Privacy Policy

In one line

natdal and its extensions do their work on your computer. What you copy, capture or send travels between your own devices, end-to-end encrypted, and is never stored on our servers. The app has no telemetry, no analytics and no ads. What we keep is your natdal account and its list of devices, and the feedback and email you choose to send us.

This policy covers the natdal app (the tray, the natdal command, natdald), the extensions inside it — tools, clipmesh, inkshot, dialmix and guildlings — the natdal account service (id.natdal.app, accounts.natdal.app) and the relay (relay.natdal.app). This website has its own website privacy notice.

What stays on your computer

All of this lives in your configuration folder (Windows %APPDATA%, macOS ~/Library/Application Support, Linux ~/.config) or a folder you chose, and leaves the computer only as described under “What leaves your computer”.

• natdal: this computer’s device key (its secret half never leaves the computer), the email and device name you signed in with, which extensions are on, your agent access settings, and the app’s logs.
• The agent access log: which agent used which tool and when, and whether it was allowed. Never what was read or written, never a tool’s arguments.
• tools: its settings. To time breaks it asks the system when you last used the keyboard or mouse; it never sees what you typed.
• clipmesh: your last 20 clips, in memory only (gone when clipmesh stops). Received files go to your Downloads folder; a partly received file waits in the configuration folder and is deleted after 7 days. Items a password manager marks as secret are never sent or kept.
• inkshot: a capture is kept only when you copy or save it. Text recognition (OCR) runs on the computer with the system’s own recognition and is sent nowhere. Captures made for an agent wait in the temporary folder and are deleted after a day.
• dialmix: its settings. It watches keyboard and wheel input on the computer to spot its volume and brightness shortcuts, and records or sends nothing else.
• guildlings: it reads what your coding agents write to your disk to draw them on screen, and keeps a usage record (date, token counts, tool and model names, the last piece of the repository path) in .guildlings in your home folder. Never prompts, full paths or command lines.

What leaves your computer

• Signing in. You approve this computer in your browser with Google or GitHub. The app sends the natdal account service this computer’s name (as the system has it — if it contains your real name, that goes too), its operating system and its device public key. We receive your email address and your sign-in provider’s account identifier, never a password.
• Staying signed in. When the app starts and when you open the tray (at most once a minute), it signs a request with the device key for a short-lived pass. The request carries the device id, the time and the signature. Nothing is sent while the app is idle.
• Extension keys. clipmesh and guildlings register their public keys with your account to reach your other devices.
• Between your devices. clipmesh’s clips, pictures and files and guildlings’ sessions and usage records travel only between your account’s devices, end-to-end encrypted. When two devices cannot reach each other directly, they go through natdal’s relay (relay.natdal.app), which passes on ciphertext it cannot read, stores nothing, and only asks the account service whether a connecting device belongs to a natdal account. The relay and the account service see the IP addresses that connect.
• Finding each other. Each device publishes its public key and relay address to an address lookup (DNS) service run by n0 (Number 0) and looks up the others there. It does not publish its IP address, but n0’s servers see the IP address that asks.
• Feedback. “Send feedback” or natdal feedback sends what you wrote, the category and extension you picked, the app version, the operating system, your account email and account and device ids. Only if you choose “include logs” recent logs go too, with home folder paths, user names, emails, tokens and IP addresses masked on your computer first and shown to you before sending. The account service does not store it; it forwards it as one email to the support mailbox.
• Updates. New versions are downloaded from GitHub, which sees the IP address that asks.

No beacons, no crash reporter, no “anonymous usage statistics”.

When an AI agent uses natdal

If you allow it, an AI agent on your computer (Claude Code, Codex, Cursor and so on) uses natdal’s features through MCP tools: it may capture the screen or read the clipboard, for example. Read and write access are switched per extension, and write access is off by default. What an agent receives from a tool (a capture, a clip, window titles) may go to the company that makes the agent, under that agent’s own terms and privacy policy. natdal does not receive or keep it. Keep this in mind when deciding what to allow. When an agent captures your screen, inkshot tells you with a notification.

What we keep for a natdal account

• Your email address and your sign-in provider’s identifier.
• Devices: name, operating system, the public keys of natdal and its extensions, when each was added and last seen. Remove a device on your account page at any time; it is cut off at once.
• A record of feedback sent (its id, time and size), used only to stop floods, deleted after 24 hours.
• Access records: the account service uses the requesting IP address to limit request rates, and failed or limited requests may be logged with the IP address and time.

That is all. We never receive your clipboard, captures, files or what your agents do.

Support email

When you write to [email protected] or send feedback from the app, we process that email (address, name, body, attachments) as far as needed to answer and fix things. It is kept in Google Workspace (Gmail). To draft a reply, the body may be sent to Anthropic’s Claude (log attachments are not); a person reads and edits every draft before it is sent, and we have opted out of its use for model training.

How long we keep it

What	How long
natdal account (email, sign-in identifier, devices)	until the account is deleted; deleted within 30 days of a request
Support email and app feedback	one year after our last reply
Feedback send records	24 hours
Access records in server logs	up to 30 days
Backup copies	rotated out within 30 days after the original is deleted

When a period ends or you ask us to delete, we delete the data from the account database without delay (within 30 days of a request) and backups rotate it out as above. Everything we keep is electronic and deleted so it cannot be recovered; we keep nothing on paper.

Who processes it for us

Who	What for	Where
Vultr Holdings, LLC	hosting the account service and the relay	Republic of Korea (Seoul)
Cloudflare, Inc. (privacy)	account database backups (R2)	Asia-Pacific
Google LLC (privacy)	business email (Google Workspace)	United States and elsewhere
Anthropic, PBC (privacy)	drafting replies to support email	United States

We do not give personal information to anyone else except where the law requires it. Outside these processors, n0 (device lookup, as above) and GitHub (updates) see the IP addresses that reach them, and Google or GitHub tell us who you are when you sign in, under their own policies. Transfers abroad happen over encrypted networks at the times described above; the table in the Korean version of this policy lists each transfer as Korean law (PIPA Article 28-8) requires.

Cookies

The app uses no cookies. The account pages (id.natdal.app) and sign-in screen (accounts.natdal.app) use only the cookies needed to keep you signed in.

Children

Under-14s cannot create a natdal account. If we learn we hold an under-14’s personal information, we delete it without delay. Features used without an account send nothing off the computer.

Your rights

You can ask to see, correct or delete the personal information we keep about you, ask us to stop processing it, and withdraw any consent, at any time: write from your account email to [email protected]. A legal representative or someone you authorise may ask on your behalf with proof. We answer access requests within 10 days and deletion requests within 30, and if the law makes us refuse or wait, we tell you why and how to object. In Korea you can also contact the Personal Information Infringement Report Center (privacy.kisa.or.kr, 118) and the Personal Information Dispute Mediation Committee (www.kopico.go.kr, 1833-6972); elsewhere, your local data protection authority.

Security

Traffic to the account service is HTTPS and traffic between devices is end-to-end encrypted. What the app opens to agents and other programs can be opened only by the same user on the same computer. Server administration is reachable only from a private network with password login off, and the backup store’s key works only for that store and from the server’s address.

Privacy officer

KIM DONG HUN (representative) · [email protected], for questions, complaints and requests about personal information.

Removing everything

Logging out in the tray removes this computer from your account and deletes its device key. After uninstalling, delete the natdal, clipmesh, inkshot, dialmix and natdal-tools folders in your configuration folder and .guildlings in your home folder, and nothing the app left remains. To delete your natdal account and what we keep, write from your account email to [email protected]; we delete it within 30 days.

Changes

We post a changed policy and its effective date on this site 7 days before it takes effect, or 30 days before and by email to your account when the change is to your disadvantage. If paid features or payments are ever added, this policy is updated and announced before they are.