Privacy Policy

Coii Ref

Effective effective date

1. The short version

Your images never leave your Mac, and we never receive anything from the app. There is no account to create, no server of ours to connect to, no analytics, no crash reporting and no telemetry. We cannot see how large your library is, whether you use the app at all, or what is in a single picture — not because we promise not to look, but because nothing is sent.

The app does make three kinds of outbound connection. They are listed exhaustively in §3, and none of them carries your files, your thumbnails, your tags or anything computed from them.

The one place any information about you exists is your purchase, which is held by Lemon Squeezy, our merchant of record (§4).

2. What stays on your device

Two locations, and nothing else.

Beside your own files. Everything the app knows about a folder you added is written into that folder, so that moving the folder moves the library with it:

Every name the app writes starts with coii-, and the whole prefix is reserved: anything in your folder with that prefix is ours and is skipped when indexing, so a folder can be handed back to you by deleting them.

Under your user library. ~/Library/Application Support/coii holds license.json — the trial's start date and activation state — and models/, where the semantic-search model goes if you install it.

A copy of the licence key and the trial's start date is also kept in your macOS keychain under io.coii.ref.license, so that reinstalling the app does not cost you a device activation or reset your trial. It is readable only by you and by signed builds of this app.

Two things are worth spelling out:

• Reading a file locally is not sending it. To make a thumbnail the app hands a path to macOS's own tools (sips, qlmanage) and reads Spotlight metadata with mdls. Those are processes on your machine, they are given your file, and they hand back pixels or a string.
• Vectors are not identity. Semantic search stores a short numeric vector per item. It is compared only against other items in the same workspace; it is not matched against any database of ours, and it is not sent anywhere.

Deleting those coii- files from your folders, deleting ~/Library/Application Support/coii, and removing that keychain item deletes everything the Software holds. There is no other copy anywhere.

3. Every connection the app makes

This is the complete list. Nothing else in the app opens a connection.

3.1 Downloading the semantic-search model — only if you install it

Not in this build. Semantic search has no control anywhere in the app yet, so nothing can start this download and the connection below is never made. The section is kept because the feature is coming back, and a policy that gains a network call in a later version should be one you can compare against this one.

The model is google/siglip-base-patch16-224, roughly 815 MB, and the app has no semantic search until you ask for it. Hugging Face is not ours, and its own privacy policy applies to the request. Nothing about your library or your licence is included. Once the files are on your disk they are used from there and the host is not contacted again; uninstalling the model deletes them.

3.2 Licensing — only when you press Activate or Deactivate

POST https://api.lemonsqueezy.com/v1/licenses/validate POST https://api.lemonsqueezy.com/v1/licenses/activate POST https://api.lemonsqueezy.com/v1/licenses/deactivate

Sent to validate: your licence key, and nothing else. Pressing Activate makes this call first, because Coii Ref and Coii Audio are sold from one Lemon Squeezy store and this is the only call that says which of the two a key was issued for. A key belonging to the other product is refused here rather than activated and then undone, which would have cost somebody a device slot.

Sent to activate: your licence key, plus a device label so that a stuck slot can be identified in a support request. The device label includes your Mac's computer name — the name from Sharing settings, often a person's name, for example "Jane's MacBook Pro" — plus six characters of a random per-install identifier. If you would rather Lemon Squeezy not hold that, rename your Mac before activating.

Received: which product the key was sold for, and an activation identifier, which is stored locally so the slot can be released later.

Nothing else is sent, and this happens at most three times per device — one check and one activation when you activate, one more if you ever deactivate. After a successful activation the Software does not contact the licensing service again; it does not phone home, re-validate or check in. An activated app works indefinitely with the network off.

3.3 Checking the trial clock — during the trial only

HEAD https://cloudflare.com/, and if that fails, HEAD https://www.apple.com/

The trial is thirty days, and the only defence against a system clock being wound back is a clock from somewhere else. Any HTTP response carries a Date header, so the app reads that and nothing else. The request contains no identifier, no licence key and nothing about your install — it is indistinguishable from opening the website. Those two operators see an IP address making an ordinary request, as they would for any visit.

If the request fails, nothing happens: being offline is normal, and the trial then runs on your own clock rather than refusing to run.

3.4 The app's own HTTP service, on loopback

Coii Ref is a window around a local web service. Opening the app starts a backend that listens on 127.0.0.1 and points a macOS WebKit view at it; the interface you see is that page, rendered inside the app rather than in a browser, and the same page is reachable from a browser on the same Mac. That traffic never leaves your Mac, and the view loads nothing from anywhere else.

One thing about it is yours to get right rather than ours. The service has no authentication, because a loopback address is the boundary. Starting it on a different address — --host 0.0.0.0, or the COII_HOST environment variable — publishes your library, its thumbnails and the original files to everyone who can reach that address. It is not a deployment mode, and it is not the default.

3.5 What the app does not do

No analytics. No crash or error reporting. No usage statistics. No advertising or tracking identifiers. No update check — the app has no in-app updater, so it contacts no release server. No connection at launch beyond the trial clock in §3.3, and none at all once you are licensed: opening the app with the network off does everything it does with the network on, apart from installing a model you have not installed yet.

4. Your purchase, which Lemon Squeezy holds

We do not run an account system. If you buy a licence, the record of that purchase is held by Lemon Squeezy LLC, our merchant of record, which handles checkout, payment, invoicing and tax.

Lemon Squeezy holds your email address, the licence key it issued you, your activations and their labels, and the billing and tax details it needs — including whatever your payment method required. Lemon Squeezy is the controller for the payment transaction; its privacy policy governs that data.

As the seller, we can see in its dashboard: the purchase email address, purchase date and amount, the licence key, and the device labels of its activations. We use that only to answer support requests, adjust an activation limit, and handle refunds. We never receive full card details.

To reach your own purchase data, use My Orders at https://app.lemonsqueezy.com/my-orders, which authenticates you by mailing a sign-in link to the address that bought. It is where you recover a lost key and find your receipt, without going through us. It is not where a device slot is released — that is a button in this app, on the machine holding the slot; see §7 of the Terms.

5. The website

Stub — must be completed before launch. Fill in exactly what https://coii.io runs: analytics, session recording, embedded fonts and video, and the checkout redirect. If the site runs anything that records visitor behaviour, it is disclosed here, in these words, and the "no telemetry" claim in §1 stays scoped to the app — it is a claim about the Software and must not be allowed to read as a claim about the website. If the site runs nothing, say that instead: it is the stronger sentence and it is free.

6. Children

The Software is not directed at children under 16, and we knowingly collect nothing from anyone.

7. Your rights

Because we hold no data collected from the app, there is normally nothing for us to access, correct, export or delete. Rights over your purchase data are exercised through Lemon Squeezy, which holds it; write to support@coii.io if you would rather we start that for you.

If you are in the EEA, the UK, Switzerland or a US state with a comprehensive privacy law, you have rights of access, correction, deletion, portability and objection over data held about you. For purchase data those are exercised against Lemon Squeezy as controller. Data held about you locally is deleted by deleting the files and keychain item named in §2 — no one else has a copy to delete.

If your library contains pictures of identifiable people, you are the one holding that, not us. §9 of the Terms says whose responsibility that is; this section only says that we have no part in it.

8. Changes

If this policy changes, the current version is at https://coii.io/ref/privacy with a new effective date. A change that materially expands what the Software sends will be called out in the release notes of the version that introduces it, not buried here.

9. Contact

Riff Tech, Inc. seller address support@coii.io