← Back to homepage

Where your data lives

Kajuto is not 100% local — and this page shows completely and honestly: what stays on your Mac, what goes out, when, why, and to whom.

Stays on the Mac

  • → All scores and reports — as an open cache in .pumuckl right inside each repo (the open format is still historically named .pumuckl; readable, diffable, no lock-in)
  • → Finds (links/notes via ⌘⇧M) including embeddings — on-device via Apple NaturalLanguage, local SQLite DB
  • → Portfolio knowledge (capabilities/RAG), favorites, parked state, rekindled stamps
  • → Morning-greeting engagement learning (what you open, what you dismiss)
  • → Settings and watch-folder configuration
  • → Storage map and security check: with the Full Disk Access you grant, Kajuto reads folder sizes and macOS's permission databases — sizes and entries only, never contents, and none of it leaves the Mac

Goes out — and where to

  • · AI scoring (triage & deep analyses): project context — README, package manifest, git-log summary — goes to the AI endpoint of your choice. Default: Claude Code (Anthropic) through your own subscription via claude -p. Alternatives: any OpenAI-compatible endpoint or DeepSeek via jcode. Straight from your Mac, no moinsen.dev server in between.
  • · GitHub API: inventory, archiving, deleting, and cloning run through the gh CLI — with your own gh login. Kajuto never sees a token.
  • · Links you share yourself: when you save a link as a find or a Zuruf, your Mac fetches exactly that page (for YouTube: title, channel and description from youtube.com) so the AI knows what it is about.
  • · Web search for Zuruf tasks without a project: Claude runs the search (at Anthropic); only the sentence you said goes along — no project knowledge, no code.
  • · iCloud (only with the iPhone and Watch app): Zurufe travel to the Mac through your own private iCloud database. Apple stores them in your account; we never see them.
  • · Cloudflare API (only with your Cloudflare login): If you are signed in to Wrangler or keep a key in your password vault, a helper reads visitor counts, errors and settings of your domains and Workers once a day and on request. Changes happen only after your click. Kajuto stores no key; the results stay on your Mac.
  • · TesterPayKit (only when you start it): when you send a report through “Feedback…”, it goes to TesterPayKit with a screenshot. Without that click, no connection (from version 1.3.1; up to 1.3.0 the app opened a test session at launch and reported scan errors). On the iPhone, “Report a Bug…” sends your text with device model, system version, language and app version: no screenshot, no session, no usage data, no device identifier. Testers in TestFlight can switch on a report button that runs a test session; the App Store version has no such switch.
  • · Nothing else. No analytics endpoint, no license server, no crash reporting.

Deliberately not built

  • No telemetry. Not even "anonymous usage statistics". Not crash reports either (Sentry or similar would be opt-in, if ever).
  • No accounts. No Kajuto login. There is nothing you could sign up for with us.
  • No analytics. No Google Analytics, no Plausible, nothing on the landing page beyond Cloudflare edge request logs.
  • No remote feature flags. What you installed is what's in the binary.
  • No Kajuto cloud. We can't sell or lose what we never have.

For compliance officers & data protection officers

GDPR Art. 28 (data processing on behalf)

Kajuto as a vendor does not process personal data of your employees on behalf of a controller. The software runs on the user's device; there is no Kajuto-side server processing.

Important and honest: for AI scoring, project content (README, manifest, git-log summary) is transmitted to an AI endpoint. Which one is configured by the user (default: Claude Code by Anthropic through the user's own subscription via claude -p; alternatively OpenAI-compatible or DeepSeek via jcode). Whether a DPA is required depends on the chosen endpoint provider — check their terms. GitHub access runs through the gh CLI with the user's login; the GitHub terms you already have apply.

EU AI Act Art. 50 (transparency obligations)

Kajuto is not a "provider" of an AI system within the meaning of EU Regulation 2024/1689 (EU AI Act). The models used are provided by their respective vendors (Anthropic, DeepSeek, or whichever OpenAI-compatible provider you configure).

Kajuto is an interface to these models, not a model provider. Transparency and labelling obligations under Art. 50 fall on the respective model providers. The software itself classifies as a non-high-risk AI system (no area listed in Annex III).

Note: The statements above are the vendor's legal assessment based on current regulation texts. They do not replace your organisation's own legal review. Questions: [email protected]

How to verify it yourself

This page describes intent. If you want to verify:

  • Open Activity Monitor → Network while using Kajuto. Outbound should be exclusively your configured AI endpoint and api.github.com (via gh) — plus iCloud if you use the iPhone app, and the pages of links you share yourself.
  • Set Little Snitch to "ask on every connection". Kajuto should only request the destinations listed above, each of them only once you start it.
  • Read the .pumuckl files in your repos — it's your data in an open format, and you can trace every score.
→ Privacy Policy → Trust: four honest answers → GitHub: Issues & Discussions