Privacy policy

Last updated: 7 November 2026

Summary: everything happens on your Mac. Postik has no servers, creates no accounts, sends none of your data anywhere and includes no telemetry or analytics. Its only automatic connection is checking whether a new version exists, and you can turn that off. The app mapping library (below) only connects when you press its buttons.

What data Postik handles and where it lives

Data	Purpose	Where it is stored
The text of your notes (plain and formatted)	Showing them	~/Library/Application Support/Postik/notes.json (plus rotating backups)
The URL or window title of the tab/window where you pin a note	Showing the note only in that context	Inside notes.json
Text fragments recognised by OCR (the anchor line and its neighbours)	Finding the exact spot again	Inside notes.json
Audio memos and attached files	Attachments of your notes	~/Library/Application Support/Postik/Attachments/
Imported stickers	Your personal collection	~/Library/Application Support/Postik/Stickers/
Calendar: each day's text, the expenses, earnings, habits and ratings you log, and linked notes (macOS)	The full calendar, its overview and its charts	~/Library/Application Support/Postik/calendar.json

Everything is local and in plain text inside your user folder, protected by your macOS account permissions. You can delete it all by removing the folder ~/Library/Application Support/Postik/.

What Postik does not do

• It does not send your data over the network. The only requests it makes by itself are the update check and, if you set a second currency in the calendar, the exchange-rate lookup, both described below.
• It does not keep screenshots: the images captured for OCR are processed in memory and discarded; only the chosen anchor text is kept.
• It does not log your activity or usage statistics.
• It does not access the microphone except while you record an audio memo.

System permissions and their exact use

• Screen Recording: capturing the window of the app where you anchor a note, to recognise its text with Vision (Apple’s on-device OCR).
• Accessibility: sending the scroll/click events of “jump to mark”, reading window titles, and reading the active tab’s URL in browsers without AppleScript (Firefox and similar).
• Automation (Apple Events): asking the browser for the URL of the active tab.
• Microphone: recording audio memos when you ask for it.

You can revoke any of them in System Settings → Privacy & Security; the corresponding feature turns off and the rest of the app keeps working.

Network connections

• Update check: at launch (at most once a day) and when you choose “Check for updates”, Postik downloads https://postik.sekaibuilder.com/version.json, a small text file with the latest version number. It is an ordinary GET request with no cookies, no identifiers and none of your data; the server only sees what any web visit shows (IP address and macOS version in the user agent). You can turn it off in the menu (“Check for updates at launch”). Postik never downloads or installs anything by itself.
• Exchange rate: only if you set a second currency in the calendar, Postik asks https://postik.sekaibuilder.com/api/rates for the day’s rate between your two currencies (at most once a day per pair). The request carries only the two currency codes, never your amounts, and is not recorded. The site gets the rates from a public service (exchangerate-api.com), which never sees you.
• App mapping library (only if you use it): “Use a shared mapping” downloads, for the app you are mapping, the zones other people shared. “Share this mapping” sends, after asking you, the app’s identifier and name and the rectangles of the zones you marked (fractions of the window): never what is on screen, never your notes. Shared mappings are reviewed before being published for everyone; the ones not approved are deleted after 90 days.
• External links: “Buy me a coffee” and “Send feedback” open your browser on the Postik website; whatever you do there (or on the linked support platform) is governed by that site’s policy.

This website

The app and the website are separate: what follows applies only to this website (postik.sekaibuilder.com), which runs on Cloudflare Pages.

• Visit log: for each page you open, the site records the date and time, your IP address, the approximate location Cloudflare derives from it (country, region, city and network), the page, the page you came from, your browser (user agent) and language, and the names of the cookies your browser sends (never their content). Downloads and access-code attempts are recorded the same way. It is used for security (spotting abuse and slowing down repeated wrong codes) and for basic visit statistics; it is not shared with anyone and never used for advertising.
• Retention: visits and downloads are deleted automatically after 90 days; the record that you acknowledged the privacy notice, after 365 days.
• Cookies: a single technical cookie, postik_dl, set only when you enter a download access code. It lasts until the code changes (30 days at most) and the downloads need it to work. The site owner's private app (/m) uses a session cookie, postik_m, only on the devices the owner has approved; visitors never receive it. No advertising or third-party analytics cookies.
• Local storage: your browser remembers your language and that you closed the privacy notice. None of that is sent anywhere, except the acknowledgment itself (date, IP address and browser), which is kept as proof.
• Chat («Write»): if you write to me, the site stores your messages, my replies and, if you give them, your name and contact. Your browser keeps a key to the conversation (local storage, postik.chat) so you can read my reply; the site only stores a fingerprint of that key. Each message is recorded like a download (with the IP) only to limit abuse. Conversations are deleted 180 days after the last message, and I can delete one earlier if you ask in the chat itself.
• Bug reports (beta testers): if you are a beta tester and use “Report a bug” (on this site, in the phone app or in Postik for Mac), the site stores what you write, the screenshots you attach, your tester code (or the device you send it from), the app version, the system and the language. Each report is first kept on your own device and only deleted there once the site confirms it arrived; your browser also remembers your tester code (local storage, postik.tester) and keeps unsent reports in its own database (IndexedDB, postik-bugs). The IP is not stored with the report: each report is recorded like a download (with the IP) only to limit abuse. Screenshots are never public: only I can see them, from Postik Admin. Reports are deleted a year after their last change, and those that never finished uploading after 14 days; I can delete one earlier if you ask.
• Personal code: if I gave you a personal code (beta testers), the site stores the date you first used it to open the downloads and, once you enter it in Postik, which of your computers it belongs to. It is not stored next to your IP address.
• Update checks from the app (version.json) are not recorded.
• Shared app mappings: they are stored without your IP address. Each submission is recorded like a download (with the IP) only to limit abuse, and deleted after 90 days.
• Legal basis: legitimate interest in keeping the site secure and knowing how it is used (GDPR art. 6(1)(f)); the download cookie is strictly necessary for the service you request.
• Your rights: you can ask for access to, or deletion of, the records linked to your IP address through the contact section, and complain to your data protection authority.

Contact

Questions about privacy: see the contact section of the website.