Aureole has no account and no analytics, and what you do in it doesn’t go through us. This page covers everything that’s left: what leaves your Mac, where it goes, and how long it stays there. Questions? Write to us.
Version of November 3, 2026
What you do in Aureole stays on your Mac, or goes straight to the providers you chose. We sell no data, show no ads, and do not track what you do. Here is what we do process nonetheless, for the website and then for the app, and why.
The controller of the processing described here is Christophe Cousin, entrepreneur individuel (EI), Moulin de la Mouchère, 61130 Saint-Cyr-la-Rosière, SIREN 949 854 822, publisher of Aureole. For any question about your data or to exercise your rights: hello@aureole.app.
When you use an AI provider, a reseller or a third-party service, that party is responsible for what it does with your data, under its own policy.
Like any web server, our host, Vercel, receives your IP address and technical information about your browser, which it keeps in its logs to run and protect the website. Basis: our legitimate interest in serving a secure website.
To know which pages are read, the website counts its visits with Vercel Web Analytics. For each page viewed, it records its address, without anything after “?” or “#”, the address of the page you came from, your country, region and city, derived from your IP address, your operating system, your browser and your type of device. No cookie: a visit is recognized by a fingerprint computed from the request, which Vercel erases after twenty-four hours. We only see overall figures, never a person. Basis: our legitimate interest in knowing what the website serves.
The website sets only one cookie, NEXT_LOCALE, which remembers the language you’re reading it in: when you change it, or when you open a page in a language other than your browser’s. It is erased when you close your browser. It is a preference cookie, which the law exempts from consent. In the help center, the steps of the path you check off stay in your browser (local storage): nothing leaves it, and they are erased with the site’s data. A service you ask for, also exempt from consent. The audience measurement sets no cookie, and the website has no advertising tracker: that is why no banner asks for your consent.
We collect your email address, and the language of the page, to write to you with each piece of Aureole news. Basis: your consent, given by submitting the form. Signing up is for people aged fifteen or over.
Your address is entrusted to Resend, which stores it in the United States and sends our emails from Ireland, without tracking opens or clicks. It is kept until you unsubscribe: reply “stop” to any of our emails, or write to us.
To prevent abuse of the form, your IP address is used to count attempts for one hour, then forgotten. Basis: our legitimate interest in protecting the website.
The contact form sends us your email address and your message. It reaches us through Resend, which delivers it from Ireland and keeps a copy for thirty days in the United States. We receive it in our mailbox, hosted by OVH in France, and keep it for three years after our last exchange, to follow up on your request. Basis: our legitimate interest in answering you.
As for the news sign-up, your IP address is used to count submissions for one hour, then forgotten. You can also write to us directly, at hello@aureole.app: nothing then goes through the website.
Your conversations, your memory, your library, your agents and your settings are stored on your Mac, and nowhere else. Your API keys are kept in the macOS keychain. Audio transcription happens on your Mac, unless you choose an online service. We have no access to any of it.
When you query an online model, Aureole sends the provider you chose what the request needs — your message, what you selected or attached, a voice to clone —, straight from your Mac, with your key. That provider processes this data under its own policy and responsibility: read it, especially on training its models. With a local model, nothing leaves.
Aureole only knows your location if you allow it: macOS asks you at the latest the first time a tool needs it, for while you use the app, and you can withdraw it in System Settings › Privacy & Security › Location Services. It serves the tools that need it, maps (“from here”, “near me”) and, through them, the weather “here”: Aureole reads it on your Mac, asks Apple for the matching address, then hands both to the conversation’s model, which therefore receives them at its provider with the tool’s response, except with a local model. Without your permission, Aureole does not try to guess it: it queries no IP-based location service, gives the model only your Mac’s time zone, as a mere hint, and asks it to ask you which city you are in.
With OpenAI, Aureole asks that your exchanges not be stored to be picked up later: all the history needed goes with each message. One exception: when you generate an image with an OpenAI model in a conversation, the response, image included, stays with OpenAI, under its own rules, so that you can retouch it in the next message.
To read a file you attach, OpenAI, Anthropic, Google and Mistral require it to be placed in their file storage. Aureole places it there with your key, then asks them to delete it as soon as the answer arrives or, when the provider searches it for several questions in a row, three days later. The provider may keep it longer, under its own rules.
To transcribe a YouTube video, whether you give it to the bar, a conversation or the library, Aureole sends its address to Google through the Gemini API, with your Gemini key: Gemini reads the video, Aureole doesn’t download it. Google handles this request under its own rules; on its free tier, it also uses it to improve its products. Without a Gemini key, Aureole asks YouTube for its subtitles.
Likewise, when an Aureole tool queries a public source, reads a web page or calls an MCP server you added, the request goes straight from your Mac: that service sees your IP address and what Aureole asks it. Apple’s official store badges, shown next to each app or podcast Aureole finds, load from Apple’s image server: that request carries your IP address, the ordinary headers of a web request, the badge wanted and the app’s language — never your search.
Finally, Aureole contacts four kinds of services on its own, passing them nothing about you but your IP address and what it asks them for:
When you buy a license, our reseller collects your name, your email, your billing address and your payment method: it is responsible for them, under its own policy, and passes on to us what we need to serve you — your email, the plan bought, the invoice. We keep these for as long as your license exists, and accounting records for ten years, as the law requires.
To activate and check the license, the app sends the service that manages our licenses your key, your Mac’s name and an activation identifier, on activation and then once a day. Basis: performance of the license agreement.
When you ask for the weather, Aureole gets it from Apple (Apple Weather); when it shows you a map, that comes from Apple too (Apple Maps). To query these services, it needs access tokens, which our website issues: the app requests them from aureole.app, then keeps the weather’s for an hour, the maps’ for twelve hours. With its request, it sends your license key, if you have activated one, and an identifier drawn at random the first time it needs one, then kept in the app’s settings — it is not your Mac’s serial number. During the trial, which has no key yet, this identifier is enough.
Our website checks the key, without recording it, then counts the requests, so that no one can exhaust the service: your IP address for one hour, and your license’s identifier — or, during the trial, the randomly drawn identifier — for twenty-four hours; after that, they are forgotten. Nothing else is kept, apart from the host’s logs (article 3). Basis: performance of the contract, of which the weather and maps are features, and our legitimate interest in protecting these services.
With the weather’s token, the app queries Apple directly from your Mac: it sends the coordinates of the place you asked about, to within about ten meters, its time zone and country, and the app’s language; Apple also sees your IP address. Neither your key nor your identifier reaches Apple: the token only says who we are. Apple processes this request under its own policy, on its own responsibility.
With the maps’ token, the app asks Apple, directly from your Mac, for what it needs to draw the area the map shows; Apple also sees your IP address. Here too, neither your key nor your identifier reaches Apple.
At every launch, then once a day, Aureole asks our website whether a new version exists. This request carries your IP address and Aureole’s version, nothing else: your Mac’s profile is not sent. You stop it in Settings › General, by unchecking “Check automatically”. Basis: performance of the contract, which includes updates.
When a version is available, Aureole offers it to you, and installs it only if you accept. If you check “Download automatically”, in the same settings (unchecked at first), it downloads it from our file servers and installs it when you quit the app, without asking you to confirm.
To fix Aureole’s defects, the app sends us a report when it crashes or hits an error, through Sentry, which stores it in Germany. These reports are on by default; you can turn them off at any time in Settings › Privacy › Diagnostics, and nothing more is sent.
A report contains the type of error and where in the code it occurred, the last 64 KB of the app’s log, the macOS version, the language and region, the AI provider and model in use, the active MCP servers, and a random installation identifier that does not say who you are. Added to it are the diagnostics macOS records when the app hangs, overuses the processor or writes too much to disk. Nothing else is sent: not your sessions (when you open or quit the app), not performance measurements.
The content of your conversations is never in it: the log replaces it with its length alone. Before sending, Aureole also strips out API keys, tokens, email addresses, phone numbers and the paths of your folders. In the same settings, “See what is sent…” shows you a report exactly as it would be sent.
Basis: our legitimate interest in fixing the app, which you can object to by turning reports off. They are kept for ninety days at most.
We only entrust your data to the providers we need, each bound by contract to use it only for us:
When a provider is based outside the European Union, the transfer is covered by the safeguards the GDPR provides: an adequacy decision, such as the EU–US Data Privacy Framework, or the European Commission’s standard contractual clauses.
You can access your data, have it corrected or erased, object to or restrict its processing, receive your data in a readable format, withdraw your consent at any time, and tell us what to do with your data after your death. Write to hello@aureole.app: we reply within one month at most.
For the most part, we hold nothing about you: what you do in Aureole is on your Mac, and you erase it by deleting the app and its data. For your data with an AI provider or our reseller, contact them.
If you believe we are not respecting your rights, you can lodge a complaint with the CNIL (cnil.fr), or with the data protection authority of your country.
We update it when a processing operation changes. The new version is published on this page, dated; if it changes what we do with your data, we also announce it in Aureole’s release notes before it applies. See also our terms of use.
Questions about your data? Write to us: we’ll get back to you.
Aureole