Eden Desk works without an account and has no analytics, advertising or tracking. What you work on stays on this device unless you choose to send something.
Information reaches us in exactly two ways, and both of them are something you choose to do. You can send one item to Eden Cloud. You can apply for Business or Enterprise. That is the whole list, and the two sections below say precisely what each one sends, where it is kept, and for how long. If you do neither, we hold nothing about you at all.
The only code in the app that can reach the network lives in one separate module. It sends something only when you press a button for it: an item you send to Eden Cloud as a subscriber with Cloud switched on, one of three short tries of Cloud before subscribing, or a Business or Enterprise application. A try and an application do not need a subscription. A check that runs on every build fails if any networking appears anywhere else, or if any other part of the app so much as refers to that module. Until 16 September 2026 the Mac had no permission from the system to use the network at all; Cloud replaced that wall with this smaller, checkable one, and this policy changed on the same day the code did.
What stays on your device
Everything you work on, and the few preferences the app remembers:
- Your notes. Plain text files you own, kept in the app's own folder or in a folder you choose. They are yours to open with any other app, move, or delete.
- Your scans and PDFs. Saved where you put them, on this device.
- Your voice recordings. Audio files you record in Capture, kept in the app's own folder on this device.
- The details you save for filling in forms, if you use the Form Assistant: things like your name, address or date of birth, written once, kept on this device, and offered only where you accept them.
- Your Budget. The accounts, transactions and debts you type in or import from a statement you choose. Kept on this device.
- Your search index. A small file the app builds so it can find words inside your own notes and documents. It lives on this device and nowhere else, and it is kept out of device backups because the app can rebuild it.
- What you asked Spotlight to see, if you turned Spotlight on. Your note titles and the first line of each note, in the system's own index rather than in the app's. Nothing deeper into a note, nothing from a folder you granted, and nothing from the Private Drawer. Turning it off removes what it added.
- Your collections and your desk rules, and the record of what the app has done on your behalf. Plain files in the app's own folder. Keeping exports all three in full, as the same JSON the app keeps, and can clear all three.
- Your calendar and reminder entries, if you use the Calendar skill. They are written to Apple's Calendar and Reminders on this device, the same as if you typed them there.
- Your appearance choice. Whether you prefer the light or the night look, or follow the system.
- Your purchase and your trial. Whether Local is owned, and the day the trial began.
None of this is sent anywhere. Deleting the app removes the index and the app's own folder. Notes you kept in a folder you chose stay where you put them, because they are your files.
Folders you choose
When you point the app at a folder, you pick it with Apple's own file picker. The app can then read and write inside that folder and no other. It keeps your choice across launches so you do not have to pick again. You can take that access away at any time by choosing a different folder or removing the app.
The camera, the microphone, and your calendar
Scan asks for the camera only when you tap Scan, to photograph a page. The picture stays on this device.
The dictation button in Take notes asks for the microphone and for speech recognition. Recognition runs on this device only. The button only appears when your language can be recognised locally; otherwise it is not offered, rather than quietly sending your voice somewhere.
Calendar asks for access to your calendar and reminders only when you first use that skill, and it asks for the smallest access that does the job.
The on-device model
Where the writing skills are available, they use Apple's on-device model, which Apple states runs on your device and keeps what goes into and out of it on the device. The same Apple framework can also reach a server model, but only if an app chooses that model in its code and holds a separate Apple-granted permission. Eden Desk never does either.
Things the system may do on its own
Three honest notes, because they are true even though the app sends nothing:
- Files you keep in iCloud Drive or another provider may not be on this device yet. Opening one makes your provider download it, possibly over cellular.
- Apple's own frameworks may download model files from Apple the first time a feature needs them: the on-device model, and the language files behind on-device text understanding and dictation. That is the system fetching its tools, not your text going anywhere.
- Keyboard dictation, Siri and Spotlight are Apple's features under Apple's rules and your own Settings.
Purchases
The one-time purchase and the free trial are handled entirely by Apple through the App Store. Eden Desk receives only whether Local is owned, whether the trial has been used and the day it started, and whether a purchase was later refunded. We never see your name, your payment details or your Apple Account. Apple's own privacy policy covers that transaction.
Individual Cloud
If you send an item to Eden Cloud, as a subscriber with Cloud switched on or as one of three short tries before subscribing, that one item leaves your device: your question and the passages that matched it, or the words of one document you chose to summarise. It goes to our own server, which checks Apple's signed proof of your subscription, counts the send against the month, keeps the date and size of the request and never its content, and forwards the item to Anthropic, PBC in the United States. Each send also carries a random number the app makes for it, which our server remembers for two days so the same send is never sent to the model or counted twice (a copy that arrives at the same moment as the first may still be measured, as below); nothing in that number comes from what you sent.
Our server first checks what it can without sending the item on: that Cloud is not paused or too busy, that your subscription is confirmed or a try carries its random id, that the item is no more than one send can carry, that it has not already arrived once, that a try is within the day's limit for tries from one internet address, and that your month or your tries still have room for this send, counted at the least it could be. A send refused at any of these checks goes no further than our server. Otherwise the item goes first to Anthropic's token counter, which measures its size and does not answer it, and only then to the model. A send can still be refused after it has been measured: when it turns out to be more than one send can carry, when at its measured size it no longer fits what is left of your month or your tries, when Eden Cloud's own spending limit has been reached, when a second copy of the same send arrives at the same moment as the first, or when the measuring fails, in which case it may or may not have reached the counter. Such a send never reaches the model and is not counted. What reaches the counter has reached Anthropic, PBC in the United States, the same as a send that is answered.
Anthropic keeps what you send for up to 30 days and then deletes it, unless it is flagged under their usage policy, when they may keep it for up to two years, and does not use it to train their models. A try is counted against a random id the app made once, which says nothing about who you are. Our server keeps that id with the number of tries it has used, so that a fourth try is refused; it has no set deletion date. It also keeps the internet address a try came from, with that day's count and nothing you sent, for 26 hours, so that one address cannot use more than the day's tries. With Cloud off and no try sent, which is how every install starts, nothing leaves. Every send is written in your Paper Trail before it leaves this device, and what came of it is added to the same line: that it was answered; that our server refused it; or that no answer came back, and then, unless our server said otherwise, that it may still have been received and counted. A send that never left this device, such as one for which no connection could be made, stays on the list, struck through and marked Not sent. If the Paper Trail cannot be saved, nothing is sent. Nothing in the Private Drawer can be sent.
The Business or Enterprise application
If you apply for Business or Enterprise from inside the app, the form you fill in goes to our own server when you press Send, so we can review it. This is the one place Eden Desk asks you for personal information, and it asks because an application from an organization has to come from a person at that organization.
What the form sends: the organization and its website, your name and your role, a work email at the organization's own domain, roughly how many people, the country or region, and a free-text description of what you need. The description is stored exactly as you typed it, so please do not put anything in it you would not want kept.
Where it goes: to our own server, which runs on Cloudflare's network and keeps the application there. Our server then emails it to us at Support@edenapps.app. The email is sent through Resend and arrives in a mailbox hosted by Zoho. Eden reads it there and answers you by email. It is not used for anything else and it is not sold. We also keep the internet address the application came from, for 26 hours, only so that one address cannot apply more than five times in a day.
How long: the copy on our server is deleted automatically 183 days after you send it. That timer starts when you press Send, not when we reply. Resend deletes its copy of the email after 30 days. The email in our mailbox is kept until we delete it.
We answer by email, and there are no calls. Nothing else on your desk goes with it.
Services we use
Our server runs on Cloudflare's network, at cloud.edenapps.app. Everything Eden Desk sends goes there first.
- Cloudflare runs our server and the storage behind it, for Cloud sends, tries and applications.
- Anthropic, PBC in the United States answers Cloud sends and tries, as described above.
- Resend is the email service our server uses to send a Business or Enterprise application to us. Resend keeps a copy of that email for 30 days, and keeps its account data, including that copy, in the United States regardless of which region an email is sent from.
- Zoho hosts our mailbox, Support@edenapps.app, where applications arrive and where we reply from, on Zoho's United States data center.
- Apple handles purchases and subscriptions through the App Store.
What we never do
- The only personal information we hold is what you type into a Business or Enterprise application, including its free-text description, and an internet address for 26 hours: the one an application came from, so that one address cannot apply more than five times in a day, or the one a try came from, so that one address cannot use more than the day's tries, kept beside a count and nothing you sent.
- With Cloud, our server sees Apple's signed proof of your subscription, which carries no name, no email and no Apple Account, and the one item you chose to send.
- We do not use analytics, advertising or tracking identifiers.
- We do not include any third party code, so nothing else is watching either.
- We do not ask for your location or your contacts. The one exception is the Business or Enterprise application, which asks for the organization's country or region so we know where the organization is.
- We do not sell data, and we do not sell an application you send us.
Children
The Business or Enterprise application is the only part of Eden Desk that asks for personal information, and it is meant for someone applying on behalf of an organization they work for. The Form Assistant also asks you to save details like a name or an address so it can offer to fill a form field, but those stay on this device and are never sent.
Changes
Individual Cloud, its three tries, and the Business or Enterprise application are the features that use the network. This policy changes before a feature that sends something does, and the date at the top changes.
Contact
Questions about privacy: Support@edenapps.app