Interim documents — alpha program.
Cognate is in invite-only alpha. These pages describe, accurately and in plain language, how the software behaves today. They have not yet been reviewed by a lawyer. A reviewed version will replace them before Cognate is offered to anyone outside the program.
They are published now so that anyone joining the alpha can see exactly what the software does before connecting an account. Retention periods, refund terms and the liability and governing-law sections are our own provisional drafting and may change on review. The product is changing weekly and so will these pages; anything material will be announced by email first. Questions, corrections and objections: privacy@trycognate.com.
Cognate is a local-first application. Your mail, calendar, documents, notes and the connections between them are stored on your own devices and synchronized through your own iCloud account. Cognate operates no server that holds your content.
This policy describes the narrow set of things that do reach us, the third parties involved, and the choices you control.
The following never reaches Cognate:
Synchronization between your devices uses Apple iCloud, in your own account, under Apple's terms. Cognate cannot read that data and holds no copy of it.
There are two exceptions to all of this, and they are set out rather than buried: usage and diagnostic data, in section 2, and the AI features, in section 3.
| What | Why | Kept |
|---|---|---|
| Email address | To issue an invite, send sign-in codes, and identify your license | While your account exists |
| License and subscription status | To know whether the application should run | While your account exists |
| Update checks | To tell the application a new version exists | 30 days |
| Usage and diagnostic data | To find what is broken and what is unused. Not linked to your account | 13 months |
| How much AI you used | To count the allowance included with your subscription, and to know what the service costs to run | 13 months |
| Your devices | To know which builds are in use and to show you where you are signed in | While your account exists |
| The days you opened the app | To count how many people are actively using Cognate | 13 months |
| How much you used it, as daily counts | To know whether Cognate is working for the people using it. Counts only — not collected yet | 13 months |
| Support messages | To answer you and fix what you report | See below — not yet settled |
| Invitations you send | To deliver the invitation and show you whether it was taken up | While your account exists |
| How you arrived | To know which routes into Cognate work. The invitation or wave you came through, and which page you asked from | While your account exists |
| That you finished setting up | So the person who invited you can see you are up and running | While your account exists |
| Invitation requests | To invite you, and to decide which connectors to build | Until you ask us to delete it |
Cognate records how the application is used and whether it is working, and sends that record to us. It covers which screens you open, which kinds of record you open and complete, whether operations succeed or fail, the version and platform you are running, and — for each request to the AI — which feature asked, which model answered, how long it took, how many tokens it used and whether it succeeded.
It does not include the content of anything: not your mail, calendar, documents, notes, transcripts, search terms, or what you send to the AI or get back from it. It carries no names, email addresses, subject lines, file names or location. Record types you invent yourself are reported as custom and never by name.
How this is enforced. Every value in the record is a number, a yes/no, or one word from a list fixed in the source code. Free text is not a permitted value — it is rejected in the application and again when it reaches us — so content cannot reach this record by mistake. There is no crash reporter and no session replay.
The demo workspace sends nothing at all.
Linked to you: daily totals. A short list of counts, one number per day, kept against your account.
What that record is not: no screens, no names, no titles, no search terms, no content, and nothing you wrote. It is a tally rather than a diary. It can say that you wrote eleven notes on a Tuesday; it cannot say which they were or what any of them said.
Not linked to you: how you move around the app. Which screens you open, which kinds of record, whether an operation succeeded or failed, and the detail of each AI request — all of that carries only a random identifier generated on your device when you install Cognate. That identifier is never sent to the sign-in service. There is no shared key between the two records, no lookup table, and nothing in Cognate that pairs them.
The line between them is where we put it on purpose. A daily count tells us whether Cognate is working for the people using it, which is a thing we need to know. A step-by-step log of what you did would tell us how you work, which is yours. So the counts are linked to you and the log is not, and the log is kept coarse enough that it would not identify you even if it were.
And we do not connect them. We say do not rather than cannot on purpose. Both records describe the same AI requests, so someone with direct access to the database who set out to match them by day and volume might manage it. Nothing in the product does that and nobody here has a reason to — but cannot would be a stronger word than the facts support, and we would rather give you the accurate one.
During the alpha and beta programs none of this can be switched off. It is how a pre-release product gets fixed, and taking part means accepting it. In the released product the telemetry and the daily counts can both be switched off in Settings.
The AI meter is the one exception, and it always runs. Your subscription includes an allowance of AI; an allowance that is not measured is not an allowance. So the meter keeps running even with everything else switched off. It counts requests and tokens and nothing else — it is metering, not study, and it is the only part of this you cannot turn off while you hold a subscription.
Cognate's AI provider is Anthropic. It is the only provider, and it is not selected by you.
Some AI work happens when you ask for it. Some happens automatically, as part of how the product works — reading what arrives, extracting commitments and dates, linking new material to what is already there, scoring what deserves your attention. That is the product. It is not an ambient service running behind your back, but it does not stop to ask permission each time either.
When you use Tell us while signed in, or write to support@trycognate.com, what you send becomes a support ticket on our service and we answer it by email. We keep what you wrote, our replies, your email address, the version you are running and what kind of device it is.
Three things go only if you tick them, and you can read each one first: the support report (counts, sizes, times and version numbers — never anything you have written), your usage counts, and a screenshot. Nothing is attached without you choosing it.
A ticket is used to answer you and to fix what you reported, and nothing else. It is included when you ask for your data and deleted when you delete your account. How long a closed ticket is kept otherwise is not yet decided — the current proposal is twenty-four months for the conversation and ninety days for any report or screenshot attached to it. This page will say the settled answer before the alpha program ends.
Signed out, or if our service cannot be reached, Tell us falls back to an ordinary email from your own account, as it always did.
When you invite someone, we keep the address you invited, your name as the person who invited them, and when it was sent. The person you invite is told who invited them — that is rather the point. You can see whether each person you invited has started and whether they have finished setting up, and nothing else about them.
When you finish setting up Cognate, your device tells our service so, linked to your account. It is how the person who invited you sees that you are up and running.
We also record how you came to Cognate: the invitation or the wave you arrived through, who invited you, and which page you asked from. It tells us which routes actually work.
If you ticked Send me the occasional note on the invitation form, we may write with news about Cognate. Each note carries an unsubscribe link, and you can stop them at any time. Notices about your account or your invitation go to everyone they concern.
Cognate can suggest people you might like to invite. That is worked out on your device, from your own mail, calendar and People, and nothing about those people, and not even the fact that anyone was suggested, is sent anywhere. Anyone marked Keep from AI, and anyone under a confidential hat, is never suggested. Ari explains this once after setup, and Settings → Privacy → Invitations turns it off.
This site sets no cookies of its own and stores nothing in your browser. No analytics, no advertising, no tracking pixels, no session replay. We do not know you visited unless you ask for an invitation.
Two things on the page are loaded from somewhere else, and both receive your IP address because that is how fetching a file over the internet works:
What you type into the invitation form reaches us only when you press the button. Nothing is sent as you type, and a form you abandon is a form we never saw.
So that you can see where you are signed in and we can tell which builds are in use, we keep a row per device: the name the device reports for itself, its platform, the app version, and when it was first and last seen. Macs and iPhones often name themselves after their owner — if yours is called something you would rather we did not hold, rename it in your system settings and Cognate will record the new name.
Cognate can track habits — something you do each day, or a number you log. Habits live on your device and sync through your own iCloud account, like everything else you write.
On an iPhone or iPad, a habit can be set to write itself into Apple Health. You turn this on for one habit at a time, on that habit's own page, and Health asks your permission separately before anything is written.
Four kinds of habit can be written: weight, water, exercise minutes (as a workout) and meditation minutes (as a mindful session). Changing a day's entry in Cognate replaces the Health entry for that day; clearing it removes it. Steps and sleep are not written, because your phone and watch already put them there.
Cognate never reads anything from Apple Health. Not steps, not sleep, not weight, not anything you or another app has put there. The permission Cognate asks for is write-only.
Nothing from Apple Health reaches us, and nothing from it goes to iCloud. Health data stays in Health, on your device, under Apple's own protection. Cognate holds no copy of it, our service never sees it, and it is not part of your Cognate sync, your export or anything in section 2.
Turn it off on the habit's page, or withdraw the permission in Health at any time. Doing so stops any further writing; what has already been written is yours, in Health, and you remove it there.
When you connect a Microsoft or Google account, you authorize Cognate through that provider's own sign-in screen. The resulting tokens are stored on your device, in the operating system's secure storage. They are not transmitted to us, and you can revoke them from your provider's account settings at any time or by disconnecting the account in Cognate.
| Who | What they do | What they see |
|---|---|---|
| Cloudflare | Website hosting, the anti-abuse check on the invitation form (Turnstile), email routing, storage of application builds, usage and diagnostic intake | Requests to this website, including your IP address; mail sent to our addresses; the usage record described above |
| Resend | Sends sign-in codes, invitations, replies to support tickets, notices about your account, and news if you asked for it | Your email address and the message |
| Anthropic | Runs the AI features | The text each operation sends, and nothing marked Keep from AI |
| Apple | iCloud sync and app distribution, in your own Apple account | Your synchronized data, encrypted under Apple's terms |
| Serves the two typefaces this website is set in | Your IP address, when the fonts load. Nothing else |
Nobody takes payment yet. Cognate is in alpha and no payment is collected, so no payment processor holds anything of yours. When subscriptions open we will name the processor here, and say what it sees, before the first payment is taken.
Delete your account. Write to privacy@trycognate.com. Your account record, license record, support tickets, invitations and request for an invitation are deleted within 30 days. Everything on your devices and in your iCloud account is deleted by you, because we cannot reach it.
If you are in the United Kingdom or the European Union you have rights of access, correction, deletion, portability and objection over personal data we hold, and a right to complain to your supervisory authority.
Ask and we will send you everything linked to your account as a single file — the account itself, your devices, the days you opened the app, your daily counts, your AI usage, your support tickets, your invitations and how you arrived, and your request for an invitation — or erase all of it. Everything else is already in your possession, on your own machine, where we cannot reach it.
One honest consequence of keeping the behavior log unlinked: we cannot include it in either. With nothing tying those records to you, we have no way to find yours to send or to delete. That is the trade — we would rather not be able to identify you than be able to hand you a file.
Account records, license records, support tickets and usage data are held in the United States, on Cloudflare's network. Your content is held on your own devices and in your own iCloud account, in whichever region Apple assigns to it. We hold no copy of it anywhere.
Cognate is made by Charles Araujo International, LLC, a company in the United States. There is no European entity in the middle: when you ask for an invitation or sign in, what you send arrives here directly.
Where we pass something to one of the companies in section 6, each of them holds a data processing agreement with us that carries the transfer safeguards the UK and EU require:
Being a United States company means United States legal process can in principle reach what we hold. What we hold is the narrow list in section 2 — an email address, a license row, some counts. Your mail, your documents, your notes and your calendar are not on that list, and no order served on us could produce them, because we do not have them. That is the practical point of building it this way, and it is worth more than any clause we could write.
Cognate is changing weekly, and so will this policy. If it changes materially, we will say so by email before the change takes effect.
Cognate is a product of Charles Araujo International, LLC. In this policy, “Cognate”, “we” and “us” mean that company, which is the data controller for everything described above.