Effective September 14, 2026 (supersedes the September 1, 2026 version) · OnyxLinc LLC, doing business as SecureOffline.ai (“we,” “us”) · Contact
The short version. The SecureOffline applications are built so that your conversations, documents, voice, and answers stay on your device. They contain no analytics, no telemetry, and no account system, and the only connection they make is the download of AI model files you choose. What we do hold is the small amount of commerce data needed to sell and support the Mac app on secureoffline.ai — and Apple, not us, handles App Store purchases. This policy explains all of it.
This policy covers secureoffline.ai (the “Website”), the SecureOffline application for macOS, and the SecureOffline application for iPadOS and iOS (together, the “Applications”), and the license, download, and support services behind them. It does not cover Apple’s App Store, Stripe’s checkout, or other third-party services, which have their own policies; we name them below where they touch your data. Capitalized terms not defined here (User Content, Output, Model, Device Data) have the meanings in our Terms of Sale & Use, which this policy forms part of.
This inventory is organized by where data is held, because that is what determines who can see it. It also matches the “Data Not Collected” privacy label for the iPad and iPhone application in the App Store.
2.1 On your device only (never sent to us).
None of this reaches OnyxLinc. The Applications contain no analytics, crash reporting, advertising, or telemetry code, and they make no network connection during use. You can verify this with any network monitor; our Trust page explains how.
2.2 What an Application sends when you download a Model or voice pack. When you choose to download a Model or voice pack, the Application makes an ordinary file request to the hosting server. Like any web request, that transmits your IP address, the file requested, and a user-agent string, which appear in the host’s standard server logs. For Models, the host is our content network (models.secureoffline.ai, served by Cloudflare). For the Mac application’s optional voice pack, the speech-recognition and text-to-speech files are downloaded from their publishers’ public release sites — Hugging Face and GitHub — under those sites’ privacy policies. No identity, license key, account, or content is included in any download request, and we do not link download logs to purchasers.
2.3 Held by Apple (App Store purchases). If you buy the iPad and iPhone application, Apple processes the transaction under its own privacy policy: your Apple Account, payment method, receipt, and purchase history are Apple’s records. We receive aggregate sales reports from Apple that do not identify individual purchasers. We do not receive your name, email address, or payment details from an App Store purchase.
2.4 Held by us (Website and Mac purchases).
We collect no other personal information, and we do not buy data about you from anyone.
On the Mac, the Application stores Device Data in your user account’s application-support folder. On iPad and iPhone, it stores Device Data inside the Application’s private sandbox, where iOS encrypts it at rest whenever a passcode is set. In both cases the Application relies on the device’s own protections — your passcode or password, FileVault on the Mac, operating-system updates, and physical control of the device — rather than adding a separate encryption layer of its own. The Application keeps no server-side copy or cache of anything. If a device is lost, stolen, or shared, the Device Data on it may be exposed and cannot be recovered or remotely wiped by us; use your platform’s own tools (Find My, remote erase) for that. Deleting the Application deletes its Device Data.
4.1 In the Applications. User Content is processed by the Model on your device to produce Output, and both are stored on your device for your later use. That is the whole pipeline. We do not use User Content or Output for anything, because we do not have it — not for marketing, not to improve the product, and not to train any model. The Applications make no automated decisions about you.
4.2 Commerce and support data. We use the data in Section 2.4 to deliver and support what you bought, issue keys and refunds, send the material you requested, answer your messages, keep legal and tax records, prevent fraud and license abuse, and comply with law. We do not use it for profiling, and we do not sell it or share it for advertising.
4.3 The Website’s one tag. secureoffline.ai uses one third-party tag: Google’s ads-measurement tag (gtag.js), which sets cookies solely so we can measure whether visits and trial downloads came from our own advertising. We do not use it to build remarketing or advertising audiences, your Application content is never involved, and the tag is not loaded at all when your browser sends the Global Privacy Control signal or blocks third-party cookies. Beyond that tag there are no analytics profiles and no fingerprinting trackers. Public forms are protected by Cloudflare Turnstile, which evaluates the request to distinguish people from bots and receives only what that requires.
4.4 De-identified data. We may use aggregate, de-identified information — such as how many licenses were sold in a month, or how many visitors reached a page — to run the business. We do not attempt to re-identify it.
| Data | Where | Kept for |
|---|---|---|
| User Content, Output, conversations, Models, settings, trial state | Your device | Until you delete them or uninstall the Application. We hold no copy. |
| App Store purchase records | Apple | Per Apple’s policy. Our aggregate sales reports: 7 years (tax and accounting). |
| Order and license records (Mac) | Us (Cloudflare license service, Railway database) | While your license is active, then up to 7 years for tax and accounting law. |
| Payment records | Stripe | Per Stripe’s policy; our copy of receipts, 7 years. |
| Consent records | Us | As long as needed to prove the agreement — generally while you hold a license and for the limitation period afterward. |
| Support and contact correspondence | Us (Zoho mailbox) | 3 years after the last message, unless needed longer for a dispute or a legal obligation. |
| Guide, newsletter, and waitlist signups | Us (email provider) | Until you unsubscribe or ask us to delete them; unconfirmed contact-form messages are purged after 30 days. |
| Download links | Us | Expire after 7 days. |
| Website and download server logs | Cloudflare, Railway | Short-lived (days to a few weeks), then routinely deleted. |
| Google ads-measurement cookies | Your browser | Per Google’s cookie durations; not set at all under Global Privacy Control. |
Deletion requests. Email [email protected] with the subject “Delete my data,” and we will delete what the law does not require us to keep and confirm when it is done. Legal hold: if a dispute or legal proceeding is pending or reasonably anticipated, we suspend deletion timelines for the affected records until the matter is resolved, as permitted or required by law.
We do not sell personal information, and we do not share it for advertising. We use a small number of service providers, each receiving only what its job requires:
We may also disclose information when the law requires it (a subpoena, court order, or lawful request), giving you notice where permitted and where we hold your contact details; to protect the rights, safety, or property of you, us, or others; in connection with a merger, acquisition, or sale of the business, in which case this policy continues to apply to the transferred data; or with your consent. A fuller description of what we process, our subprocessors, and security measures — written for procurement review — is in our Data Processing Statement.
The most important safeguard is architectural: the content you create in the Applications never reaches us, so the most sensitive data has no server-side copy to protect. On your device, protection depends on the device controls described in Section 3. For the limited commerce data we hold: all connections use TLS encryption; database connections are encrypted; admin access is password-hashed (scrypt), rate-limited, and session-protected; public forms are protected by Cloudflare Turnstile and rate limits; access is restricted to the people who need it; and we collect the minimum needed for each purpose. No method of storage is completely secure and we cannot promise absolute security, but we keep the attack surface small.
If a breach occurs. If we confirm a security incident affecting personal information we hold, we will notify affected people by email without undue delay — and, where practicable, within 72 hours of confirming it — describe what happened and what data was involved, and take reasonable steps to contain and remediate it, in addition to any notification the law requires. This applies to data we hold; we cannot detect or notify you of a compromise of your own device.
Wherever you live, we extend the same rights: you may ask what personal information we hold about you, ask us to correct it, delete it, or export it in a portable format, and object to or restrict how we use it, by writing to [email protected]. We will verify your request against the email address or order reference on file (we hold no other identifier), respond within 30 days, and not discriminate against you for exercising a right. An authorized agent may act for you with written permission that we can verify. If we decline a request, we will say why, and you may appeal by replying with the subject “Privacy appeal”; a different person will review it.
Device Data. Because the Applications store your content on your device and we hold no copy, you exercise access, correction, portability, and deletion for that content directly — by opening, editing, exporting, or deleting it in the Application, or by deleting the Application. There is nothing for us to produce or erase.
You may put information about other people into the Applications — clients, patients, policyholders, family members. That information stays on your device and is under your control; we do not receive, see, or process it, and we do not contact or profile the people it concerns. Any legal obligation about that information (consent, confidentiality, records retention, breach notification if your device is compromised) is yours as the person holding it, not ours.
The Applications will process whatever you enter, including health, financial, legal, and other sensitive information. All of it stays on your device. OnyxLinc is not a HIPAA covered entity or business associate, does not offer a business associate agreement, and the Applications are not medical devices and are not a substitute for professional care. If you are a covered entity or professional handling regulated information, you remain responsible for your own compliance, including the safeguards on your device.
The Applications are rated for ages 13 and up in the App Store, and purchases require a person at least 18 years old. Our products and Website are not directed to children under 13, and we do not knowingly collect personal information from anyone under 13 — the Applications collect none from anyone, and the Website collects it only in the course of a purchase or signup by an adult. If you believe a child under 13 has provided us personal information, contact us and we will delete it.
We are a United States company and our service providers process the commerce data described above in the United States. The Applications process your content only on your own device, wherever you are. Our products are offered to residents of the United States only: purchases on secureoffline.ai require a United States billing address, and the iPad and iPhone application is published only to the United States App Store. We do not target residents of the European Union, European Economic Area, United Kingdom, or Switzerland, and we do not hold ourselves out as complying with those jurisdictions’ data-protection laws. If you access the Website from outside the U.S., the information you submit will be transferred to and processed in the U.S.
If you are a resident of California (CCPA/CPRA) or another U.S. state with a comprehensive privacy law (including Virginia, Colorado, Connecticut, Texas, Oregon, Montana, and others), the rights in Section 8 are how we honor your statutory rights of access, correction, deletion, portability, and to opt out of certain processing. We do not sell personal information, we do not share it for cross-context behavioral advertising, and we do not use it for profiling in furtherance of decisions that produce legal or similarly significant effects. Our only advertising-related processing is the Google ads-measurement tag described in Section 4.3, used to measure our own campaigns. To the extent that measurement counts as “sharing” under California law, you can opt out: we honor the Global Privacy Control signal automatically (the tag is not loaded), and blocking third-party cookies has the same effect. In the twelve months before this policy’s date we collected the categories of personal information listed in Section 2.4 (identifiers, commercial information, and internet activity), from you directly and from our service providers, for the purposes in Section 4, and disclosed them only to the providers in Section 6. We do not collect sensitive personal information as defined by those laws. California residents may also request the disclosures in Cal. Civ. Code § 1798.83 (we made none). To exercise any right, email [email protected].
If this policy changes materially, we will post the new version here with a new effective date at least ten (10) days before it takes effect, email you where we have your address, and, for a change that affects the Applications, note it in the Application or its release notes; where the law requires fresh consent for a change, we will ask for it. We do not intend to weaken the core commitment in this policy — that the Applications do not transmit your content — and if that ever changed it would be a different product, disclosed as such before you installed it.
OnyxLinc LLC, doing business as SecureOffline.ai · Lee’s Summit, Missouri, United States. Privacy requests, deletion requests, appeals, and general questions: [email protected].