Legal
Privacy policy
In short: Deixis has no account and no server. Everything the app records stays on your Mac. Only what you send yourself leaves it, to a target you pick yourself.
1. Controller
The controller responsible for data processing under the General Data Protection Regulation (GDPR) is:
Daniel Boberg
Klinkerwerkstraße 8
32549 Bad Oeynhausen
Germany
Email: post@danielboberg.de
No data protection officer has been appointed because the legal requirements for one are not met. Where “we” is used here, it means the controller named above.
2. The Deixis app
2.1 No account, no server
Deixis has no user accounts and no server. We run no infrastructure that the app sends data to, and the app itself sends us no usage data, crash data or content. Only if you allowed it in macOS does Apple pass us crash reports without names (section 2.9). The app contains no analytics, advertising or tracking tools. You are responsible for the data you capture with Deixis, including personal data of third parties that is visible on your screen. We do not process it on your behalf because we never receive it.
2.2 Microphone and speech recognition
While you hold the trigger key or a hands-free recording runs, Deixis records your voice through the microphone. Speech recognition runs on the Mac with the speech models of macOS. Your speech is not sent to us or to any server for it. The audio stays on this Mac and only until delivery. The microphone never opens unnoticed: recording is tied to the edge light and the status icon in the menu bar, and a hands-free recording ends by itself after three minutes without speech or pointer movement. The microphone is optional: without this permission Deixis works fully with pointing and typing.
2.3 Screen recording and input monitoring
For each point, Deixis uses macOS screen capture to take an image of the window under the pointer and reads the text in it with the text recognition of macOS. Both happen on the Mac. Deixis needs input monitoring only to see whether the trigger key is held and whether another key or Esc is pressed meanwhile. Which key that is is not evaluated beyond that. Keystrokes are neither stored nor passed on. If you decline input monitoring, Deixis uses a key combination that you hold instead.
2.4 Where the data lives
Points, rounds, images, texts and history live in a database in the app’s protected container and in the App Group AY9VQ7X6DM.app.deixis on your Mac. Only Deixis, the bundled Safari extension and the bundled helper process for AI agents can access it. The history stays local and is searchable only by you. Deixis writes export files only to folders you granted access to once.
2.5 What happens when you send
Deixis sends something only when you send a round, and only to the target you choose for it: a session of an AI agent on your Mac (such as Claude Code, Codex or Cursor), a folder, the pasteboard or another app such as Slack, Notion, Messages or Mail. What happens to the data there is governed by the privacy terms of that target. When sending to people and third-party apps, Deixis redacts email addresses, keys, tokens and card numbers by default. You see the redaction beforehand and can lift it for that delivery. For AI agents on your Mac and the local folder it is off by default.
2.6 AI agents (Claude Code, Codex, Cursor and others)
When you connect an AI agent to Deixis (such as Claude Code, Codex, Cursor or VS Code), that agent starts a helper process that ships with the app. It talks to the agent only over standard input and output and to Deixis through the shared local storage. It needs no network connection. Deixis remembers the agent’s name and the session’s project folder so you can send rounds to the right session. What the agent does with a round it receives depends on your settings there and on the terms of its provider. We are not responsible for that.
2.7 Browser extensions
The Safari and Chrome extensions are optional. When Deixis asks, they read the address, the title, the element under the pin, console errors and failed requests of the last 30 seconds and the most recent clicks. These events stay in the browser’s memory. Nothing is stored or sent until you create a point, and never the content of an input field. The Safari extension exchanges data with the app through the App Group. The Chrome extension talks only to the local app over your Mac’s loopback address 127.0.0.1. You confirm the first connection once in Deixis. Neither extension sends anything to the internet.
2.8 Apple Intelligence
If your Mac supports Apple Intelligence, Deixis uses the on-device language model to split sentences into separate points. Processing happens on the Mac. Without Apple Intelligence, Deixis uses simpler rules.
2.9 Purchase and crash reports through Apple
Apple handles purchase, payment and restore in the Mac App Store. Apple processes that data as an independent controller. If you allowed sharing crash reports with developers in macOS, Apple may provide us with reports without names. We use them only to fix bugs.
2.10 Deleting
When you delete Deixis from the Applications folder, macOS removes the app. The data remains in the folders ~/Library/Containers/app.deixis.mac and ~/Library/Group Containers/AY9VQ7X6DM.app.deixis. Move both to the Trash to delete it. You delete rounds you already sent at the respective target.
3. This website
3.1 Hosting
The website consists only of static files and is delivered through the network of Cloudflare, Inc., 101 Townsend St, San Francisco, CA 94107, USA (Cloudflare Workers). We do not run a server of our own for it. When a page is requested, Cloudflare processes technically necessary data: IP address, date and time, requested address, referrer, and browser and operating system. This is necessary to deliver the pages and to protect the website against attacks and abuse. The legal basis is our legitimate interest in a secure and available website under Art. 6(1)(f) GDPR. We do not store any server logs ourselves and use neither log export nor Cloudflare’s counting script. How long Cloudflare keeps data for operating and securing its network is governed by Cloudflare’s privacy policy. A data processing agreement under Art. 28 GDPR is in place with Cloudflare. Data may be transferred to the USA in the process. This is based on the European Commission’s adequacy decision on the EU-U.S. Data Privacy Framework of 10 July 2023 (Art. 45 GDPR), under which Cloudflare is certified, and in addition on the standard contractual clauses in the data processing agreement (Art. 46(2)(c) GDPR).
3.2 No cookies, no tracking, no external content
The website sets no cookies, stores nothing in your browser and counts no visitors. It loads no fonts, scripts, images or other content from other servers.
4. Contact by email
When you write to us, we process your email address, your name and the content of your message to answer your request. The legal basis is Art. 6(1)(b) GDPR if it concerns a purchase or the use of Deixis, otherwise our legitimate interest in answering under Art. 6(1)(f) GDPR. We delete the messages once the matter is settled and no statutory retention duties apply.
5. Recipients at a glance
- Cloudflare, Inc., USA: delivery of this website. Processor under Art. 28 GDPR, transfer to the USA as described in section 3.1.
- Apple: purchase, payment and crash reports, each under Apple’s own responsibility.
- The target you choose when sending: under your own responsibility (section 2.5).
There are no other recipients. We do not sell data and do not pass any on for advertising.
6. Retention
Deixis keeps data in the app on your Mac until you delete it (section 2.10). Emails that are part of a business transaction, such as a purchase or a refund, we keep as long as commercial and tax law require (six years for business letters, eight years for emails that serve as accounting records, under section 147 of the German Fiscal Code).
7. Do you have to give us data?
No. Deixis works without you giving us any data. Emails to us are voluntary. Without an email address, however, we cannot reply to you.
8. Your rights
You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18) and data portability (Art. 20). You can withdraw any consent you have given at any time with effect for the future (Art. 7(3)). To do so, write to the address in section 1. For data that Apple processes as an independent controller for purchases and crash reports, contact Apple directly.
Right to object: where we process data on the basis of legitimate interests (Art. 6(1)(f) GDPR), you can object to this processing at any time on grounds relating to your particular situation (Art. 21 GDPR). We then no longer process the data unless we can demonstrate compelling legitimate grounds that override your interests, or the processing serves the establishment, exercise or defense of legal claims.
You can also lodge a complaint with a data protection supervisory authority (Art. 77 GDPR), for example where you live or with the authority responsible for us: State Commissioner for Data Protection and Freedom of Information of North Rhine-Westphalia, Kavalleriestraße 2 to 4, 40213 Düsseldorf.
9. No automated decision-making
We do not make automated decisions within the meaning of Art. 22 GDPR and do not create profiles.
10. Changes
We update this policy when the app, the website or the law changes. The version published here applies. The date at the top shows when we last changed it.