Privacy policy

• AiTuner from the Mac App Store asks for your permission in the agreement at first launch, like the edition installed with Homebrew; it cannot be used without it, because the shared results are what pay for this free service. It sends each benchmark run, which Hugging Face models you look at and test, the daily check-in, how aituner is used and the errors it shows you, as described below, but no list of applications and no activity (it cannot see other apps). The rest of this list describes the edition installed with Homebrew.
• aituner is free because it collects anonymous benchmark data. Every Mac gets a random machine id (not tied to its hardware or to you) and every run a new random run id.
• Each run and the daily check-in carry the Mac's model, chip, cores and memory, macOS and tool versions, how much memory macOS, aituner and the other apps were using, and the results.
• The place comes from the internet connection the Mac uses at that moment (city, region, postal code, country), worked out by our hosting provider; aituner never asks for or uses the Mac's location services. Public pages show only city, region and country, and the map rounds positions to about 10 km.
• aituner looks at the whole Mac to make accurate recommendations: once a day it reports every installed application with its version, what runs (inference engines such as Ollama, LM Studio, MLX and llama.cpp, with the model each has loaded, and other apps), and the memory each takes. Accepting the agreement gives permission to collect and analyze this.
• While it runs, aituner notes once a minute whether the Mac is in use (only how long since the keyboard, mouse or trackpad was touched, never what was typed), working on its own or idle, shows it to you as a heat map, and sends the previous day's totals for each hour with the check-in.
• We keep which Hugging Face models people look at, test and download (names only, never what you type), and, only if you turn it on, the custom prompt you give aituner and the text the model writes for it.
• How aituner is used. To learn what helps people get started and what makes AiTuner Plus worth having, aituner reports the steps you take, each as a name with a few fixed values, with the machine id, the edition and the version: Get started pressed, finished or stopped and how long it took; a benchmark finished and how long it took; a model downloaded, started or failed (the model's name, its size, how long, and the kind of problem); a chat answered (the model's name, how many tokens and how long, and how long after installing the first answer came; never what was asked or answered); a document added to a question (PDF or text, never its name); the picture button pressed; an AiTuner Plus offer shown, Subscribe pressed and the App Store's answer, and Plus coming on; and pairing an iPhone.
• Errors. When something fails in aituner and it tells you so (a model that does not start or stops, a download, Get started, a benchmark, a model's test or an update), aituner reports where it failed, the error message, the last lines the model server or AI runtime wrote, the model's name and architecture and the runtime's version, with the machine id, aituner's version and build, and the Mac's model, chip, memory and macOS version, so we can fix it. Your home folder's name, temporary folders, email and IP addresses and anything that looks like a key are removed before it is sent, and again on our servers. The same error is sent at most once every 10 minutes.
• Unless you sign in (below), no names, email addresses, file contents, screen contents, or IP addresses are stored.
• Chats stay on your Mac. Conversations in Local AI, with the pictures and documents you add, are kept only on your Mac (a factory reset deletes them) and go only to the model running on it; we never receive them.
• MCP servers you add. If you add an MCP server in Settings and turn on tools in a chat, the model can ask to use one of that server's tools. aituner then shows you the tool and exactly what the model wants to send it, and sends it to that server only if you allow it (or, for a tool you chose to always allow, without asking again). What you send there is handled by whoever runs that server, under their terms, not ours; we never receive it. A token you give for a server is kept in your Mac's Keychain.
• AI apps on your Mac. If you turn on "Let AI apps on this Mac read aituner", other apps on the same Mac that hold its token can read your Mac's hardware, live use, the models running and which fit, and your benchmarks; never your chats. It answers only on the Mac itself (127.0.0.1), only while aituner runs, and is off until you turn it on.
• To have your data deleted, write to [email protected] with the machine id shown in aituner's Settings.

Your account

• From version 0.4, aituner on the Mac asks you to sign in with Apple once, after the agreement, before it is used. The account ties your Macs, iPhones and browsers together and turns on AiTuner Plus, free during the beta. Apple handles the sign-in; we never see your password.
• What the account keeps: Apple's identifier for you in aituner; the email address Apple gives us (your own, or Apple's private relay address if you choose to hide yours); your name if you choose to share it; when you signed up and were last active; your devices: for each Mac, iPhone and browser signed in, its name (or one you give it), its model, chip and memory, the aituner version and edition, when it was linked and last seen, and for a Mac where its paired devices reach it through our relay (a room id, its public key and an invitation id, none of them secret on its own); a hash of each sign-in session; and your support tickets' numbers, subjects and topics.
• What stays on your Mac: your chats and the files a model reads, your models, benchmark results, live GPU, CPU and memory, what is running, and the iPhones and browsers paired with it. When account.aituner.app or the iPhone app shows your Mac, they reach it through our relay end to end encrypted: the relay passes sealed messages it cannot read, keeps no log and stores none of them.
• The device you signed in on is linked to the account, so the steps it reports (how aituner is used, above) say who and when: that is how we learn who uses aituner and which features they use most. Nothing you type, ask or chat is linked to it.
• account.aituner.app uses one cookie, strictly necessary: the session of that browser, 30 days from its last use (we keep only a hash of it). Signing in there sets a second cookie for the ten minutes the sign-in with Apple takes. No analytics, advertising or third-party cookies. The browser's name ("Chrome on macOS") is worked out from its User-Agent once; nothing else of it is kept.
• Support tickets filed at account.aituner.app become public issues on github.com/aituner-app/issues: anyone can read them. We never add your name, email or account to them; a ticket carries only what you write (with email addresses, home folder names, IP addresses and long keys removed), the topic, an opaque ticket number, and, if you choose, your Mac's model, chip, memory and aituner version. Do not write personal details.
• Disconnect a device at account.aituner.app ends its session: it asks you to sign in again (a Mac within 15 minutes). Remove also takes it off the list. A browser whose session ends is forgotten by your Macs.
• Delete account at account.aituner.app, in the Mac app's Settings or in the iPhone app deletes the account, its email and name, its devices, sessions and tickets' link to it at once, and revokes aituner's Sign in with Apple authorization. Public issues stay, naming no one. Steps already reported stay, linked to no one, until they are deleted with age (about 13 months). Nothing on your Mac is deleted. Sign out only unlinks that device.

What's new and notifications

• The apps show our announcements of new features in a What's new card; reading them sends nothing about you.
• The Mac app also posts each new one as a notification if macOS allows aituner's notifications; Settings can turn that off.
• If you allow notifications in the iPhone app, it sends us the push token Apple issues for it, kept under the app's random id (hashed), so we can send announcements through Apple's push service. Turning notifications off in the app deletes it; we also delete it when Apple says it is no longer valid.

AiTuner for iPhone

• The iPhone app shows the public stats (the same as this website). Reading them sends nothing about you.
• Following your Mac. When you pair the iPhone with AiTuner on your Mac (by scanning the QR code your Mac shows, or opening its link), the iPhone sends its name and a public key it makes for itself to your Mac, and your Mac sends the iPhone its live status (its inference engines and their models, GPU, CPU and memory). This goes between your own devices: we do not receive it. The camera is used only to read that QR code, on the iPhone; no picture is kept or sent.
• Away from home the iPhone and your Mac talk through our relay (relay.aituner.app, run on Cloudflare). Everything they say is encrypted end to end with keys only your devices hold, so the relay cannot read it. To connect them the relay keeps a random room id, the hashed token of your Mac, and each paired iPhone's random id with its hashed token. It also counts, anonymously: per hour, how many connections it opened and how many messages and bytes it passed; and per room (its id hashed again) whether the Mac is connected and how many iPhones are. It keeps no logs, no IP addresses and no content. Removing an iPhone on the Mac removes it from the relay.
• Where iPhones are. While a Mac is paired and the Live tab is open, the iPhone tells us every few minutes that it is there: a random id the app makes once and keeps on the iPhone (not linked to you, your Apple account or the device's hardware), "ios" and the app version. We keep a hash of that id, the app version, when it was first and last seen, and the place of the network the request comes from (city, region, country, time zone and approximate coordinates, no postal code); only our own private map shows it, as an anonymous dot for the last 10 minutes rounded to an area of about 11 km; it is not published. The iPhone sends no location, name or Mac.
• Chat with your Mac. A chat from the iPhone, in the app or in its Messages app, goes to the model running on your paired Mac, directly at home or through the relay, end to end encrypted, away from home. It is kept on your Mac with your other chats, so you can continue it on the Mac, in the app or in Messages; we never receive it. If you share an answer from the Messages app, it goes into that conversation's message field and is sent, by Apple's Messages, only when you tap Send.
• AiTuner Plus is bought through Apple; we never see your payment details or Apple Account. To unlock pictures in the chat on a paired Mac (the Homebrew edition sells nothing, so this is how it gets them), the iPhone sends the paired Mac the App Store's signed record of the purchase, and the Mac checks Apple's signature itself; it does not reach us.
• When you press Send in Request a feature, it sends what you wrote, the app version and the same random id.
• Share how you use the app (in About) is off until you turn it on. When it is on, the app sends the steps you take, each as a name with a few fixed values, with the same random id (we keep only its hash) and the app version: the AiTuner Plus screen shown (and from where), a plan tapped, the App Store's answer, Restore purchases, the scanner opened, pairing with a Mac (at home or through the relay, and the kind of problem when it fails), a question sent to your Mac (never its text), and another Mac chosen. Turning it off stops it and drops anything not yet sent.
• Nothing else is collected; there is no tracking and no advertising.

Feature requests and bug reports

• A feature request (Mac or iPhone) becomes a public issue on GitHub (github.com/aituner-app/issues) with the title and details you wrote and the app version; the app says so before you send it. A bug report becomes a public issue with exactly the text the Mac app shows you before sending. The random id is never published.
• To stop floods, the service keeps a salted, daily hash of the sending network address (it cannot be turned back into the address) for 2 days, and each report's random id for 7 days.

This website

• When you open a page of aituner.app, the page tells our own service (insights.aituner.app, not a third party) which page it was, the site that linked to it (its address only, for example reddit.com) and the campaign tags in the link (utm_source, utm_medium and utm_campaign), and, when you press a download button or copy the Homebrew command, which one. With it we keep the approximate place of the network the visit comes from (city, region, country, time zone and coordinates rounded to about 11 km, worked out by Cloudflare), the kind of device (phone, tablet or computer) and the browser and system families (for example Safari on iOS), and whether it looked like an automated program.
• The site is hosted on Cloudflare Pages with Cloudflare Web Analytics, which counts page views without cookies and without storing your IP address (Cloudflare's own privacy policy applies to it).
• No cookies are used and nothing is stored in your browser. Your IP address and your browser's full identification string are not stored. To count visitors without knowing who they are, we keep a one-way hash of the network address and browser with a random value that changes every day and is deleted at the end of the day, so it cannot be traced back to you or linked from one day to the next.
• If your browser sends Global Privacy Control or Do Not Track, the page sends nothing at all.
• The details of each visit and the daily totals are kept for as long as the service runs; the daily value behind the visitor hash is deleted at the end of each day, so a visit cannot be traced back to you.

Who else handles the data

• Cloudflare hosts the service and the relay, and works out the place of the connection. GitHub hosts the public issues. Data goes to them only to provide those services. Nothing is sold, and nothing is shared for advertising or tracking.

How long it is kept

• Benchmark runs: as long as the service runs (they make the public stats). Memory and activity summaries, and how the apps are used: about 13 months. Error reports: 180 days. The list of applications: 90 days. The live map: 30 days after an iPhone was last seen. The relay's counts: 30 days for each room, about 13 months for the hourly totals. Feature requests: until they are done or declined, or until you ask for them to be deleted. Public GitHub issues: until deleted on request. Website visits: 90 days, and their daily totals 2 years.

Your choices

• On the iPhone, the live map stops when you forget your Mac or close the Live tab, how you use the app is sent only while Share how you use the app is on, and nothing else is sent unless you send a request; to stop following your Mac, use Forget this Mac on the iPhone or remove the iPhone in the Mac's Settings. On the Mac, the agreement shown at first launch asks for your permission; to withdraw it, stop using aituner and uninstall it, and ask us to delete what was collected.
• To have your data deleted, write to [email protected] with the machine id shown in aituner's Settings on the Mac, or the number of your feature request or bug report.

Read the full agreement