Caspian Privacy Policy

What Caspian does

Caspian is an assistant you can text or call. The Mac app connects data from your device, the website manages your account and connections, and the Chrome extension can share browser sign-ins. Caspian processes and stores connected data on its servers so the assistant can work when your Mac is offline.

Account and conversation data

We collect the phone number you use to sign in, account and device identifiers, connection settings, time zone, and information you provide to us. When you text or call Caspian, we process the messages, attachments, audio, transcripts, and information needed to deliver and manage the conversation. We also store assistant responses, task records, summaries, and memories used to answer later requests.

Technical records can include app versions, connection and upload status, timestamps, request identifiers, network information, and errors. Support messages contain whatever you choose to send us.

Website cookies and measurement

The account website uses cookies to keep you signed in, secure your account, and remember your approval to share sign-ins.

The marketing website uses Vercel Analytics and Speed Insights and our own visit log. We record pages visited, referring websites, interactions, browser and network details, and advertising campaign identifiers. We keep a random visitor ID and campaign information in your browser storage. We can also include campaign information in checkout records. This website measurement is separate from cookies shared by the Chrome extension. Browser settings and blocking tools can limit it.

Data from your Mac

The Mac app uses a background helper to read connected sources and upload their data to your Caspian account. Access depends on the sources you select, the accounts available on your Mac, and macOS permissions such as Full Disk Access, Contacts, or Reminders access. A source can contain information about other people as well as you.

Depending on the source, this can include messages and email; contacts; calendars and reminders; notes and documents; files and attachments; photo and video information, including available location metadata; saved screenshots; voice memos and transcripts; call history; notifications; browser visits, searches, bookmarks, downloads and tabs; application and website activity; listening history; development-tool conversations and workspace information; and redacted shell history. Supported applications include Apple's apps and third-party messaging, mail, notes, and development tools. Some sources upload content or locally available attachments; others upload metadata only.

The app keeps configuration, credentials, logs, and queued uploads on your Mac. Connected data and selected files or attachments also leave your Mac. Uninstalling the app does not delete data already stored in your account.

Safari sign-ins from the Mac app

The Mac helper also collects Safari sign-ins. When it can access Safari's files, it finds your Safari profiles and uploads cookies for the websites in those profiles. Cookies include the values that keep you signed in, along with the website, name, path, expiry, and security attributes.

Collection starts automatically when the helper runs after device enrollment. The website's shared-login activation setting controls whether Caspian may use a stored sign-in; it does not prevent the helper from collecting and storing that copy. Restricting access to Safari's files or stopping the helper stops further collection. Use the dashboard's deletion controls to remove a stored copy.

Chrome extension

The Chrome extension shares cookies from the Chrome profile where it is installed. These are the small pieces of data websites use to remember sign-ins and preferences. Cookies can grant access to your accounts, so treat sharing them as sharing access to those accounts.

The extension reads no cookies until you grant site access in Chrome and confirm sharing on the Caspian website. You sign in on the website; the extension does not read website cookies to authenticate you. Each profile needs its own approval. Incognito windows and other Chrome profiles are excluded.

With access to all sites, the extension reads every unexpired cookie Chrome makes available in that profile, including cookies used for sign-ins and cookies kept separately for embedded sites. It uploads each cookie's name, value, website, path, expiry time, security settings, and any information that ties it to an embedded site. If you restrict site access, it reads only the permitted sites and reports that some sites are blocked. Caspian's own cookies are excluded on the extension and server.

The extension does not read passwords, browsing history, page contents, anything you type, or other website storage. It does not inject page scripts or change or delete your browser's cookies. It sends uploads to app.textcaspian.com and keeps the stored copy up to date while Chrome runs. It saves an installation credential and upload status locally, but does not save cookie values in extension storage or Chrome sync.

Turn Share Sign-ins off to stop reading and uploading cookies. The server copy stays stored but cannot be used while sharing is off. Signing out of the website session that approved sharing, switching that session to another account, or letting it expire ends approval. Other website sessions are unaffected. Approve again to resume.

Delete the Chrome connection in the Caspian dashboard to remove its stored cookies and profile name and revoke the extension's credentials. You can do this after uninstalling the extension. Uninstalling alone stops uploads but leaves the server copy in your account.

Vault and payments

If you use the Vault, we store the details you save there. These can include usernames and passwords, payment-card details including security codes, addresses, private notes, and authenticator setup keys. Vault secrets are encrypted using server-held keys. Caspian can decrypt them for supported tasks, such as signing in, entering an authenticator code, or completing an approved checkout. We store labels and some details shown in the Vault separately from the encrypted secret.

If you connect a payment service or make a payment through Caspian, we process the connection credentials, payment requests, amounts, transaction status, and related account records. Stripe and Stripe Link can process payment information. A purchase or checkout can also send the required details to the merchant. These features are separate from the Chrome extension, which does not read saved passwords or payment cards.

Connected online accounts

When you connect an online service, we receive the account information, permissions, and access credentials needed for that connection. Caspian stores connection credentials on its servers and uses them to read the data you connect or carry out permitted actions. Access depends on the provider's consent screen and the permissions you grant.

For Google, the current connection requests permission to read Gmail, list calendars, and read and edit calendar events, along with basic account identity. Mail changes require additional permission. Other supported connections can provide messages, documents, calendars, repository activity, work tasks, and business or financial records. We only access accounts you connect, within the permissions you grant.

Disconnect a service in Caspian or revoke access through the provider. Revocation stops future authorized access; it does not itself remove every copy already collected by Caspian. Use the relevant deletion controls or contact us to request removal.

How we use connected data

We use connected data and conversations to answer questions, find information, prepare briefings, remember relevant context, and carry out tasks such as drafting messages, managing events, or working with connected services. Requested actions may send information to recipients or websites outside Caspian. When Caspian uses a browser or computer for a task, it may process page contents, files, screenshots, and information about the open workspace on a hosted computer.

We also use technical and task records to maintain the service, investigate failures or abuse, and improve its quality. Authorized staff may access information when needed for support, security, or service operations. We do not sell personal information. Chrome cookies are not used for advertising, credit decisions, or model training.

AI processing and service providers

Caspian sends the context needed for a task to AI services. That context may include your messages, connected-source content, attachments, screenshots, or transcripts. AI processing happens on servers. The Mac app has no setting to keep all assistant processing on your device.

AI services can include Anthropic and OpenAI, with model routing through OpenRouter and Amazon Bedrock or other model providers. We choose providers based on the model and how the service is configured. Messages travel through Linq; calling and voice processing can involve Twilio and OpenAI. Hosted browser tasks can use Kernel, and hosted computer tasks can use exe.dev. The websites use Vercel; server compute, databases, and file storage can use exe.dev, PlanetScale, and Cloudflare R2. Providers receive the information needed for the functions they perform. A task may also contact connected services or external websites.

We retain conversation and task records within Caspian. Providers may also store requests. How they process and keep data depends on the service, account settings, and agreements.

Google user data

Caspian's use and transfer of information received from Google APIs follows the Google API Services User Data Policy, including its Limited Use requirements. We use that data for the features you connect and request, not advertising or credit decisions. We do not use Google Workspace data to train general-purpose AI models.

Google data can enter AI task context and be sent to providers needed to deliver the requested feature. We limit transfers and human access to uses permitted by the Limited Use policy, including providing the service, investigating security issues, complying with law, or access you expressly approve. You can revoke Caspian's Google access from your Google Account permissions page.

Storage and security

We use encrypted network connections for app, extension, and website traffic. Browser-cookie copies are encrypted on Caspian's servers using server-held keys. Caspian can decrypt them to use an approved sign-in. This is not end-to-end encryption.

We control access through account and device permissions, credentials limited to particular actions, and encryption for protected server data. Some details used to run the service remain readable. Local files, cloud records, logs, and backups have different protections. Caspian can read stored data, and it does not always encrypt its local cache on your Mac. Protect your device and connected accounts as well as your Caspian account.

Retention and deletion

We keep connected data, credentials, conversations, memories, and task records as needed to provide the service. Deletion controls and automatic cleanup remove some records. How long we keep data depends on the type of record.

For Chrome, the latest complete cookie copy remains until another complete upload replaces it, you delete the connection, or your account is deleted. Turning sharing off or ending approval keeps that copy stored but unusable. Incomplete uploads expire within 15 minutes. Pending approvals expire after 10 minutes. An encrypted copy used to recover extension credentials can be retrieved for up to 90 seconds.

When you delete a source or close your account, we remove its records, credentials, files, and hosted resources or queue them for removal. Some cleanup continues after we revoke access. Where account deletion is available, use the dashboard; contact us if the control is unavailable or you need help. Deleting Caspian data does not delete the original information from the connected app or service, and removing an app does not automatically erase its local files.

Backups, security records, and provider-held copies may outlast deletion from the active service. We have no fixed deadline for erasing backups. We may retain information required for legal obligations, security, or resolving disputes.

Your choices and requests

You can change connected sources, revoke provider access, stop the Mac helper, turn Chrome sharing off, or delete stored browser connections. Stopping collection does not necessarily delete a stored copy. You can ask us to access, correct, export, or delete your personal information by emailing team@heynox.com. Available rights depend on your location.

Transfers, changes, and contact

Caspian and its providers may process information in countries other than the one where you live. Contact us to ask where we process your data and how we protect it.

Caspian is intended for adults. Please do not create an account if you are under 18. We may update this policy when the service or our practices change and will provide notice where required.

NOX Devices, Inc. operates Caspian. Send privacy questions and requests to team@heynox.com.