Privacy Policy

1. How Caret Works

Caret runs as an input method on macOS. It registers as an input source so it can detect which text field you are typing in.

When you trigger a completion, Caret reads the accessibility tree of the active application to understand the context on screen. This context is sent through our proxy server to third-party AI model providers (such as Google, Cerebras, OpenAI, and Anthropic) to generate a text completion, which is then typed into the text field. Your data is never sent directly from your device to these providers.

Accessibility data and typing context are processed in real time and are not stored on our servers beyond the duration of a single request. You control whether Caret retains completion data through the "Completion Feedback" setting. When disabled, no completion data is retained beyond a single request.

Caret also builds a local memory of you and relevant entities (people, organizations) it detects on screen. Entities are identified on-device using a local AI model. Definitions for those entities are then generated by the third-party AI model providers listed above.

2. Data We Collect

Account Data

When you sign in with Google, we receive and store:

• Your Google email address
• Your display name
• Your profile photo URL

Account data is used for authentication and to associate your usage with your account. We use Supabase for authentication, and your session credentials are stored securely in the macOS Keychain on your device.

Usage Data

We collect basic product analytics to understand how Caret is used. These events are routed through our server to PostHog, a third-party analytics provider. Usage events include:

• App launched, sign-in, and sign-out events
• Tab completion triggered (with metadata such as whether a cached completion was used)
• Feature flag evaluations

Usage events are associated with your account ID. We do not record the content of your completions or what you type as part of standard analytics.

Completion Feedback Data

Caret can collect data about completions to help improve the Service. This includes:

• The generated completion text
• The text field content at the time of feedback
• Whether you accepted, rejected, or modified the completion
• Timing and interaction details (e.g., delay before action, number of deletes)
• The app name where the completion occurred
• The prompt context used to generate the completion (the screen context around your cursor)

You can turn this off at any time in Settings. When disabled, none of this data is retained. Caret may still collect basic usage statistics such as whether a completion was triggered.

Crash and Error Reports

We use Sentry to collect crash reports and error diagnostics. This includes:

• Stack traces and error messages
• Your account ID and email (for error attribution)
• Device and OS metadata
• Performance traces for completion and hint generation

Crash reports help us identify and fix bugs. They do not contain the content of your text fields or completions.

Local Data

Caret stores certain data locally on your Mac that is never sent to our servers:

• Entity store: Names and short descriptions of people and organizations Caret detects on screen, used to improve completion relevance. Stored in a SQLite database locally on your computer.
• User profile: Description of you that Caret uses to make completions have relevant context about you.
• Preferences: Your shortcut settings, overlay position, and feature toggle states.
• Session credentials: Your authentication session, stored in the macOS Keychain.

3. How We Use Your Data

We use the data we collect to:

• Provide the Service: Generate and deliver text completions based on your current typing context.
• Authenticate you: Manage your account and session.
• Improve Caret: Analyze usage patterns, diagnose errors, and improve completion quality (when you opt in to feedback storage).
• Evaluate features: Determine which features are enabled for your account via feature flags.
• Communicate with you: Send service-related notifications (e.g., updates).

4. Third-Party Services and Sub-Processors

We use the following third-party services to operate Caret:

All AI model requests are routed through our Cloudflare Worker. API keys for AI providers are stored server-side and never touch your device.

5. Data Retention

• Account data is retained for as long as your account exists.
• Usage analytics are retained according to PostHog's standard retention policies.
• Completion feedback data is retained for as long as your account exists, or until you request deletion. You can manage this through the "Completion Feedback" setting in Settings.
• Crash reports are retained according to Sentry's standard retention policies.
• Local data (entity store, preferences) remains on your device until you uninstall Caret or manually delete it.

6. Data Deletion

You may request deletion of your account and all associated data by contacting us at support@trycaret.com. Upon receiving a verified deletion request, we will:

• Delete your account and authentication data from Supabase
• Delete any stored completion feedback data
• Request deletion of your data from PostHog and Sentry

Local data on your device can be removed by uninstalling Caret and deleting the local memory files.

7. Security

We take reasonable measures to protect your data:

• All network communication between the app and our server uses HTTPS/TLS encryption.
• Authentication sessions are stored in the macOS Keychain (hardware-backed on supported Macs).
• API keys for AI providers are stored as encrypted secrets on Cloudflare and never sent to client devices.
• Server-side JWT verification ensures only authenticated users can access the Service.
• Completion feedback data is scoped to your account and cannot be accessed by other users.

8. Cookies and Tracking

The Caret macOS application does not use cookies or web-based tracking technologies.

Our website at trycaret.com uses PostHog for analytics, which may set cookies to understand how visitors interact with the site. These cookies collect anonymous usage data such as pages visited, referral source, and session duration. No data from the Caret application is linked to website cookies.

You can manage or block cookies through your browser settings.

9. Children

Caret is not intended for use by anyone under the age of 18. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us at support@trycaret.com and we will delete it.

10. Your Rights and Choices

• Completion feedback: You control whether completion data is retained through the "Completion Feedback" setting in Settings. When disabled, none of your completion data is stored.
• Sign out: You can sign out at any time from Settings, which stops all data collection.
• Uninstall: Removing Caret from your Mac stops all data collection. You can also remove local data.
• Data deletion: You can request deletion of your data by contacting us (see Section 6).
• Accessibility permission: Caret requires macOS Accessibility permission to function. You can revoke this at any time in System Settings, which fully disables Caret's ability to read screen content.

If you are a California resident, you may have additional rights under the CCPA, including the right to know what personal data we collect and the right to request deletion. Contact us to exercise these rights.

11. Changes to This Policy

We may update this Privacy Policy from time to time. If we make material changes, we will notify you through the application or by other reasonable means. The "Effective Date" at the top of this policy indicates when it was last revised.

12. Contact Us

If you have questions about this Privacy Policy or want to exercise your data rights, contact us at:

Caret Ops, Inc.
support@trycaret.com