Privacy and data

The Cleat Mac app has no account, no server and no analytics. It is a native app that reads and writes files in your home folder, and it sends nothing about you anywhere unless you use a feature listed under Network or choose Report an Issue.

Website analytics

The getcleat.app website uses Google Analytics to count visits and to see which pages and buttons are used, but only after you say yes on the cookie banner. Until then, and if you say no, Google Analytics is not loaded at all: no script, no cookie, no request to Google. If you say yes, it sets its own first-party cookies so a returning visit counts as one visitor and not two; the events carry the page, the text of the button and how far you scrolled, never a name, and advertising signals are switched off. Your answer is kept in your browser’s local storage, not in a cookie, so saying no does not itself set one, and a browser that sends Global Privacy Control is taken as a no without asking. You can change your choice at any time from the Cookies link in the footer; going from yes to no removes the analytics cookies there and then. See Google’s privacy policy. None of this touches the Cleat Mac app.

The “Report a bug” button on the site opens a report form hosted by SnagFrog, our issue tracker; it includes this page’s address, your browser and any recent page errors.

What is stored

• Clipboard history, usage counts, aliases and row hotkeys, in a SQLite file under ~/Library/Application Support/Cleat.
• Clipboard images, as files next to it.
• Commands, snippets and quicklinks, as plain files under ~/.config/cleat.
• Preferences, in the standard preferences plist.

You can open, back up, copy or delete every one of these.

What is not stored

Keystrokes. Snippet expansion watches for keywords and keeps nothing. Copies from password managers and concealed pasteboard items are never recorded.

Network

Once a day Cleat asks the update feed at getcleat.app whether a new version exists. That request carries the app version and the macOS version, the same as any Sparkle-updated app. You can turn the check off in Settings. Currency conversion fetches daily reference rates from Frankfurter. Place searches go to Apple Maps when submitted. Web searches and quicklinks open your browser. The built-in assistant model needs a download from Hugging Face. Cloud assistant requests go to the provider you configure; a model server receives prompts at its configured address.

Apple Intelligence and translation

Apple Intelligence and translation process text on the Mac through Apple’s frameworks. The built-in assistant model also runs locally. If you choose a cloud assistant, Cleat sends prompts, selected clipboard text and conversation context to that provider. API keys stay in macOS Keychain.

Permissions

Each permission is requested when the feature that needs it is used, never before. See Requirements and permissions.

Two newer places

Screen time, when you turn it on, goes into a screen_usage table in the same cleat.sqlite: one row per app per day holding a number of seconds, and nothing else. Forget Screen Time in Settings › Extras empties it.

The built-in assistant’s weights live in ~/Library/Application Support/Cleat/models, fetched once from Hugging Face when you click Download and never touched by the network again. Remove in Settings › General deletes them; so does deleting the folder.

Local backups

Export a .cleatbackup folder from Settings › Data to save clipboard history and images, snippets, commands, configuration and preferences. Restore takes effect after you quit and reopen Cleat, replaces local data, and keeps a recovery copy of the previous files.

Keep backups private: they can contain clipboard text and local command credentials. Model downloads, Keychain credentials, macOS permissions and other apps’ data are excluded. On another Mac, download models and grant permissions again.

Reporting an issue

Only when you choose Report an Issue… (in the menu bar menu, or the Report an Issue row in the palette), Cleat first shows a window listing what the report will carry; nothing is uploaded until you choose Continue in Browser, and Cancel sends nothing. It then opens a report form hosted by SnagFrog, our issue tracker, and passes along the app version, your macOS version, Mac model, processor type, memory size and language. It sends no picture of any window and no log, so nothing privacy mode hides, such as clipboard contents, file paths or note titles, goes with it. What you type into the form, and any screenshots you attach, are used only to answer you and fix the problem.

SnagFrog stores reports in the EU (Frankfurt); replies by email go out through Resend in the US. See SnagFrog’s privacy policy.

Crash reports

macOS writes a report to ~/Library/Logs/DiagnosticReports when an app crashes. If Cleat finds one of its own that you have not seen, the next launch offers to send it. Send Report opens the same SnagFrog report form as Report an Issue, with that crash report attached and your version filled in. The crash report holds stack traces, loaded libraries and file paths on your Mac, with your home folder written as ~; the window that opens first lets you read it and leave it out before anything is uploaded. Not Now dismisses it. The reports never leave your Mac on their own; Send Crash Report in the palette and the menu bar do the same thing on demand. An ordinary Report an Issue never attaches a crash report.