Privacy Policy

Last updated: October 5, 2026

This policy says plainly what SistineGPT keeps on your Mac, what leaves it, which companies receive it, and when. Where a feature is optional, it says what turns it on. Where we rely on another company, it names that company. Every sentence is meant to hold in every state the app can be in: Free or the Private Cloud plan, Local or Private cloud mode, Ghost mode on or off, the lock on or off, memory on or off.

What this policy covers

Sistine is a lab, and it makes more than one thing. This policy covers all of it, but the parts are separate, so it says which product each sentence is about:

SistineGPT, the Mac app, which is what almost everything below is about. Its subscription is sold by Paddle.
Sistine, the market research app (called Sistine Path until September 2026), a separate product with its homepage at sistine.ai and a separate subscription of its own, sold by Stripe. Nothing is shared between the two: separate apps, separate purchases, separate identifiers, separate companies handling the money. The section Sistine market research app is all of it.
This website, which runs on Cloudflare and loads third-party scripts only for Paddle checkout and, after permission, X ad measurement on the market research homepage and subscription pages. Paddle takes payment for SistineGPT; the X pixel measures advertising for the market research product.

The short version

Your conversations are saved on your Mac, encrypted with a key only your Keychain holds. With a model on your Mac (the whole of Free), they are processed on your Mac and never reach our servers. A chat in Ghost mode is written to no file at all unless you keep it.
In Private cloud mode, which the Private Cloud plan includes, each message goes to a sealed server that Venice routes to. Before sending, your Mac checks that the server is genuine sealed hardware and encrypts your message to it. It does not check every program the server's operator runs. Our relay carries ciphertext it has no key to open. No message reaches our servers in the clear, on any plan.
Web searches happen in Local mode only, and leave your Mac only after you approve the exact words, or allow searches for that chat. They go through our search service to Brave Search.
Your screen text, memory notes and attached images go only to a model on your Mac or your network. That holds on every plan, in Private cloud mode, and with your own AI service configured; no setting changes it.
Memory notes are one list, read and written only in Local mode; a chat in Ghost mode neither reads nor writes them.
Delete All Local Data destroys the key everything was encrypted with. We do not run accounts or advertising, the app has no analytics, and we do not sell personal data.
Two services recognize this install by a random identifier the app makes on your Mac, one per service, which you can replace at any time. The section Install identifiers explains what they are and what they still link.
Most of the sentences above are things you can check yourself with a packet filter and a database browser, rather than take on trust. What we prove, and what we promise sorts every claim into the ones you can check, the ones that rest on our word, and the ones that are not true yet, and gives the commands.

What stays on your Mac

Chat history, memory notes, records of documents you imported, your Instructions for the assistant and your settings are stored on your Mac in your user account.

Encrypted by the app: your conversations and their titles, memory notes, imported document records, and your Instructions. One key: 32 random bytes held in your macOS Keychain, which never leaves this Mac and which we never have. Turning on the Touch ID lock in Settings → Privacy puts that key behind Touch ID, a paired Apple Watch or your Mac password: while locked, SistineGPT stops opening your conversations and notes and cannot read them either.
Not encrypted by the app: your settings, and files you export yourself. If FileVault is on, macOS encrypts your whole disk.
Not on disk at all: a chat in Ghost mode, which lives in memory for as long as it is open. Keep copies it into your history; anything else drops it.
Keys you add (your own AI service's API key, your own Brave key) are stored in the macOS Keychain.

You can check this rather than take our word for it: the recipe is on the proof page.

Deleting it. Settings → Privacy → Delete All Local Data removes conversations, document records, your memory notes, your Instructions, and every key SistineGPT stored, then destroys the key the rest was encrypted with, so an encrypted copy of a file left anywhere else is unreadable without it. Two honest limits: restoring a whole backup made before the deletion brings the key back with the files, and anything written before the version that started encrypting was never protected by it. Dragging the app to the Trash removes the app but, like most Mac apps, leaves its Application Support folder behind.

What leaves your Mac, and when

AI replies

A model on your Mac: requests stay on your Mac, where the local model runs in Ollama.
A model on another computer on your network: each request goes from your Mac to that computer over your local network, without encryption. The app says so beside the model at the top of the sidebar.
Private cloud mode, on the Private Cloud plan: your Mac fetches the server's hardware proof through our relay (ai.sistine.ai, run on Cloudflare) and checks it on your Mac: that the hardware is genuine and sealed, that the proof is fresh, that the encryption key belongs to that hardware, and that the server started from a base system image on the list the app accepts. Only then does it encrypt the request to that key. It does not check every program the server's operator runs. The request carries, as ciphertext, your message, recent messages from the chat (30 by default, set in Settings → Privacy) and the text of a document you attached. It does not carry your memory notes, your screen text or an image, and no tool is offered to it. In the clear, the relay sees the size of the ciphertext, the timing, the model's name, your random identifier for our relay and your IP address; it has no key to open the ciphertext and stores none of it. The relay forwards the ciphertext to Venice, which receives it with the model's name, the session's two public keys, the timing, the token counts and our account, and sees the relay's IP address rather than yours. On the sealed server the request is decrypted to write the reply, so that server holds the plaintext of that turn while it runs; the reply comes back encrypted and is decrypted on your Mac. Sistine does not check what Venice keeps of the metadata. If the hardware proof does not check out, nothing is sent: Private cloud is switched off and the reply comes from the model on your Mac, with a line saying so.
If our relay ever stops reporting that it carries sealed conversations, the app takes no cloud path at all: a Private Cloud subscriber's chat runs on their Mac or their network, and Settings → AI and the Plan tab say so. The app reads that report itself rather than assuming it.
Your own AI service (the Private Cloud plan, Local mode): requests go directly from your Mac to the address you entered, with your message, recent messages from the chat, the text of a document you attached, and anything a web tool read during that turn, under that service's terms. Sistine's privacy guarantees do not cover it, and whoever runs that service can read what you send. The app says "Not private" beside the model for as long as it is in use.
Your private data (text read off your screen, your memory notes, and images you paste or attach) goes only to a model on your Mac or on a computer on your local network. Not to the sealed server, not to your own AI service, not to a model Ollama runs in its cloud, on any plan; there is no setting that changes it. When neither is ready, the feature does not run and says so, rather than sending the data somewhere else. What the model writes about a picture or a screen stays in the chat, so once a chat has been shown one, the rest of that chat also runs only on your Mac or your network.
Your Instructions (Settings → AI) go with every request, in either mode. Anything you write there reaches whichever model answers.

Web search and web pages

Web search happens in Local mode only, never on a Private cloud turn. Before each search the app shows the exact query and asks, unless you chose "Allow for this chat" earlier in that chat. An approved query goes to our search service (search.sistine.ai, run on Cloudflare) with your search identifier, and from there to the Brave Search API, which processes it under Brave's terms. Our search service does not store queries. It keeps a count of searches per search identifier (up to 35 days), and a count per connection for about a day, keyed by a hash of your IP address under a key we throw away daily rather than by the address itself. If you add your own Brave key, searches go straight from your Mac to Brave under your key.
Web pages: when you ask about a link in Local mode, or approve reading a page, your Mac downloads it directly from that website, which sees your IP address as any browser visit would.

Setting up and updating the app

Local AI setup: the one-click setup downloads the Ollama runtime from GitHub and a model from Ollama's model library. An image model is offered separately in Settings and downloads only when you press its button. Ollama is a separate program under its own terms, and the Ollama process fetches models with its own networking, which the app's Network Ledger does not list.
Voice: Apple speech recognition transcribes push-to-talk on your Mac. If your language would need Apple's servers, the app tells you and does not send the audio. Spoken replies use your Mac's built-in voices.
Software updates: the app checks our update feed (updates.sistine.ai, run on Cloudflare) every six hours by default, and downloads updates from sistine.ai. The request carries your app version and, like any connection, your IP address. By default, updates install when you quit; Settings → Privacy turns off automatic checks or background installs.

Your plan, and what the app shows you

Your plan and billing status: requests to our relay carry your identifier for it, so we can tell which plan an install is on and meter its allowance. This happens whenever you use Private cloud, start a checkout or cancel, and, while you have a paid plan, a checkout in progress, or had a paid plan in the last 60 days, when the app starts or comes to the front. An install on Free that never opened checkout sends that identifier nowhere. The one thing such an install asks our relay is when you open Settings → Plan: it asks whether the paid plan is being served yet, with no identifier, no account and nothing that says which Mac asked, and the answer is the same for everybody.
Network Ledger and Proof: Settings → Privacy lists every connection the app makes through its own networking since it started (the updater's own checks are the one exception, and the panel says so), with the feature that caused it, how many bytes went each way and how far it went. Proof lists every answer the app asked a model for and where that model ran, along with the hardware proof your Mac checked before a Private cloud turn, where there was one. Both lists are held in memory on your Mac, are never written to disk and are never sent anywhere; they are gone when you quit. Exporting one writes a file where you choose. Neither holds a prompt or a reply.
Feedback: if you send feedback from the app, our feedback service receives the category and message you write, the app version and build, your macOS version, your language and region setting, and a contact email if you give one. It stores exactly that, and nothing the app did not show you, for 120 days. The app shows you the report before it is sent.
Crash reports: this version of the app does not send crash reports anywhere. The setting only lets the app read its own crash logs on your Mac to show them to you.
Notifications: a reply that finishes while the window is not in front is shown as a macOS notification that says only that a reply arrived. No words of the reply go into it, from any chat: macOS keeps notifications in a database of its own that we do not encrypt and cannot reach into, and shows them on the lock screen. Delete All Local Data removes every notification the app delivered, and clears any still waiting to fire.
Launch mailing list: the homepage used to have a form to get updates by email, and we keep the addresses given there for that mailing. That launch-list form is retired. Email sign-in does not add your address to that list. Unsubscribe or email us and yours is deleted.
Purchases: the checkout page (sistine.ai/checkout.html) loads Paddle's script to take payment. The market research homepage and subscription pages can also load the X pixel after your permission, as described below.

Older versions

Before the chat-only release of September 2026, this app was larger, with other pages and a different paid cloud path. If you still run one of those versions, the policy that shipped inside it (Settings → Privacy → View Privacy Policy) describes what it does; updating brings you to the app this page describes. Some of what those pages created is still held on our servers after you update, and Data from earlier versions says what, for how long, and how to have it removed.

Install identifiers

SistineGPT makes two identifiers on your Mac, one for each service that needs one: our relay and web search. Each is 32 random bytes from your Mac's random number generator, stored in the macOS Keychain and derived from nothing: not your hardware, not your name, not your email. Each service sees only its own, so they are different values at different addresses.

You can replace both at once in Settings → Privacy. Your plan and its allowance come with you, because a paid allowance is counted against the subscription rather than the identifier.
Deleting all local data deletes them too, along with every other secret SistineGPT stored in your Keychain. Nothing else in your Keychain is touched. The one exception is the identifier for our relay, which is kept if you have a paid plan, a checkout in progress, a payment problem, or a plan that ended in the last 60 days, so you are not left paying for a subscription your Mac can no longer reach. Replace it whenever you want with the button above.
Paddle, who sells the subscription, is given a separate billing-only identifier. It is not one of the two and it cannot be used to buy anything.
What they still link, on our side: our plan ledger knows which search identifier belongs to which account, because that is how we stop a canceled subscription from spending. We can therefore still connect your sealed use and your search counts to your subscription.
Before September 2026 there was one identifier instead, and it was a hash of your Mac's hardware UUID: it could not be reset, and anyone who read that UUID could compute it. If you used the app before then, it trades that value in the first time you open the new version, after which it stops working.

We use these to apply plans and limits and to stop abuse, not to profile you.

Companies that receive your data

Every company below is named with the job it does, under the product it does it for. A processor handles data on our instruction and for our purposes only. An independent controller decides for itself what it does with what it receives, under its own policy, and we say so rather than implying our rules travel with the data.

SistineGPT, the Mac app

Company	Its role	When it receives anything
Cloudflare	Processor. Runs our servers and this website, so it handles every connection to a sistine.ai address, including your IP address.	Any feature that talks to sistine.ai
Venice	Independent controller for what it receives. The API provider behind the Private cloud path, which we hold an account with, and the address our relay forwards each sealed request to. It receives ciphertext, the model's name, the session keys, the timing, the token counts and our account, and sees our relay's IP address rather than yours. The sealed server it routes to holds the plaintext of a turn while it writes the reply. Before sending, your Mac checks that server's hardware proof; it does not check every program the server's operator runs, and Sistine does not check what Venice keeps of the metadata.	Private cloud mode, on the Private Cloud plan
Brave	Independent controller for what it receives. Returns web search results through the Brave Search API, under Brave's own terms and query-log policy.	Searches you approve in Local mode
Paddle	Independent controller. Sells subscriptions as our merchant of record, and holds your payment details, billing address and email under its own policy. We receive subscription status and a billing-only identifier.	Checkout, billing
Ollama	Independent controller for what it receives. Hosts the model library the app downloads from. A download tells Ollama your IP address and which file you asked for, and nothing about your conversations.	Local AI setup and model downloads
GitHub	Independent controller for what it receives. Hosts the Ollama runtime the one-click setup downloads; it sees your IP address and the file requested.	Local AI setup
Apple	Independent controller for what it receives. Speech recognition runs on your Mac, and sends nothing. Notification Center holds the notifications the app posts.	Nothing leaves your Mac for Apple through this app

Your own AI service, if you add one, is a company you chose: the app connects to it directly, as your client, with the key you gave it, under its terms. There is no server of ours in between, and it is not acting for us.

Sistine market research app

Sistine, the market research app (called Sistine Path until September 2026), is a separate product: market research for the web and the Mac, with its homepage at sistine.ai, a subscription page at sistine.ai/subscribe, a web app at sistine.ai/app and its own subscription. It is not part of SistineGPT, it is not included in any SistineGPT plan, and buying one buys nothing of the other. Its billing is Stripe's, not Paddle's.

The market research app offers a $9 per month core plan and a $12 per month Alerts plan to US customers. Opening /subscribe checks checkout availability. If this browser has a saved purchase credential, the page also checks subscription status; connection and checkout flows make additional requests. Those pages also check email sign-in availability; requesting or verifying a code, when available, makes further requests to the account service and Supabase Auth. These servers receive network information such as your IP address. Availability checks do not carry a purchase credential; authenticated status checks do.

A plain visit creates no purchase credential. The Start button can keep the word “web” in that tab’s session storage so the page offers the web app after payment. Optional advertising measurement requires separate permission. These are the companies behind the market research subscription page and web app:

Company	Its role	When it receives anything
Cloudflare	Processor. Serves the page, as it serves every sistine.ai address, so it handles the connection, including your IP address.	Opening the page
Stripe	Independent controller. Sells the market research app's subscription and holds your payment details, billing address and email under its own policy. Your card is entered on Stripe's own hosted checkout, never on our page, and we never see it. Managing or canceling that subscription goes to Stripe's billing portal.	Starting a checkout for the market research app, and managing its subscription
Supabase	Processor. Runs checkout, subscription and account services, stores authentication and purchase records, and supplies the web app’s protected market reports. When email sign-in is available, Supabase Auth stores every accepted address submitted for a code, including unverified addresses. Auth requests and protected API calls are separate from the initial availability check.	Checking availability and purchases, starting checkout, using market reports, and optional email verification
Resend	Processor selected for email sign-in. Receives the recipient email address, verification message and delivery information to deliver sign-in codes. Standard email and log retention is 30 days. See Resend retention.	Requesting a sign-in code when email sign-in is available
X	Independent controller. Only if you choose Allow for ad measurement on the homepage, /subscribe or the Alerts page: X's pixel records that visit and, after a new purchase is confirmed, one purchase event carrying a random conversion ID, with no price, email or payment details. X may set cookies and receives your IP address and browser details under its own policy.	Only after you allow ad measurement
CoinGecko	Independent controller for what it receives. The market data provider the page credits ("Data provided by CoinGecko"). The page links to it; it receives nothing about you from us.	Nothing from the page itself

A purchase of the market research app is recognized by a random credential your own browser makes when you start a checkout, saved in that browser. A first visit creates none. Opening the page from Continue in browser in the market research app on your Mac keeps that connection request in the tab until it is used or expires. Existing access uses the purchase browser and its saved credential to open the web app and approve one Mac’s connection request. Support can issue a recovery credential after checking ownership if that browser is lost. Email sign-in, when available, adds verified email accounts without replacing existing browser or Mac credentials. Linking an old purchase for the first time requires both the verified email captured at the original Stripe checkout and purchase proof; billing email alone cannot grant access. The web app keeps its watchlist and appearance in that browser's storage too; its own privacy notice says the rest. The market research app is a research tool and its page says so: historical comparisons and projected paths are not reliable probabilities and not investment advice.

Stripe requires a billing email at checkout. Email-code verification with Sistine before checkout is optional; checkout remains available if code delivery fails. Paid email-only accounts using the updated app also receive a permanent browser recovery credential, whose server-side record contains only a hash and purchase link. You can save a private copy from Account → Save recovery code. It follows subscription entitlement and survives email sign-out and session expiry. Clearing browser storage removes the local copy.

For email sign-in, unverified email records created by the sign-in form are deleted after seven days by daily cleanup, normally within eight days. Verified accounts and purchase links remain while needed for access or recovery, subject to verified deletion requests, required billing retention and backup rotation. Email sessions last 30 days, with at most five active at once. Sign-out revokes only email access, preserving the original purchase-browser credential and Mac activation. Full provider, session and retention details are in the market research privacy notice.

Who we are

SistineGPT is made by Looks Labs LLC, doing business as Sistine, which is the data controller for the processing described here. Contact us at support@sistine.ai about anything on this page.

Your rights over your data

Email support@sistine.ai and we will act within 30 days. You can ask us to give you a copy of what we hold, correct it, or delete it; object to or restrict a particular use; and, where a law such as the GDPR or the CCPA applies to you, complain to your data protection authority. SistineGPT does not sell or share personal information for advertising. Optional X advertising measurement on the market research product’s homepage and subscription pages is described in its privacy notice; use Ad privacy on those pages to decline or withdraw permission. Because almost everything the app holds stays on your Mac, the fastest way to delete the bulk of it is to delete it locally.

Purchases

SistineGPT subscriptions are sold by Paddle, our merchant of record. Paddle collects and processes your payment details, billing address and email under Paddle's privacy policy; we receive subscription status and the billing-only identifier the checkout carried, not your payment details.

The Sistine market research app is billed separately, by Stripe, under Stripe's privacy policy. The two subscriptions have nothing to do with each other: paying for one does not pay for the other, and canceling one does not cancel the other. See Sistine market research app above.

What we never do

No selling of personal data. SistineGPT has no advertising and no ad identifiers.
No analytics or telemetry in the app. The app records no content, no page views and no feature usage.
No tracker loads without your permission. The market research homepage and subscription pages load the X advertising pixel after you allow optional ad measurement, and never before. It measures visits and newly confirmed purchases. See the advertising measurement notice and controls. Other first-party site measurements count downloads and the opening of permanent links. Cloudflare, which hosts the site, also gives us daily totals, such as page views and its estimate of visitors. Data retention says what is kept.
No message, reply or document is stored on a Sistine server, and we do not train AI models on your content.

What we do not claim

Compliance with HIPAA or any other regulation, or the removal of every name. Nothing is scrubbed from what you type before it leaves your Mac; it goes as typed.
That the model cannot know who you are. It knows what you type. Type your name and it has your name.
That images, web searches or tools are sealed. Private cloud seals the text of a chat turn. An image goes only to a model on your Mac or your network; a search goes as words to our search service and Brave; a link the model opens, an event it adds or a Shortcut it runs carries the text the model wrote, after you approve it.
That there is no metadata. Whoever carries a connection sees that it happened, when, from which address and how big it was; the section above names each of them.

Data retention and deletion

What our services keep, and for how long:

Our relay: your identifier for it, current plan, subscription state, and the dollar amount of sealed use in the current period, which is the meter that enforces your allowance. Message content is not stored, and could not be read if it were: it arrives as ciphertext. When a free trial is offered, a count of trials per connection is kept for 30 days, keyed by a hash of your IP address under a key we throw away monthly rather than by the address itself.
Search: counts of searches per search identifier (up to 35 days) and per connection (about a day, keyed by a hash we throw away daily). Queries are not stored.
Feedback: 120 days.
This website: counts of downloads per day and per file (for each app, a new download or an app update), and of the permanent links (/download, /downloads, /download/sistinegpt, /download/path, /app and /pricing) opened each day from a phone or a computer; and one row a day of totals: visitors as Cloudflare estimates them, downloads, update checks and a few business totals of our own, such as paying subscribers. Both are kept for two years, and nothing in them says who downloaded. Cloudflare, which stores the download counts, keeps 30 days of earlier versions of them for recovery, from which the time of each count could be worked out; we do not read it.
Launch mailing list: your email address, until the mailing is sent or you ask for removal.
From earlier versions of the app: records the pages that left created, some of them kept until you ask us to delete them. Data from earlier versions lists them and how to have them removed.

To delete local data, use Settings → Privacy, or remove the app and its Application Support folder.

Children

The app is not directed at children under 13 and we do not knowingly collect their information.

Changes and contact

If this policy changes materially, the updated version ships with the app update and is posted here. Questions: support@sistine.ai.

Terms · Privacy · Proof · Refunds · Hosting · @sistineai