Cogitae Privacy Policy

Summary

Cogitae is designed to keep your data under your control.

• Your conversations, files, prompts, and API keys are not sent to BitArts.
• Content you send to an AI provider goes only to the provider you configured.
• Most app data is stored locally on your devices.
• BitArts stores limited licensing data so trials and purchases can work.
• For macOS ↔ iPhone relay, encrypted data passes through BitArts servers, but BitArts does not have the keys needed to read it.
• Logs on BitArts servers are deleted after 3 days.

What Cogitae stores locally

Cogitae stores most working data on your Mac or iPhone, not on BitArts servers. Depending on the features you use, this may include:

• conversations and message history
• summaries, branches, and conversation metadata
• workspace references and file access permissions granted through macOS
• app settings and preferences
• AI provider configuration, including API keys you enter
• token usage or cost information shown to you inside the app

This local data is used to make the app work for you. It is not uploaded to BitArts as part of normal use.

What is sent to AI providers you configure

When you use Cogitae with OpenAI, Anthropic, Google, or any other provider you choose, the content needed to fulfill your request is sent to that provider on your behalf.

This can include:

• prompts and chat messages
• conversation history needed for context
• files or extracted file content you choose to provide
• tool outputs or other context included in a request

Those providers process your data under their own terms and privacy policies, not BitArts’. If you use local models, your data may remain entirely on your own device, depending on your setup.

What BitArts stores for licensing

When you start a trial, purchase a license, or activate Cogitae, BitArts stores limited information required to manage licensing.

This includes:

• your license key and related metadata, such as license type, creation date, and expiration date if applicable
• a cryptographic hash of your email address, not the email address itself
• device information used for activation management: a hardware identifier, the device’s name (such as “Jane’s MacBook Pro”), its model, and its OS version

BitArts does not store your actual email address, name, conversations, prompts, files, or AI provider API keys as part of the licensing system.

BitArts also does not store IP addresses in licensing records. During email verification a non-reversible hash of your IP address is used for rate limiting and is discarded within a day.

Because BitArts does not store your actual email address, you should keep track of the email you used when obtaining a trial or license. To recover a license, you enter that same email address; its hash is matched, and the key is sent to the address you entered.

Verification codes and license keys are emailed from BitArts’ own mail server, not a third-party email service. Your address is used to send the message and is not stored, although the mail server’s log records the recipient, like the other logs below, for 3 days.

BitArts also keeps an activity log of licensing events — such as a verification code being sent, a license being created, or a device being activated — tied to a license rather than to a person. Where an email is involved, only its domain is recorded, never the address.

Payments

Purchases and relay subscriptions are processed by Stripe. Your card details and billing information go to Stripe directly and are never received or stored by BitArts.

What BitArts stores alongside your license is limited to what is needed to match a payment to a license and to manage a subscription:

• payment and subscription identifiers issued by Stripe
• the amount paid and the currency
• for relay subscriptions, the plan, its status, and the current billing period
• a record of each notification Stripe sends about a payment, with the buyer’s email, name, address and phone removed, and tied to your license by the same hash of your email address

Stripe processes your payment information under its own terms and privacy policy, not BitArts’. If you contact Stripe or ask BitArts to look up a payment, the information Stripe holds — which may include your name and email address — is governed by Stripe’s policy.

What the app sends to BitArts

Besides licensing, Cogitae contacts BitArts servers for a few features. None of these requests carries your conversations, files, prompts or API keys.

BitArts records which license downloaded or installed which plugin and version, and which news items were shown or dismissed.

iCloud

Cogitae uses your own iCloud account, which Apple holds, not BitArts:

• The Mac writes your license key to iCloud key-value storage so the iPhone app can activate itself.
• Remote messages between your devices can be stored in your private iCloud database.

Notifications to the iPhone

When your Mac sends something while the iPhone app is closed, BitArts asks Apple to wake the app with a silent notification. The notification carries no content; the app then fetches the encrypted message through the relay. BitArts stores the notification token Apple issued for your iPhone, tied to your license, until the app stops using it.

macOS ↔ iPhone relay

Cogitae can relay conversation data between your Mac and iPhone.

For this feature, encrypted data passes through BitArts servers so your devices can exchange information. The data is encrypted on your device before transmission and decrypted on your device after receipt. BitArts does not have the keys required to decrypt that relay content.

While one device is offline, the relay holds up to 64 encrypted messages for it in memory, never on disk, and loses them if it restarts. The relay’s log records when each device connects and disconnects, identified by a short hash of the license key rather than the key itself.

The one exception is demo mode, where the iPhone app connects to a simulated desktop running on a BitArts server instead of to a Mac of yours. In that case the server is the other end of the conversation and can read what you send it. Demo mode uses sample data only — no Mac of yours is connected, and no real conversation passes through it.

What BitArts does not collect in normal app use

BitArts does not receive, store, or review the following as part of normal use of Cogitae:

• your conversations or prompts
• your files or workspace content
• your AI provider API keys
• your message history
• your model responses

The main exceptions are limited licensing data and encrypted relay traffic used for device-to-device features.

Other services the app contacts

Some features contact services other than your AI providers and BitArts directly from your device. BitArts does not see these requests.

• Academic search sends the search text to arXiv, Semantic Scholar, OpenAlex and Crossref when the AI uses that tool.
• MLX models are searched for and downloaded from Hugging Face when you ask for them.
• MCP servers can be found through the public MCP registry when you browse it.
• Web pages and images: the web tool fetches the pages the AI chooses, and images linked in a conversation are loaded from their own sites.

Cogitae contains no analytics, crash reporting or advertising code.

This website

cogitae.ai counts visits with Umami, a privacy-focused analytics tool hosted by BitArts. It uses no cookies and does not store your IP address; it records the page, the referring site, your browser, operating system and device type, and your approximate location (country, region and city).

Data retention

Logs on BitArts servers are deleted after 3 days. These are the services’ own logs, the web servers’ access logs (which record your IP address, the page requested and your browser), and the mail server’s log.

Database backups are kept for 7 days.

Licensing data may be retained for as long as needed to support license verification, recovery, fraud prevention, and related business records.

If you ask for deletion of your licensing data, BitArts can delete the associated records, but doing so may invalidate your license or prevent future recovery.

To request deletion of licensing data, contact privacy@bitarts.us.

Security

BitArts aims to minimize the amount of data it receives in the first place.

• Most application data stays local to your devices.
• AI requests are sent directly to the providers you configure.
• Licensing uses a cryptographic hash of your email address instead of storing the email address itself.
• Relay content between devices is encrypted before it passes through BitArts servers.

No system can promise perfect security, but Cogitae is designed to reduce central collection wherever possible.

Children’s privacy

Cogitae is not directed to children under 13, and BitArts does not knowingly collect personal information from children through the app.

If you believe a child has provided personal information to BitArts in connection with Cogitae, contact privacy@bitarts.us.

Changes to this policy

This policy may be updated from time to time. When it changes, the updated version will be posted on this page and the “Last updated” date at the top will change.

Contact

If you have privacy questions about Cogitae or BitArts’ data practices, contact:

privacy@bitarts.us

Last updated September 28, 2026