Nativr Privacy Policy
Nativr is an independent project operated by Zile Wu, contactable at hello@nativr.app.
Nativr is a macOS app that rewrites selected text into natural English. This policy explains exactly what happens to that text.
Two rules cover almost everything:
- Text you polish is processed and forgotten. It is never stored by us and never written to any log.
- Text you submit as a feedback report is stored — and only ever after you explicitly choose to share that report.
Everything below is detail on those two.
1. When you polish text
When you press the Nativr shortcut or click the ✦ polish button, the selected text is sent over an encrypted connection to Nativr's server, which forwards it to Anthropic's Claude API, gets the rewritten version back, and returns it to your Mac.
We do not store it. The text exists in memory for the seconds it takes to process the request and is then gone. There is no database of your polishes, no archive, no backup.
We do not log it. Our server writes one diagnostic line per request. That line can only contain a fixed list of technical fields — a random request id, a timestamp, which route was called, the HTTP status, how long it took, how many bytes the request was, and the first 8 characters of a one-way hash that identifies your device. The text itself, and anything derived from it, is prohibited from those logs. We test this: automated checks send text containing marker strings through every path, including error paths, and the check fails if a marker appears anywhere in the logs.
Anthropic processes it too. To rewrite your text, we must send it to Anthropic's API. Their handling is governed by their own terms and privacy policy. We do not control Anthropic's retention.
Cloudflare carries it. Our server runs on Cloudflare, which processes the request in transit as our infrastructure provider.
2. When you send a feedback report (👎)
Nativr has a 👎 button in its preview panel, and a 👎 Report Last Polish… item in its menu bar. Both exist so you can tell us a rewrite was wrong, and both behave identically to everything below.
Nothing is sent unless you choose to send it. Clicking 👎 shows a prompt asking whether to share that report (unless you've chosen "Always share"). The prompt shows you the report itself — the text you selected and the rewrite Nativr produced — and links to this page, which lists in full what is included. It gives you three choices:
- Always share — this report and future ones are sent automatically.
- Share this time — only this report is sent; you will be asked again next time.
- Not this time — nothing happens. No report is uploaded, and no copy is kept on your Mac. Declining is a decline, not a setting; it stores nothing at all.
What a shared report contains, in full:
- the text you had selected
- the rewrite Nativr produced
- the mode (Auto or Pro), the app context (chat, email, AI prompt, or default), and whether the rewrite came from our fast model or the fallback
- when it was captured, the app version, and, where available, an identifier for which version of our rewriting instructions produced it
What it never contains: your name, your email, any account or user id, any device identifier in the report itself, and any of your other messages or text — only the one rewrite you flagged.
How long we keep it: up to 90 days. Reports are stored write-once and are never modified.
Before that, we may turn a report into a test case in our private test suite, so the same mistake can be caught in future. That test case keeps the text you flagged — it is not anonymous, and we do not claim it is. It is held in the same private repository as the rest of our test suite, is never published, and is covered by the deletion promise below.
A test case has no expiry, and the 90 days above does not cover it. The 90 days applies to the stored report. A test case exists to stop a mistake coming back, which it can only do for as long as we keep running it — so we keep it for as long as we maintain the test suite. Asking us to delete your data deletes the test case too (see "Deletion and access").
Where it is stored: reports are stored on Cloudflare's infrastructure and may be processed outside your country. Our AI provider, Anthropic, may also process requests outside your country.
Legal basis: shared reports are stored based on your explicit consent — the choice you make in the prompt above. You can withdraw it for future reports at any time (see "Changing your mind"), and ask us to delete past ones (see "Deletion and access").
Changing your mind: if you chose "Always share", you can switch back to being asked each time at any point, from Nativr's menu bar under Feedback Sharing. There is no permanent, irrevocable consent.
Your local copy: shared reports are also written to a file on your own Mac, at
~/Library/Application Support/Nativr/captures.jsonl. The menu item Reveal
Captures in Finder opens it. It is your file — you can read or delete it whenever you want,
and deleting it does not affect the app.
Deletion and access: email us at hello@nativr.app and we will delete the reports sent from your device and any test case we derived from them. You can also ask what reports we hold from your device. We can do both precisely because each stored report carries a one-way hash of your device token in its storage metadata.
3. Your invite code and device token
Nativr's beta is invite-only. Redeeming an invite code gives your Mac a device token, stored in your macOS Keychain. That token is how our server knows a request is from a real tester and applies usage limits.
There is no account. We never ask for your name, email, or any personal detail, and the token is not linked to one. In our logs the token appears only as the first 8 characters of a one-way hash — never the token itself.
What we hold about your device. Our server keeps one record per device, and this is all of it: a one-way hash of your token, counts of how many requests it has made (which is how usage limits are applied), and whether the token is still valid. No text, and no personal detail of any kind. These records are kept for the life of the beta.
4. What stays on your Mac and is never sent
- Usage counters. Nativr keeps anonymous counts on your Mac — how many polishes were applied, dismissed, retried, and similar. These are counts only, never text, and they are never transmitted. The menu item "Copy Usage Stats" copies them to your clipboard so you can choose to paste them into a bug report. Nothing sends them automatically.
- Your settings (mode, preview preference, and so on).
- Anything you never flagged. No copy of your text is written to disk unless you share it. The most recent rewrite is kept in memory only so you can report it; it is replaced by the next one and never written down.
5. Permissions Nativr asks for
Nativr needs macOS Accessibility permission to read your selected text and paste the rewrite back in place. This is used only at the moment you invoke it. Nativr does not monitor your keystrokes, does not read your screen, and does not run in the background collecting anything.
6. What we never do
- We do not sell or rent your data.
- We do not use your text to train models.
- We do not run third-party analytics, advertising, or tracking of any kind.
- We do not store your polished text, ever — only feedback reports you explicitly chose to share, and test cases derived from those reports.
7. Children
Nativr is not directed at children under 13, or the minimum age required in your country, and we do not knowingly collect their data.
8. Changes to this policy
If this policy changes in a way that affects what we collect or store, we will update this page and change the effective date above. A change that would broaden what we store will not be applied retroactively to data already collected under an earlier version.
9. Contact
Questions, deletion requests, or anything else: hello@nativr.app.