Privacy policy
Effective 3 September 2026 · Last updated 3 September 2026
The short version. Cory runs as a background service on your own Mac. Your messages, files and connected-account data stay on that machine and go only to the AI provider needed to answer the specific request you made. Crate Systems does not receive, store or read the content of your conversations. The only personal data we hold is what you type into a form on this website.
This policy explains what Crate Systems (“Crate Systems”, “we”, “us”) does with personal data in connection with Cory (the “Software”) and this website, cory.trycrate.net (the “Site”). It applies to visitors to the Site and to people who install and run the Software.
1. Who is responsible for your data
For the Site, Crate Systems is the controller of the personal data described in section 3.
For the Software the position is different. Cory executes entirely on hardware you own and control. You decide what it may read, who may address it, and which third-party accounts it connects to. In data-protection terms you are the controller of the content Cory processes on your Mac, and Crate Systems is not a processor of that content, because we never receive it. We supply software; we do not operate a service that your messages pass through.
Crate Systems operates from California, United States. Write to hello@trycrate.net for anything in this policy — a question, a correction, or a request to exercise one of the rights in section 11. That address is monitored and we answer within one month.
2. What the Software processes, and where
When you address Cory in a conversation, the Software may read and act on the following on your Mac:
- Message content and history. The message that mentions Cory, the surrounding conversation for context, and — when you ask it to search — other conversations stored in the Messages database on that Mac.
- Participant identifiers. The phone numbers, email addresses and display names that macOS already associates with the conversation, used to work out who is speaking and what they are permitted to ask for.
- Files and command output. Files you ask it to read, write, generate or send, and the output of commands you ask it to run.
- Connected third-party accounts. Data from services you explicitly connect, such as a Notion workspace or a Google Calendar — see sections 5 and 6.
None of this is transmitted to Crate Systems. It is held in the operating system and in Cory’s local working files on your machine, subject to your own backups, disk encryption and device security.
3. What this website collects
| Data | Why | Basis and retention |
|---|---|---|
| Name and email you submit to the waitlist or updates form | To tell you when the installer is available and to send occasional product news | Consent. Kept until you unsubscribe or ask us to delete it, and in any case no longer than 24 months after the last contact |
| Email you send us directly | To answer you | Legitimate interest in responding to enquiries. Kept for as long as the correspondence is live, then archived for up to 24 months |
| Standard server request logs (IP address, user agent, page, timestamp) generated by our hosting provider | Security, abuse prevention and keeping the Site up | Legitimate interest. Retained by the host on a short rolling window |
The Site sets no advertising or analytics cookies and does not embed third-party trackers. There is no cookie banner because there is nothing to consent to.
4. AI processing
To answer you, Cory sends the relevant part of your request — and only the context needed for it — to Anthropic’s Claude API, using your own Claude subscription or API credentials. Crate Systems is not a party to that exchange and does not hold those credentials.
Anthropic processes that content to return a response. Under Anthropic’s commercial terms, inputs and outputs submitted through the API are not used to train its models. Your relationship with Anthropic is governed by the terms and privacy policy you accepted when you created your account. The full detail of what is sent, when, and what we do not do with it is set out in our AI usage policy.
5. Third-party services you connect
Cory only reaches a third-party service after you connect it, and only with the permissions you grant:
- Notion. Used to create and update pages you ask for. Cory can write to the workspace or pages you share with it.
- Google Calendar. Used to read, create and change events when you ask it to. See section 6.
Authorization tokens for these services are stored on your Mac. You can revoke them at any time in the relevant provider’s account settings, which immediately ends Cory’s access.
6. Google user data
Where you connect a Google account, Cory’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
What we request and why
https://www.googleapis.com/auth/calendar.events— to read your events so Cory can answer questions about your schedule, and to create, move or amend an event when you ask it to. This is the narrowest scope that supports both halves of that feature.https://www.googleapis.com/auth/calendar.readonly— where you only want Cory to answer questions about your schedule and never change it.
No other Google scope is requested. If a future feature needs one, you will be asked to grant it and this page will say what it is before that happens.
Where Google user data is stored
Event data is fetched at the moment you ask a question, held in memory on your Mac for the length of that request, and sent to Anthropic only insofar as it is needed to answer you. It is never written to Crate Systems infrastructure — we operate no database, log or backup containing it. Anything cached is cached on your own machine and is removed when you delete the Software. OAuth tokens are stored on that machine and nowhere else.
Limited Use commitments
- Google user data is used only to provide or improve the specific features you invoked. It is not used for any other purpose.
- Google user data is never transferred to others except as necessary to provide those features, to comply with applicable law, or as part of a merger or acquisition with your prior notice.
- Google user data is never used for advertising, ad targeting, personalization or resale.
- Google user data is not used to develop, improve or train generalized artificial intelligence or machine-learning models. Where it is sent to an AI provider, it is sent solely to fulfill the request you made, under terms that prohibit training on it.
- No human at Crate Systems reads your Google user data. We have no mechanism to do so — it never reaches our servers. The only recipient outside your Mac is Anthropic, which processes it to answer the request you made and does not train on it. The only exceptions permitted under the policy would be with your explicit consent, for security purposes, or where required by law.
You can withdraw Cory’s access at any time at myaccount.google.com/permissions. Because tokens live only on your Mac, deleting the Software also ends that access.
7. Who can address Cory, and what they can reach
This is a privacy question as much as a feature. The owner of the Mac decides who may address Cory. There are two levels:
- The owner can ask Cory to run commands and read or write files on that Mac.
- Everyone else in a conversation gets a restricted version. They can ask questions, search within the conversation and have pages written to Notion. They cannot touch the machine, its files or its shell.
Anyone in a group conversation can see that Cory replied, and can see the reply. If you would not say something in front of the group, do not ask Cory for it there.
8. Sharing
We do not sell personal data, and we have never sold or shared it for cross-context behavioral advertising. For the Site we use a small number of processors: a hosting provider to serve these pages and a transactional email provider to deliver the mail you asked for. They act on our instructions and are bound by contract.
9. International transfers
Our hosting and email providers operate globally and may process Site data in the United States and the European Union. Where personal data is transferred out of the UK or EEA we rely on the UK International Data Transfer Addendum or the European Commission’s Standard Contractual Clauses.
10. Security
The Site is served over TLS. Form submissions are transmitted encrypted and are not stored in a public database.
The security of what Cory processes is, in large part, the security of your Mac. Because the Software can run commands and read files on that machine, we recommend FileVault, a screen lock, an account password that is not shared, and care over who is in the conversations Cory can see. Full Disk Access is a significant permission: grant it knowingly.
11. Your rights
Depending on where you live you may have the right to access, correct, delete, port, or restrict processing of your personal data, to object to processing based on legitimate interests, and to withdraw consent at any time. Residents of California have the rights to know, delete, correct and opt out of sale or sharing under the CCPA as amended by the CPRA; we do not sell or share personal information and never have, so there is nothing to opt out of. We will not discriminate against you for exercising any right. Because we operate exclusively online and deal with you directly, email is the designated method for submitting a request.
For anything we hold, write to hello@trycrate.net and we will respond within one month. For data held on your own Mac, you already have it: delete the Software and its working directory and it is gone. If you are in the UK or EEA you may also complain to your supervisory authority.
12. Children
Cory and this Site are not directed at children under 16, and we do not knowingly collect their personal data. If you believe a child has given us data, write to us and we will delete it.
13. Changes
If we change this policy we will update the date at the top of the page. Where a change materially affects how personal data is handled, and we hold your email address, we will tell you before it takes effect.