Stave Privacy Policy

In one paragraph

Stave is a Mac app that reads your bank SMS and email statements locally on your machine and helps you understand where your money goes. Stave never asks for your bank passwords and doesn’t sell your data or share it for advertising. It reaches other companies only as this policy describes: Apple for iCloud sync, OpenAI if you turn on Smart Assist (Section 3.7), and Razorpay and Resend when you buy Stave Pro on the direct download (Section 3.10). Categorisation is on-device by default. A few things do talk to servers we run: direct-download Pro subscribers’ Macs check in with our license server roughly weekly (license key and an anonymous device identifier only — Mac App Store subscriptions verify entirely on-device via Apple’s StoreKit and never contact getstave.app — see Section 6), and subscribing to Stave Pro on the direct download goes through a getstave.app checkout that collects your email address to deliver your license key (see Section 3.10). If you explicitly opt in to Smart Assist (direct download only, off by default), Stave sends merchant names and short category-search phrases to our own server, and — only for a message the on-device pipeline can’t classify on its own — the wording of that message with numbers and UPI IDs removed, and payee names where Stave can find them, plus, when you unlock a password-protected statement, the few sentences of the bank’s email that describe the password rule, with dates, long numbers and names after a title such as Mr or Mrs removed; our server may forward any of these to OpenAI (see Section 3.7). On the direct download, a minimal, non-optional install count (a random ID, your platform, and first-launch date — no content) is sent once per install, and install and session records (device details and how long Stave stays open, no content) are always sent; beyond that, Stave also sends anonymous parse diagnostics and feature usage events through Apple’s CloudKit so we can fix parsing problems and decide what to build next — both on by default, and you can turn either off in Settings (see Section 3.4). The Mac App Store edition sends none of this — no install count, no diagnostics, no Smart Assist, and Pro is verified entirely on-device via StoreKit with no checkout or email collection at all. You can also, entirely at your own discretion, email us messages the on-device parser couldn’t read (Section 3.9), or send us a masked outline of a statement Stave couldn’t read (Section 3.11), to help us improve the parser — nothing is sent unless you choose to. Read on for specifics, or jump to Section 7 to verify these claims yourself.

Editions

Stave ships in two editions from the same source code. Both are local-first: parsing happens on your Mac, and Smart Assist is optional and off unless you turn it on. Both use only your own private iCloud for optional sync. They differ in distribution:

• Mac App Store edition. Runs in the macOS App Sandbox. Collects no diagnostics (not even the install count in Section 3.4), has no Smart Assist (the code path doesn’t exist in this build), and makes no network calls to getstave.app at all — updates come through the App Store, subscription status is verified entirely on-device from Apple’s signed StoreKit transaction record with no server round-trip, and there is no checkout or email collection since Apple handles the purchase. Sections 3.4, 3.7, 3.9, 3.10, and 5 (diagnostics) do not apply to it. It still does the community merchant-rules refresh described in Section 6, which sends nothing about you.
• Direct download (getstave.app). Notarized and hardened-runtime. Sends the anonymous diagnostics and makes the getstave.app software-update checks described below; both are on by default and can be turned off in Settings.

1. Our position on privacy

Stave is local-first: parsing happens on your Mac, and Smart Assist is optional and off unless you turn it on. Your money is your business, and ours is only to help you see it clearly.

The architecture follows one principle: your data never leaves your sight without your explicit decision. Stave never asks for your bank credentials, never holds your account information, and never receives your balances, statements or account details.

Categorisation is on-device by default for every user, always — no cloud AI service sees a transaction unless you take a separate, explicit action. The one opt-in exception, Smart Assist, is described in full in Section 3.7: direct-download users can choose to send merchant names or short category-search phrases to our own server, and, only for a message the on-device pipeline can’t classify on its own, the wording of that message with numbers and UPI IDs removed, and payee names where Stave can find them — and, separately from categorisation, a statement email’s password instructions with dates, long numbers and names after a title such as Mr or Mrs removed. Our server may in turn ask OpenAI. There is no Anthropic integration, no Google Cloud integration, and no other third-party model API anywhere in Stave.

2. Core principles

• On-device processing by default. All transaction reading and categorisation happens locally on your Mac. Stave never sends an amount, account number, or date to any server we run on its own. The only exception is a report you choose to email us (Section 3.9), which can contain them. The narrower exception is Section 3.7 (Smart Assist): if you opt in, a merchant name, a short category-search phrase, or — only for a message the on-device pipeline can’t classify — the wording of that message with numbers and UPI IDs removed may be sent for categorisation, and a statement email’s password instructions (dates, long numbers and names after a title such as Mr or Mrs removed) may be sent to turn them into a one-line hint.
• Zero knowledge of your transactions. As the developer, Avysion has no access to your transactions, balances or statements. The only message content Avysion can receive is what Smart Assist sends, if you turn it on (Section 3.7), and anything you choose to email us, such as an unread-message report (Section 3.9) or a report about a misread transaction.
• No cloud AI by default. Stave does not send your data to OpenAI, Anthropic, or any other cloud-based AI service unless you explicitly opt in to Smart Assist (Section 3.7) — and even then, only a merchant name, a search phrase, a message’s wording with numbers and UPI IDs removed, or a statement email’s password instructions, and only Stave’s own server talks to OpenAI, never your Mac directly.
• No telemetry you can’t turn off, beyond the install count and install and session records. On the direct download, diagnostics are on by default; once you turn them off in Settings, no parse diagnostics or feature events are sent. The exceptions, direct download only, are a one-time ping at first launch and the install and session records — a random ID, device details and session times, never content — described in full in Section 3.4. The Mac App Store edition doesn’t send even that.
• No aggregators. Stave does not use third-party “bank login” services such as Plaid or Yodlee.
• No third-party tracking. Stave contains no advertising trackers and no third-party analytics SDKs (no Google Analytics, no Firebase, no Amplitude).
• No accounts. Stave does not require you to create an account with us. There is no Stave login. Subscribing to Stave Pro on the direct download does associate your email address with a license key for delivery and support (Section 3.10) — that’s a billing record, not a login account, and doesn’t apply to the Mac App Store edition at all.

3. How Stave works

3.1 Data sources

Stave reads two types of data, both stored locally on your Mac by Apple’s own apps:

• Transaction SMS from ~/Library/Messages/, synced from your iPhone via your private iCloud
• Bank statement PDFs from Apple Mail (~/Library/Mail/), filtered to a strict allow-list of known bank sender addresses

You explicitly grant access to each source during setup. Stave reads transaction information directly from these local files on your machine.

3.2 On-device categorisation

Stave categorises transactions on your Mac using your own rules and a built-in merchant dictionary. Unclear merchants stay Uncategorised. In the direct download, Smart Assist (Section 3.7) can suggest categories if you turn it on.

For SMS transaction extraction (parsing the merchant, amount, and account from a raw SMS string), Stave uses its own rules on your Mac. When the rules can’t classify a message, Apple Intelligence on your Mac helps where available.

Two additional post-processing detectors run locally to improve accuracy: a self-transfer pairing detector and a credit-card payment validator. Both are deterministic logic, not models.

3.3 How Stave handles edge cases

When the on-device pipeline cannot fully resolve a transaction or statement, Stave surfaces it for manual review rather than guessing:

• Low-confidence SMS are flagged as “needs review” so you can manually enter the merchant, amount, and account.
• Password-protected statement PDFs show a manual password input — Stave doesn’t try to guess hints.
• Statement PDFs from unrecognised senders show a manual account picker — Stave doesn’t try to infer which account they belong to.

These manual paths add slight friction but mean Stave never sends your data to a cloud service to make these decisions for you.

3.4 Anonymous diagnostics (direct download only)

This section applies only to the direct download from getstave.app. The Mac App Store edition has no diagnostics and no install count — it never writes to CloudKit public, regardless of any setting.

Install count — not optional. Once per installation, at first launch, the direct download writes one row to a public CloudKit database that Avysion controls: a random install ID, your platform (macOS/iOS), and the first-launch date. Nothing else — no message, transaction, statement, or account content, and this row is not affected by the diagnostics toggles below. It exists only so we can count distinct installs; there’s no per-device UI to turn it off individually, though it’s covered by the same deletion path as the rest of Section 8 if you delete your Stave data.

Install and session records — not optional. Always sent by the direct download; there is no setting to turn them off. They are how we count active users. An install record holds your install ID, platform, Stave version and build, macOS version, Mac model, region and language settings, first and last active dates, whether you have Pro, and your trial start date. A session record holds your install ID, platform, Stave version, and when the session started and ended. A daily activity record, sent at most once a day, holds your install ID, how many distinct days you have used Stave, and how many days since you installed it. No financial data. Feature usage events and statement diagnostics also record whether you were on the free plan, a trial or Pro at the time.

Beyond that install count, Stave sends the install and session records above and two further kinds of data to the same public CloudKit database. Both are on by default, and each can be turned off at any time. A user who turns both toggles off sends zero parse diagnostics and zero feature usage events — only the install count and the install and session records above.

Settings has two separate toggles you can control independently. If both are off, Stave may show a “Help improve Stave” note in the sidebar, at most once a week after you dismiss it; it never turns diagnostics back on by itself:

Toggle 1 — Parse diagnostics

• Sent: counts of the messages and statements Stave read, grouped by the bank’s public short code (for example “HDFC”) and by outcome — parsed, not parsed, needed a password, or had no activity. For a statement that didn’t import cleanly, Stave also sends a reason code (for example “no transactions found”) and the parser’s own measurements: which extraction method it used, page and row counts, and whether the running balance and the statement’s printed totals matched. Plus Stave version, parser version, and the anonymous install ID.
• Used to: find the banks and statement formats Stave reads badly, so we can fix the parser for them
• Not sent: transaction amounts, balances, dates, merchant names, account numbers, file names, or any message, email, or statement content

Toggle 2 — Feature usage events

• Sent: anonymous events like “user opened dashboard,” “user categorised a transaction,” “user imported a statement,” plus how far setup got, what you answered when Stave asked for your Messages or Mail folder, and failures reading Messages, Mail, iCloud sync or a backup, sent as error codes. They can include the name of a built-in category (one you created is sent as “custom”), how a transaction’s category was set (for example by a rule or by you), a bank’s public short code (for example “HDFC”), the domain of a statement sender address you add yourself (for example “hdfcbank.net”; public mail services such as Gmail are sent only as “personal provider”), and counts such as how many transactions an export contained
• Used to: understand which features get used and which don’t
• Not sent: transaction amounts, merchant names, account numbers, message content, email content, PDF content, names of categories you’ve created, tag names, notes, search text, the part of an email address before the @, or your specific account list

Both kinds of data include a stable per-install identifier so we can group events from the same Stave installation (helping us measure retention and feature adoption). The identifier is generated locally on your Mac. It is not linked to your Apple ID, your name, or any contact information you’ve shared with Apple.

You can disable either toggle at any time in Settings → Privacy. When disabled, Stave stops sending events. The install ID is kept in your Mac’s Keychain, so it stays the same if you reinstall Stave on the same Mac. Events already sent are kept; to have them deleted, copy your install ID from Settings → Privacy and email it to us.

3.5 iCloud synchronisation (optional)

If you choose to use Stave on multiple devices (your Mac and your iPhone), data syncs through Apple CloudKit:

• Data is stored in your private iCloud database, which the Stave team cannot access
• End-to-end encrypted when Advanced Data Protection is turned on for your Apple Account; otherwise protected by Apple’s standard iCloud data protection
• You can disable sync at any time in Settings — when off, Stave makes zero CloudKit writes to the private database

Note: the diagnostics in Section 3.4 use CloudKit’s public database, which is separate from your private database. Disabling iCloud sync (private database) doesn’t disable diagnostics, and disabling diagnostics doesn’t disable iCloud sync. They’re independent toggles.

3.6 Diagnostic logs (support, user-initiated)

Stave keeps a small rotating technical log on your Mac (under ~/Library/Logs/Stave, inside the app’s sandbox container on the Mac App Store edition). It records structural events only — pipeline stages, counts, durations, error codes, and public bank identifiers. By design it does not contain transaction amounts, merchant names, SMS or email content, account numbers, or anything you authored, and a redaction pass strips currency amounts and long digit runs as a second line of defence.

When you contact support from within Stave, you can choose to attach this log. Stave hands the file to your own mail client — you review it and send it to stave@avysion.studio, and a “Don’t attach” option lets you send without it. Stave never transmits this log automatically and never sends it anywhere on its own. This applies to both editions; because it is sent only by you, through your mail client, it is not part of any automatic data collection.

3.7 Smart Assist: optional cloud assistance (opt-in, direct download only)

By default, categorisation is entirely on-device (Section 3.2) — nothing about a transaction ever leaves your Mac. In the setup wizard or Settings, direct-download users can additionally turn on Smart Assist (the in-app toggle name for this feature) for help with merchants and messages the on-device tiers can’t confidently place, and with reading a statement’s password instructions. This is off by default and reversible at any time. The Mac App Store edition does not include this feature at all — the code path doesn’t exist in that build, so there is nothing to enable.

Smart Assist covers four touchpoints, all gated by the same toggle and all going to Stave’s own server first, never straight from your Mac to OpenAI:

• Merchant categorisation. When the on-device tiers can’t confidently categorise a merchant, only the merchant name string is sent — for example, “SWIGGY BANGALORE.” Never the amount, account, date, or message text.
• Category-search fallback. If you type a search in the category picker (e.g. “pizza,” “petrol”) that doesn’t match anything locally, that short typed phrase is sent to suggest the best-fitting category. This is text you typed into the picker, not transaction data.
• Message classification, for messages Stave couldn’t otherwise read. When both the on-device rule classifier and Apple Intelligence can’t tell whether an SMS is a transaction, Smart Assist can send the wording of that message to help decide. Before sending, Stave removes every number (amounts, dates, account and reference numbers), every UPI ID and email address, and payee names where it can find them — for example after “to”, “from” or “Mr”. Name detection is pattern-based, so an unusual name can occasionally remain. Our server applies the same removal again before anything reaches OpenAI. This only runs as one batched check after a scan finishes, never inline while reading your messages.
• Statement password hints. When you unlock a password-protected statement found in Mail, Smart Assist can turn the bank’s instructions into one plain line — for example, “First 4 letters of your name + date of birth as DDMMYY” — so you don’t have to open the email. Only the few sentences of that email that describe the password rule are sent: never the rest of the email, the statement, or your password. Dates, email addresses, long digit runs, and names after a title such as Mr or Mrs are removed first. Without Smart Assist, Stave does this with Apple Intelligence on your Mac, or shows those sentences as they are.
• Opaque references and person-to-person transfers are filtered out and never sent, both on your Mac and again on our server as a backstop — a bare UPI handle, phone number, bank reference code, or a string that looks like a person’s name never reaches the merchant-categorisation or search-fallback touchpoints above.
• The first three touchpoints check a cache on our server first and only forward a cache miss to OpenAI. Password-hint requests aren’t cached or stored on our server — the text is forwarded to OpenAI and discarded, and only your Mac keeps the one-line answer. The merchant-name and category-search caches are anonymous (a string and the category it maps to, never who asked) and are kept for up to 180 days, pruned automatically after that or sooner if they no longer pass the opaque-reference/person-to-person filter above. The message-classification cache stores only a one-way hash of the redacted wording and the classification it resolved to — never the wording itself, and not tied to you or your device — and is also pruned automatically after 180 days.
• Suggestions only. A cloud categorisation answer appears as a chip you tap to confirm — it is never applied to a transaction automatically. A message classification result is used only to decide whether to surface a message for the normal on-device review flow. A password hint is only shown to you — Stave never uses it to guess or try a password.
• Requests are authenticated per device and rate-limited, not by a value shared across every Stave install.

Turning Smart Assist off in Settings stops future merchant names, search phrases, redacted messages, and password instructions from being sent. It does not retroactively delete anything already cached — which, again, is never transaction data, and never message text.

3.8 Contributing a sample SMS (getstave.app website, optional)

Separately from the Stave app, the getstave.app website has an optional, public “Contribute” page where anyone can paste a bank SMS to help us extend Stave’s on-device parser to more banks. This is a website feature, not something the Stave app does on your Mac. If you use it, we collect the message text you paste, the bank you attribute it to, an optional email address, and (like any web form) your IP address, browser user-agent, and the referring page. Submissions are used to build and test the on-device parser dictionary and are retained indefinitely — this feature has no automatic deletion schedule today.

3.9 Sharing unread messages (support, user-initiated)

Stave keeps a local, on-device log of transaction-shaped SMS the parser couldn’t read — sender, a sample of the message, and why it was skipped — so it can show you, in Settings → Privacy, how many such messages exist. This log stays on your Mac and is never sent anywhere on its own.

From that same Settings section, you can choose to share it with us to help improve the parser. This is entirely your decision:

• Nothing is sent until you tap Share. A Preview button shows you the exact file Share would send, using the same settings — so what you preview is what goes out.
• You choose how much detail it contains. By default the report omits amounts and account numbers; a checkbox lets you include them if you want the fuller context to help us fix a specific miss.
• It goes out through your own mail client, addressed to stave@avysion.studio, the same as the diagnostic-log flow in Section 3.6 — Stave hands the file to Mail, you review it, and you send it.

Unlike Section 3.6’s log, this report can contain real SMS content — sender names, merchant strings, and, if you opt in on the checkbox, amounts and account numbers. We use it only to fix parsing for the message pattern it contains and delete it once that’s done. This applies to both editions — it’s a local file and your own mail client, not an Avysion server call.

3.10 Purchasing Stave Pro (direct download, getstave.app checkout)

This section applies only to buying Stave Pro on the direct download. Mac App Store subscriptions go entirely through Apple’s own purchase sheet — Avysion never sees your payment details or your email for those, and this section doesn’t apply to them at all.

When you subscribe on getstave.app, checkout is hosted by Razorpay, our payment provider. Your card or payment details go to Razorpay directly — Avysion’s server never receives or stores them. What we do receive and store, to run the subscription:

• Your email address, associated with your license key so we can deliver it, let you recover it if you lose it, and manage your subscription status. This is stored in Stave’s license database for as long as your subscription record exists.
• Your license key is emailed to you through Resend, a third-party email delivery service, the one time it’s issued.
• Nothing about your transactions, balances, or messages is ever part of this flow. It’s billing data only — an email address and a subscription status, not app content.

This is separate from the weekly license-verification check described in Section 6, which sends only your license key and an anonymous device identifier — not your email — once your subscription is already active.

3.11 Sending a masked statement outline (user-initiated)

When Stave reads text from a statement PDF but doesn’t recognise its layout, it offers to send us a masked outline of the statement so we can add support for it. It is never offered for password-protected, scanned, or damaged files, and nothing is ever sent automatically:

• It is built on your Mac. Stave reads the first two pages and builds an outline in four parts: the header, the column headings, up to five rows, and up to three footer lines. Every digit becomes #, and every word that isn’t a generic statement label (such as “Date”, “Description”, “Balance”) becomes A or a. Header lines with no such label, such as your name and address, are removed. A layout fingerprint, a short hash of the column headings, lets Stave tell you on your Mac when an update can read that layout. The outline is masked, not anonymous: its shape can still be distinctive.
• You review it first. You see exactly what would be sent and can leave out any part of it, or cancel. You can name the bank, but it is shared only if it matches a bank on Stave’s list. You confirm each statement separately; there is no setting that sends them for you.
• What is sent: the outline, the fingerprint, the bank if it matched, whether it is a bank or card statement, its page count, why the import failed, and the Stave version. Never the PDF, its password, its unmasked text, your file name, or your install ID. The request carries the same per-device token used for Smart Assist, only to authenticate it; rate limiting stores a keyed hash of the device ID, never the ID itself. Our server checks every line again and refuses anything that contains a digit, an “@”, a word off the list, or a field it doesn’t expect.
• How it’s used and kept: only to build and test support for that statement layout. It is stored on our server with no install ID, IP address, or email, not forwarded to OpenAI or anyone else, and deleted after 180 days. Removing the request in Stave deletes it from our server sooner, and Delete All Data asks our server to delete every request you sent. Our hosting provider keeps its own short-lived request logs (IP address and time), as it does for every request.

In the Mac App Store edition the same masked outline is shared by email instead: Stave opens a draft to us in your mail app with the outline attached and nothing else from Stave, sent from your own address only when you press Send there. Nothing goes to our server.

Earlier versions of Stave sent a masked outline with every digit as 9, or before that a masked word layout, for the same purpose. Those submissions are kept no longer than 180 days and 12 months respectively.

4. What data is handled

5. The pseudonymity question

This section applies only to the direct download — the Mac App Store edition sends no diagnostics. On the direct download, the diagnostics events in Section 3.4 use a stable per-install identifier rather than fully anonymous events. This is a deliberate trade-off:

• Stable IDs let us answer questions like “which crashes affect the most users?” and “do users come back the next day?” That signal is genuinely useful for improving Stave.
• Stable IDs are not anonymous in the strict sense — events from the same install can be linked. We call this “pseudonymous”: tied to an install, not to a real-world identity.
• The ID is generated on your Mac. We don’t know whose Mac it is. We can’t tie it to your name, email, or Apple ID.
• You can ask us to delete it. Disabling diagnostics in Settings stops new events. To have past events deleted, email us the install ID shown in Settings → Privacy and we’ll delete every record tied to it.

If pseudonymous events still feel too revealing for you, turn diagnostics off. The app works exactly the same with diagnostics off as with it on.

6. Network usage

Stave processes your data on your Mac. Network traffic falls into these categories:

Always allowed (when the relevant feature is in use):

• iCloud sync to Apple’s icloud.com infrastructure, only when you’ve enabled it in Settings.
• Software update checks (direct download only) to getstave.app/updates/appcast.xml (on by default; you can turn update checks off in Settings). Sends only your Stave version and macOS version. The update file itself downloads from GitHub (github.com and release-assets.githubusercontent.com), where Stave’s releases are hosted. The Mac App Store edition updates through the App Store and makes no getstave.app calls.
• License verification (Pro subscribers, direct download only), roughly weekly, to our license server at getstave.app. Sends your license key and an anonymous device identifier (a random ID generated on your Mac, used only to limit how many Macs one license runs on) — never transactions, amounts, merchants, or any financial data, and Pro keeps working without a connection between checks. The Mac App Store edition verifies its subscription entirely on-device from Apple’s signed StoreKit transaction record and makes no call to getstave.app for this at all.
• Install count (direct download only, not optional), once per installation, to Apple’s CloudKit public database — a random install ID, platform, and first-launch date. See Section 3.4.
• Community merchant-rules refresh (both editions, not optional, no toggle), a read-only, unauthenticated query to Apple’s CloudKit public database at most once every 24 hours, checking for crowd-verified merchant categorisation rules. Sends nothing about you or your device. As of this writing the underlying CloudKit schema hasn’t been deployed to production yet, so this query returns nothing — documented here because the mechanism is live in the shipped app on both editions.

Optional:

• Diagnostics (parse diagnostics and/or feature usage events, direct download only, on by default) to Apple’s CloudKit public database while the corresponding toggle is on. Install and session records (Section 3.4) always go to the same database. Not present in the Mac App Store edition.
• Smart Assist (direct download only, off by default — see Section 3.7) sends merchant names, category-search phrases, redacted message text, and/or a statement email’s password instructions to our server at getstave.app, which may forward any of these to OpenAI. Never your Mac talking to OpenAI directly. Not present in the Mac App Store edition.
• Statement outline sharing (direct download only, only for the statements you review and tap Send for — see Section 3.11) sends that statement’s masked outline to our server at getstave.app. It is not forwarded to OpenAI or anyone else. Not present in the Mac App Store edition.

One-time, direct download only:

• Stave Pro checkout (see Section 3.10) — subscribing routes you to a Razorpay-hosted checkout page and collects your email address to deliver your license key. Not present in the Mac App Store edition, where Pro is purchased entirely through Apple.

Avysion operates two servers your Stave installation may talk to, both at getstave.app: a license server (Pro subscribers only, described above) and, if you’ve opted in, a Smart Assist server (Section 3.7). Neither ever receives your transaction amounts, dates, accounts, or, outside the message-classification and password-hint touchpoints described in Section 3.7, message or email content. Outside of these, the only other Avysion-controlled destinations are Apple’s CloudKit public database (diagnostics unless you’ve turned them off, plus the always-on install count and community-rules refresh above) and, only if you subscribe to Stave Pro on the direct download, the Razorpay checkout page and the license database that stores your email for that subscription (Section 3.10). Stave’s own code never talks to OpenAI, Anthropic, or any other cloud AI service directly — only our Smart Assist server does, and only when you’ve opted in.

7. Verification: don’t trust us, verify

You can confirm Stave’s network behaviour using built-in macOS tools:

1. App Privacy Report. Go to System Settings → Privacy & Security → App Privacy Report. Stave’s network connections appear there. On the Mac App Store edition you’ll see only Apple domains, including for Pro subscribers — subscription verification never leaves Apple’s StoreKit, so getstave.app never appears. On the direct download with diagnostics and Smart Assist both off, you’ll see Apple domains, getstave.app (update checks, and license verification if you’re Pro) and, while an update downloads, github.com and release-assets.githubusercontent.com, where Stave’s release files are hosted. Turning on Smart Assist adds no new domain: the OpenAI call happens on our server, not your Mac. Checking out for Stave Pro is the one exception: your browser briefly visits Razorpay’s hosted checkout page to complete payment.
2. Activity Monitor. Open Activity Monitor, select the Network tab, and search for Stave. Sent bytes stay near zero except during iCloud sync, update checks, the one-time install count, the periodic community-rules refresh, license verification, or opt-in diagnostics or Smart Assist requests — and even with Smart Assist on, every connection your Mac makes resolves to Apple, getstave.app or, while an update downloads, github.com and release-assets.githubusercontent.com; it never dials api.openai.com itself.
3. Sandboxing & signing. The Mac App Store edition runs in the macOS App Sandbox — macOS prevents it from accessing files, folders, or system resources unless you’ve explicitly granted permission. The direct download is notarized and hardened-runtime, and reads your Messages and Mail only through folders you grant via the system file picker.
4. Source code inspection. We’re happy to walk through the code with anyone who asks.

8. Your data, your control

You’re never locked into Stave:

• Delete all data. Settings → Delete all Stave data. Clears your local database. If iCloud sync is enabled, also clears your private CloudKit data. Cannot be undone.
• Disable diagnostics. Settings → Privacy → toggle off Parse Diagnostics and/or Product Analytics. Stops sending events. Past events are deleted on request: email us the install ID from Settings → Privacy.
• Keep your data on one Mac. Turn off iCloud sync and diagnostics. The direct download then contacts getstave.app only for update checks and, with Pro, a weekly licence check, and GitHub when an update downloads. The Mac App Store edition then contacts only Apple.
• Uninstall. Removing Stave from your Mac leaves no remote data behind we control beyond any CloudKit public diagnostics events you sent. Disabling diagnostics first ensures those are deleted on schedule.

Data export to CSV/JSON is on the roadmap but not yet shipped. When it lands, it will be a one-click action.

9. Changes to this policy

If we update this policy, the change is recorded in the version history at the top of this document. Material changes (new data types handled, new third-party services that fire by default, changes to sync or diagnostics behaviour) will be communicated in-app at the next launch following the change.

Contact

Questions about how Stave handles your data, or about the architecture described above:

Email: stave@avysion.studio
Website: https://www.getstave.app/

Stave is built by Avysion in India. The Stave team has zero access to your transactions, balances, or messages. That’s not a policy choice — it’s an architectural constraint. The Mac App Store edition is sandboxed by macOS and the direct download is notarized and hardened-runtime; the network is observable in Activity Monitor, and every external service is opt-in. We invite scrutiny.

← Back to getstave.app