Stave Privacy Policy

In one paragraph

Stave is a Mac app that reads your bank SMS and email statements locally on your machine and helps you understand where your money goes. Stave never asks for your bank passwords and doesn’t share your data with anyone. Categorisation is on-device by default. A few things do talk to servers we run: Pro subscribers’ Macs check in with our license server roughly weekly (license key and an anonymous device identifier only — see Section 6), and if you explicitly opt in to cloud-assisted categorisation (direct download only, off by default), merchant names go to our own categorisation server, which may forward them to OpenAI on a cache miss (see Section 3.7). On the direct download, if you opt in, Stave can also send anonymous crash reports and feature usage events through Apple’s CloudKit so we can fix bugs and decide what to build next — both off by default. The Mac App Store edition has no diagnostics and no cloud categorisation at all. Read on for specifics, or jump to Section 7 to verify these claims yourself.

Editions

Stave ships in two editions from the same source code. Both are local-first, never see your transactions, and use only your own private iCloud for optional sync. They differ in distribution:

• Mac App Store edition. Runs in the macOS App Sandbox. Collects no diagnostics, has no cloud categorisation (the code path doesn’t exist in this build), and makes no update-check calls to getstave.app — updates come through the App Store, and subscription checks send only a hashed purchase identifier. Sections 3.4, 3.7, and 5 (diagnostics) do not apply to it.
• Direct download (getstave.app). Notarized and hardened-runtime. Supports the opt-in diagnostics and the getstave.app software-update checks described below.

1. Our position on privacy

Stave is local-first. Your money is your business, and ours is only to help you see it clearly.

The architecture follows one principle: your data never leaves your sight without your explicit decision. Stave never asks for your bank credentials, never holds your account information, and never has access to your transactions.

Categorisation is on-device by default for every user, always — no cloud AI service sees a transaction unless you take a separate, explicit action. The one opt-in exception is described in full in Section 3.7: direct-download users can choose to send merchant name strings (never amounts, accounts, dates, or message text) to our own categorisation server, which may in turn ask OpenAI. There is no Anthropic integration, no Google Cloud integration, and no other third-party model API anywhere in Stave.

2. Core principles

• On-device processing by default. All transaction reading and categorisation happens locally on your Mac. No message or statement content — amounts, accounts, dates, or text — is ever sent to any server we run, regardless of settings. The one narrower exception is Section 3.7: if you opt in, a bare merchant name string may be sent for categorisation.
• Zero knowledge of your transactions. As the developer, Avysion has zero access to your transactions, balances, messages, or statements.
• No cloud AI by default. Stave does not send your data to OpenAI, Anthropic, or any other cloud-based AI service unless you explicitly opt in to cloud-assisted categorisation (Section 3.7) — and even then, only a merchant name string, and only Stave’s own server talks to OpenAI, never your Mac directly.
• No always-on telemetry. No analytics or crash data is sent unless you opt in. Stave makes no automatic phone-home calls.
• No aggregators. Stave does not use third-party “bank login” services such as Plaid or Yodlee.
• No third-party tracking. Stave contains no advertising trackers and no third-party analytics SDKs (no Google Analytics, no Firebase, no Amplitude).
• No accounts. Stave does not require you to create an account with us. There is no Stave login.

3. How Stave works

3.1 Data sources

Stave reads two types of data, both stored locally on your Mac by Apple’s own apps:

• Transaction SMS from ~/Library/Messages/, synced from your iPhone via your private iCloud
• Bank statement PDFs from Apple Mail (~/Library/Mail/), filtered to a strict allow-list of known bank sender addresses

You explicitly grant access to each source during setup. Stave reads transaction information directly from these local files on your machine.

3.2 On-device categorisation

Stave categorises transactions through a three-tier pipeline that runs entirely on your Mac:

1. Your own rules. When you categorise a transaction, Stave learns the pattern and applies it to similar transactions in the future.
2. Static rules. A built-in dictionary of common Indian merchants (Swiggy, Uber, BESCOM, etc.) provides starting categorisation without any model inference.
3. Apple Intelligence. For transactions that don’t match the first two tiers, Stave uses Apple’s on-device Foundation Models (macOS 15.1+) to suggest a category. The model runs on your Mac’s Apple Silicon. No prompts, transactions, or results are sent to Apple’s servers.

For SMS transaction extraction (parsing the merchant, amount, and account from a raw SMS string), Stave uses Apple’s CoreML Named Entity Recognition framework, also running on-device.

Two additional post-processing detectors run locally to improve accuracy: a self-transfer pairing detector and a credit-card payment validator. Both are deterministic logic, not models.

3.3 How Stave handles edge cases

When the on-device pipeline cannot fully resolve a transaction or statement, Stave surfaces it for manual review rather than guessing:

• Low-confidence SMS are flagged as “needs review” so you can manually enter the merchant, amount, and account.
• Password-protected statement PDFs show a manual password input — Stave doesn’t try to guess hints.
• Statement PDFs from unrecognised senders show a manual account picker — Stave doesn’t try to infer which account they belong to.

These manual paths add slight friction but mean Stave never sends your data to a cloud service to make these decisions for you.

3.4 Anonymous diagnostics (opt-in, direct download only)

This section applies only to the direct download from getstave.app. The Mac App Store edition has no diagnostics — it never writes to CloudKit public, regardless of any setting.

On the direct download, if you opt in, Stave sends two kinds of anonymous data to a public CloudKit database that Avysion controls. Both are off by default. A user who never enables diagnostics sends zero events.

During setup, Stave asks once: “Help improve Stave by sharing anonymous diagnostics?” — a single combined toggle, off by default. After setup, Settings → Privacy splits this into two separate toggles you can control independently:

Toggle 1 — Crash reports

• Sent: stack traces, OS version, Stave version, anonymous install ID
• Used to: identify crashes affecting users so we can fix them
• Not sent: any transaction, message, statement, or category data

Toggle 2 — Feature usage events

• Sent: anonymous events like “user opened dashboard,” “user categorised a transaction,” “user imported a statement”
• Used to: understand which features get used and which don’t
• Not sent: transaction amounts, merchant names, account numbers, message content, email content, PDF content, categories you’ve created, tags, notes, bank names, or your specific account list

Both kinds of data include a stable per-install identifier so we can group events from the same Stave installation (helping us measure crash impact, retention, and feature adoption). The identifier is generated locally on your Mac. It is not linked to your Apple ID, your name, or any contact information you’ve shared with Apple.

You can disable either toggle at any time in Settings → Privacy. When disabled, we delete events tied to your install ID from the CloudKit public database within 30 days.

3.5 iCloud synchronisation (optional)

If you choose to use Stave on multiple devices (your Mac and your iPhone), data syncs through Apple CloudKit:

• Data is stored in your private iCloud database
• Protected by your Apple ID and Apple’s end-to-end encryption
• Neither Apple nor the Stave team can access this data
• You can disable sync at any time in Settings — when off, Stave makes zero CloudKit writes to the private database

Note: the diagnostics in Section 3.4 use CloudKit’s public database, which is separate from your private database. Disabling iCloud sync (private database) doesn’t disable diagnostics, and disabling diagnostics doesn’t disable iCloud sync. They’re independent toggles.

3.6 Diagnostic logs (support, user-initiated)

Stave keeps a small rotating technical log on your Mac (under ~/Library/Logs/Stave, inside the app’s sandbox container on the Mac App Store edition). It records structural events only — pipeline stages, counts, durations, error codes, and public bank identifiers. By design it does not contain transaction amounts, merchant names, SMS or email content, account numbers, or anything you authored, and a redaction pass strips currency amounts and long digit runs as a second line of defence.

When you contact support from within Stave, you can choose to attach this log. Stave hands the file to your own mail client — you review it and send it to stave@avysion.studio, and a “Don’t attach” option lets you send without it. Stave never transmits this log automatically and never sends it anywhere on its own. This applies to both editions; because it is sent only by you, through your mail client, it is not part of any automatic data collection.

3.7 Optional cloud-assisted categorisation (opt-in, direct download only)

By default, categorisation is entirely on-device (Section 3.2) — nothing about a transaction ever leaves your Mac. In the setup wizard or Settings, direct-download users can additionally choose to turn on cloud-assisted categorisation for merchants the on-device tiers can’t confidently place. This is off by default and reversible at any time. The Mac App Store edition does not include this feature at all — the code path doesn’t exist in that build, so there is nothing to enable.

When you opt in:

• Only a merchant name string is sent — for example, “SWIGGY BANGALORE.” Never the amount, account, date, or message text.
• Opaque references and person-to-person transfers are filtered out and never sent, both on your Mac and again on our server as a backstop — a bare UPI handle, phone number, bank reference code, or a string that looks like a person’s name never reaches this feature.
• The merchant name goes to our own categorisation server first, not directly to OpenAI. That server checks a cache of merchant names already looked up before, and only forwards the name to OpenAI on a cache miss.
• Common merchant names may be cached on our server so other users asking about the same merchant don’t need a fresh OpenAI lookup. This cache is anonymous — it stores only a merchant name and the category it maps to, never who asked, and it is never a copy of anyone’s transaction history. Cache entries are kept for up to 180 days and are pruned automatically after that, or sooner if they no longer pass the opaque-reference/person-to-person filter above.
• Suggestions only. A cloud answer appears as a chip you tap to confirm — it is never applied to a transaction automatically.
• Requests are authenticated per device and rate-limited, not by a value shared across every Stave install.

Turning this off in Settings stops future merchant names from being sent. It does not retroactively delete anything already cached — which, again, is only merchant names and categories, never transaction data.

3.8 Contributing a sample SMS (getstave.app website, optional)

Separately from the Stave app, the getstave.app website has an optional, public “Contribute” page where anyone can paste a bank SMS to help us extend Stave’s on-device parser to more banks. This is a website feature, not something the Stave app does on your Mac. If you use it, we collect the message text you paste, the bank you attribute it to, an optional email address, and (like any web form) your IP address, browser user-agent, and the referring page. Submissions are used to build and test the on-device parser dictionary and are retained indefinitely — this feature has no automatic deletion schedule today.

4. What data is handled

5. The pseudonymity question

This section applies only to the direct download — the Mac App Store edition sends no diagnostics. On the direct download, the diagnostics events in Section 3.4 use a stable per-install identifier rather than fully anonymous events. This is a deliberate trade-off:

• Stable IDs let us answer questions like “which crashes affect the most users?” and “do users come back the next day?” That signal is genuinely useful for improving Stave.
• Stable IDs are not anonymous in the strict sense — events from the same install can be linked. We call this “pseudonymous”: tied to an install, not to a real-world identity.
• The ID is generated on your Mac. We don’t know whose Mac it is. We can’t tie it to your name, email, or Apple ID.
• You can break the link. Disabling diagnostics in Settings deletes the historical events from CloudKit public within 30 days, and re-enabling later generates a new install ID.

If pseudonymous events still feel too revealing for you, leave diagnostics off. The app works exactly the same with diagnostics off as with it on.

6. Network usage

Stave is designed to operate primarily offline. Network traffic falls into these categories:

Always allowed (when the relevant feature is in use):

• iCloud sync to Apple’s icloud.com infrastructure, only when you’ve enabled it in Settings.
• Software update checks (direct download only) to getstave.app/updates/appcast.xml (when opt-in update checking is enabled). Sends only your Stave version and macOS version. The Mac App Store edition updates through the App Store and makes no getstave.app calls.
• License verification (Pro subscribers only), roughly weekly, to our license server at getstave.app. The direct download sends your license key and an anonymous device identifier (a random ID generated on your Mac, used only to limit how many Macs one license runs on); the Mac App Store edition sends an anonymised (hashed) purchase identifier. Neither ever includes transactions, amounts, merchants, or any financial data, and Pro keeps working offline between checks.

Opt-in only (off by default):

• Anonymous diagnostics (crash reports and/or feature usage events, direct download only) to Apple’s CloudKit public database when you’ve enabled the corresponding toggle. Not present in the Mac App Store edition.
• Cloud-assisted categorisation (direct download only — see Section 3.7) sends merchant name strings to our categorisation server at getstave.app, which may forward them to OpenAI on a cache miss. Never your Mac talking to OpenAI directly. Not present in the Mac App Store edition.

Avysion operates two servers your Stave installation may talk to, both at getstave.app: a license server (Pro subscribers only, described above) and, if you’ve opted in, a categorisation server (Section 3.7). Neither ever receives your transaction amounts, dates, accounts, or message content. Outside of these, the only other Avysion-controlled destination is Apple’s CloudKit public database, and only if you’ve opted in to diagnostics. Stave’s own code never talks to OpenAI, Anthropic, or any other cloud AI service directly — only our categorisation server does, and only for merchant names, and only when you’ve opted in.

7. Verification: don’t trust us, verify

You can confirm Stave’s network behaviour using built-in macOS tools:

1. App Privacy Report. Go to System Settings → Privacy & Security → App Privacy Report. Stave’s network connections appear there. On the Mac App Store edition you’ll see only Apple domains and, for Pro subscribers, getstave.app (subscription verification). On the direct download with diagnostics and cloud categorisation both off, you’ll see only Apple domains and getstave.app (update checks, and license verification if you’re Pro). Turn on cloud categorisation and getstave.app is still the only non-Apple domain you’ll see — the OpenAI call happens on our server, not your Mac.
2. Activity Monitor. Open Activity Monitor, select the Network tab, and search for Stave. Sent bytes stay near zero except during iCloud sync, update checks, license verification, or opt-in diagnostics or categorisation requests — and even with categorisation on, every connection your Mac makes still resolves to Apple or getstave.app; it never dials api.openai.com itself.
3. Sandboxing & signing. The Mac App Store edition runs in the macOS App Sandbox — macOS prevents it from accessing files, folders, or system resources unless you’ve explicitly granted permission. The direct download is notarized and hardened-runtime, and reads your Messages and Mail only through folders you grant via the system file picker.
4. Source code inspection. We’re happy to walk through the code with anyone who asks.

8. Your data, your control

You’re never locked into Stave:

• Delete all data. Settings → Delete all Stave data. Clears your local database. If iCloud sync is enabled, also clears your private CloudKit data. Cannot be undone.
• Disable diagnostics. Settings → Privacy → toggle off Crash reports and/or Feature usage events. Stops sending events; deletes historical events tied to your install ID within 30 days.
• Work fully offline. Turn off iCloud Sync in Settings to keep all data on a single machine. Disable diagnostics. Now Stave makes zero outbound calls except update checks (which you can also disable).
• Uninstall. Removing Stave from your Mac leaves no remote data behind we control beyond any CloudKit public diagnostics events you sent. Disabling diagnostics first ensures those are deleted on schedule.

Data export to CSV/JSON is on the roadmap but not yet shipped. When it lands, it will be a one-click action.

9. Changes to this policy

If we update this policy, the change is recorded in the version history at the top of this document. Material changes (new data types handled, new third-party services that fire by default, changes to sync or diagnostics behaviour) will be communicated in-app at the next launch following the change.

Contact

Questions about how Stave handles your data, or about the architecture described above:

Email: stave@avysion.studio
Website: https://www.getstave.app/

Stave is built by Avysion in India. The Stave team has zero access to your transactions, balances, or messages. That’s not a policy choice — it’s an architectural constraint. The Mac App Store edition is sandboxed by macOS and the direct download is notarized and hardened-runtime; the network is observable in Activity Monitor, and every external service is opt-in. We invite scrutiny.

← Back to getstave.app