps to ensure it receives comparable protection wherever it is handled.
Tracking
We do not track you across other companies’ apps or websites, and we do not share your data with data brokers. The app does not request App Tracking Transparency permission because it does no tracking.
Encryption and storage
Conversations come in two levels of privacy. Every conversation is encrypted in transit (TLS/HTTPS and secure WebSockets) and stored encrypted at rest on our servers, which act as a searchable mirror so your history syncs across devices and reaches you by push. The agent itself, and everything it remembers, runs on your own machine — not ours.
You may optionally mark any single conversation as end-to-end encrypted, in which case its message text is stored only as ciphertext that our servers cannot read — the keys remain on your device and your own agent.
Two limits of end-to-end encryption to be aware of. First, it currently covers message text only: attachments — images, files, and voice recordings — are not end-to-end encrypted, even in an end-to-end encrypted conversation; they are stored in a private storage bucket that our servers can access. Second, limited metadata (such as which conversations exist, timestamps, and message sizes) remains visible to our servers in order to route messages.
Push notifications include the beginning of a new message by default, delivered through Apple’s push service. You can turn message previews off in the app’s notification settings.
Permissions the app may request
- Camera — to scan the pairing QR code, or to take a photo to attach to a message.
- Microphone — to record a voice message, which is transcribed by your agent.
- Photos — to let you choose an image to attach.
- Notifications — to deliver new-message push notifications.
Each is requested only when you use the related feature, and is optional.
Your AI agent
Macchiato connects to an AI agent that you provide and run (for example, on your own machine). When you send a message, we relay it to your agent; your agent’s responses are relayed back and stored in your history. What your agent does with a message is governed by the agent software you run, not by this app.
Data retention and deletion
We keep your data until you delete it or close your account. You can delete individual conversations in the app. To delete your account, open Settings → Delete account: this permanently and immediately removes your account and all associated data — conversations, messages, attachments, and linked agents — and cannot be undone. Copies of deleted data may persist in our encrypted backups for up to 30 days before they are purged on schedule. If you need help, contact hello@macchiato.chat.
Your rights
You can ask us for a copy of the personal data we hold about you, ask us to correct it, or ask us to delete it — email hello@macchiato.chat and we will respond within a reasonable time. You can also delete individual conversations and your entire account directly in the app. If the law where you live gives you additional rights (such as data portability or the right to complain to a supervisory authority), those rights are not affected by this policy.
Children
Macchiato is not directed to children and is rated for adults.
Changes
We may update this policy; we will post the new version here with an updated date.
Contact
Questions or requests, including data-protection requests: hello@macchiato.chat. This mailbox reaches the person responsible for data protection at SUPERMIND PTE. LTD. (UEN 202216226M, registered office: 81 Ubi Avenue 4, #09-18, UB. One, Singapore 408830).