SomethingGet the first build

Draft, under legal review. This text is not in force and may change before launch.

Privacy Policy for Something

Version 0.1 · Last updated 30 October 2026 ·

Draft. For review by BAARS DESIGN and its lawyer before publication. Not legal advice. Text in [square brackets] is a placeholder. “Decision” lines need an answer from the owner. “Lawyer” lines need a legal check. Retention periods are proposals. Several services named below are planned and not yet created (see “Status” in each section); publish only once the facts match.

This policy explains what personal data BAARS DESIGN processes when you use Something, the website, and our support channels, and what your rights are.

The short version: Something runs on your Mac. Your project files, code, prompts and AI responses stay there or go directly to services you chose. What reaches us is your account, your plan, your team membership, and the messages you send us.

1. Who is responsible

The controller is:

We have no data protection officer; the law does not require one for a business of this size and kind. Write to the email address above for anything about your data.

Decision: the published privacy contact address. Lawyer: GDPR Article 13(1)(a) requires “the identity and the contact details of the controller”. This draft gives the email here and the postal address by link to the imprint, so the home address appears on one page only. Confirm a link is enough, or repeat the address here.

2. What this policy covers

  • The Something desktop app for macOS.
  • The website [something.baars.design] and its contact form.
  • Accounts, teams and billing.
  • Email you send us and email we send you.

It does not cover services you connect to through the app under your own account: GitHub, your AI provider, Google or Apple as sign-in providers. Each of those has its own privacy policy, linked in section 8.

3. What stays on your Mac

This section describes data we do not receive. It is here because it is the most important fact about how Something handles data.

Your projects. Project files, code, branches, commits, screenshots, canvases, history, undo state and the index the app builds of your project are stored on your Mac, in the project folder and in ~/.something. The app never uploads them to BAARS DESIGN.

Your AI conversations. When you use an AI feature, the app sends your prompt and the relevant code from your Mac directly to the AI provider you configured (Anthropic, OpenAI or Google, through their CLI tools or API). Nothing passes through our servers. We cannot see it. Your conversation threads are stored locally in ~/.something/threads.json.

Your credentials. Your sign-in session, your GitHub token and any AI API keys you enter are stored in the macOS keychain under the service name “Something”. They are never written to a file or sent to us. Plugins cannot read the account or GitHub entries.

Logs. The app writes a log to ~/Library/Logs/Something/main.log and keeps the previous run as main.previous.log. The log stays on your Mac. We only see it if you choose to send it to us when asking for help.

No analytics or telemetry. The app contains no analytics, crash reporting or usage tracking code, and sends no usage events to us or to anyone. We checked the source for such code on 2026-10-30 and found none. If this ever changes, we will update this policy and tell you first.

4. What we process, and why

Each row is one processing activity. “Basis” refers to Article 6(1) of the GDPR. Retention periods are proposals marked for decision.

4.1 Account

Status: planned. The sign-in service (Supabase Auth) is built into the app but not yet configured in any released build.
Data Email address, display name, sign-in method (Google, Apple or email code), the identifier your sign-in provider gives us for you, the time you signed up and last signed in, your IP address at sign-in. If you use Apple’s “Hide My Email”, we receive a relay address instead of your real one.
Purpose To create and secure your account, to know which plan and organisation you belong to, to contact you about your account.
Basis Article 6(1)(b), contract: we cannot provide an account without this.
Where Supabase Auth, hosted on AWS in Stockholm, Sweden (region eu-north-1), planned. Our own backend database, see 4.3.
Retention For as long as your account exists. Deleted within [30] days after you delete your account, except what we must keep under 4.4. Sign-in IP addresses and times: [90] days.

4.2 Organisations and teams

Status: planned.
Data Organisation name, your role (owner, admin, billing, editor), whether you hold a seat, who invited you and when, invite emails sent by an admin, and an audit log of administrative actions (who changed what and when).
Purpose To run team plans: seats, invites, access control, and an audit trail that business customers need.
Basis Article 6(1)(b) for members who are the customer; Article 6(1)(f), legitimate interest, for processing on behalf of an organisation customer. Where an organisation is the controller for its members’ data, we act as its processor under the Data Processing Agreement.
Retention While the organisation exists and you are a member. Invites expire after [7] days. Audit log: [2 years], with the actor replaced by a pseudonymous id if the person deletes their account.

4.3 Plan and entitlement

Status: planned.
Data Your plan, seat, subscription status, trial status, and a signed entitlement token the app stores in your keychain. The app reports its version and your Mac’s name and platform so we can show you where you are signed in. The backend records counts, such as the number of pull requests sent per seat per month, but never their content.
Purpose To unlock the features of your plan, including offline; to show you your devices; to measure usage per seat for billing and fair use.
Basis Article 6(1)(b), contract.
Retention Device records: [12] months after last seen. Usage counts: [24] months, then aggregated.

4.4 Billing

Status: planned. BAARS DESIGN is the merchant of record. Stripe processes payments.
Data Billing name and address, email, VAT number if you give one, the plan and seats you bought, invoices and receipts, payment status. Your card number is entered on Stripe’s pages and we never receive it; we see the last four digits and the card brand.
Purpose To take payment, issue invoices, calculate tax, handle refunds and failed payments, and meet our tax and bookkeeping duties.
Basis Article 6(1)(b), contract, for taking payment; Article 6(1)(c), legal obligation, for invoices, tax records and bookkeeping.
Retention Accounting records, including invoices, are kept for five years after the end of the accounting year as required by bokføringsloven § 13. We cannot delete these earlier even if you ask.

Stripe also processes your payment data as an independent controller for fraud prevention and legal compliance, under its own privacy policy (linked in section 8).

4.5 Support and email you send us
Data Your email address, name, what you write, any attachments or logs you choose to send.
Purpose To answer you.
Basis Article 6(1)(b) if you are a customer; Article 6(1)(f), legitimate interest in answering enquiries, otherwise.
Where Our own mail server, mail.baars.design, which runs on a virtual server at Oracle Cloud (see subprocessors).
Retention [24] months after the last message in the thread, then deleted.

4.6 Contact form on the website

Status: planned. The website does not exist yet.
Data Name, email, company (optional), your message, the time sent, and your IP address for abuse prevention.
Purpose To answer you.
Basis Article 6(1)(f), legitimate interest in answering enquiries, and 6(1)(b) if the enquiry leads to a contract.
Where Submissions are stored in [the website’s database, provider to be decided] and emailed to us.
Retention Stored copy: [12] months. Email copy: as in 4.5. IP address: [30] days.

4.7 Transactional email we send you
Data Your email address and the content of the message: sign-in codes, invites, receipts, renewal reminders, security notices, changes to terms.
Purpose To run the Service. These messages are not marketing and you cannot opt out of them while you have an account.
Basis Article 6(1)(b), contract.
Where Sent from no-reply@baars.design through our mail server (Oracle Cloud), and, for sign-in codes, from Supabase through the SMTP server we configure (planned to be the same server).
Retention Sending logs: [90] days.

4.8 Marketing email

Status: not planned at launch.

We send marketing email only with your prior consent, or to existing customers about our own similar products where Norwegian law allows it (markedsføringsloven § 15, third paragraph). Every marketing email has an unsubscribe link. Basis: Article 6(1)(a), consent, or 6(1)(f) within the existing customer exception.

4.9 Auto-update checks
Data When an installed copy checks for updates, it fetches the release feed and the update file from GitHub (github.com/the-baaron/something-releases). GitHub sees your IP address and a standard user-agent string. We receive nothing; the feed is a public, static file.
Purpose To deliver updates.
Basis Article 6(1)(f), legitimate interest in keeping the app secure and current. You can turn off automatic checks in [Settings] and use “Check for Updates…” by hand.
Retention None by us. GitHub’s retention is under GitHub’s privacy statement.

Decision: whether to add a setting to turn off background update checks. Today the app checks whenever it runs from an Applications folder (docs/RELEASING.md). A visible switch is the cleanest way to make the legitimate-interest basis solid.

4.10 GitHub integration
Data The app lists repositories you have given the Something GitHub App access to, and shows your GitHub login. Pull requests are created through your own GitHub CLI. All of this uses your GitHub token, stored in your keychain. The app looks up whether a repository is owned by a person or an organisation to decide whether a paid plan is needed; this lookup uses your token or an anonymous request, never a BAARS DESIGN token.
What we receive Nothing about your repositories. Only counts (section 4.3).
Basis Article 6(1)(b), contract: you asked the app to work with your repositories.

4.11 Website visits

Status: planned. The website does not exist yet.

The website sets no cookies and uses no analytics. The hosting provider ([Vercel, to be confirmed]) logs requests, including IP addresses, for security and operation, under its own terms. If this changes, we will update this policy before it does.

5. Who receives your data

We share personal data only with the service providers we need to run Something, listed with their roles, locations and transfer mechanisms in the Subprocessor list. In summary:

Provider What for Location
Supabase (planned) Account sign-in and user records Data hosted on AWS in Stockholm, Sweden; Supabase Pte. Ltd is in Singapore; support staff in the US and Singapore
Stripe Payments, invoices, tax Stripe Payments Europe, Limited (Ireland); data also processed by Stripe, LLC in the US
Oracle Cloud Hosts our mail server Admin note records the Amsterdam region (eu-amsterdam-1); Oracle is a US company
GitHub Hosts the update feed; receives your IP on update checks United States
Google, Apple Sign-in providers, if you choose them Google LLC (US); Apple Distribution International Limited (Ireland)
[Vercel, Neon] (under consideration) Backend hosting and database EU regions selectable
[WorkOS] (planned for Enterprise only) Single sign-on and directory sync United States

We do not sell personal data. We do not share it with advertisers.

We disclose data to authorities only when the law requires it, and we tell you unless the law forbids it.

If BAARS DESIGN is transferred to another company, your data moves with the business and this policy continues to apply until it is changed with notice.

6. Transfers outside the EEA

Norway is in the EEA, so the GDPR applies in full. Some providers process data in the United States or Singapore. For each we rely on one of these mechanisms:

  • EU-U.S. Data Privacy Framework (DPF) certification of the US provider. Stripe, LLC states it is certified (Stripe Privacy Center, read 2026-10-30). GitHub, Inc. states it complies with the EU-U.S. DPF (GitHub Privacy Statement, effective 2026-04-27). Google LLC states it is certified (Google “Data transfer frameworks”, effective 2025-08-23).
  • Standard Contractual Clauses (SCCs) under Commission Decision (EU) 2021/914, included in the provider’s data processing agreement. Used by Stripe (Data Transfers Addendum), GitHub (DPA, October 2025), Supabase (DPA v1, 2026-08-01, Singapore entity), Apple (Privacy Policy, updated 2025-07-30), and Oracle.

We checked each provider’s own statement on 2026-10-30. We did not verify the entries on the US Department of Commerce DPF list itself because that page requires a browser; the subprocessor list records this. You can ask us for a copy of the clauses that apply.

7. Your rights

Under the GDPR you can:

  • Access the data we hold about you, and get a copy.
  • Correct data that is wrong.
  • Delete your data (“right to be forgotten”). You can delete your account yourself in [Settings > Account] or by emailing us. We keep what the law requires (invoices, section 4.4) and a pseudonymous id in team audit logs.
  • Restrict or object to processing based on legitimate interest.
  • Export your data in a machine-readable format (JSON).
  • Withdraw consent where we rely on it, with effect for the future.

Email [privacy@baars.design]. We answer within one month, as the GDPR requires, and may ask you to confirm your identity first. There is no charge unless requests are clearly excessive.

Complaints. You can complain to the Norwegian Data Protection Authority:

If you live in another EEA country you can complain to your local authority instead.

8. Third parties you connect to yourself

These services receive data from your Mac because you chose to use them. We are not the controller for that processing.

When you sign in with Apple, Apple gives us a unique identifier, your name as you choose to share it, and either your email address or a relay address if you hide it. When you sign in with Google, Google gives us your email, name and profile picture under the openid, email and profile scopes.

9. Security

  • Your credentials live in the macOS keychain, never in files. Values are passed to the keychain without appearing on a command line.
  • All connections from the app to our servers and to third parties use TLS.
  • Sign-in uses the system browser with PKCE and a loopback redirect, as RFC 8252 recommends. The app holds no client secret.
  • The app’s page never sees a token; the host process answers only “who is signed in”.
  • Plugins cannot read the account or GitHub keychain entries.
  • Planned for the backend: JWT verification against the provider’s keys, signed webhooks, rate limits, encrypted backups, and logs that hash email addresses. These are design commitments in docs/AUTH-AND-BILLING.md § 10 and are not yet built.
  • Releases are signed with an Apple Developer ID and notarized. Updates are checked against a SHA-512 hash and the signature before installation.

If we learn of a breach that is likely to put your rights at risk, we will notify Datatilsynet within 72 hours and tell you without undue delay, as Articles 33 and 34 of the GDPR require.

10. Cookies

The website is planned to use no cookies and no analytics. The app is not a website and sets no cookies. If we ever add cookies that need consent, we will ask first and update this section.

11. Children

Something is for professional use. You must be 18 to buy a plan. Norwegian law sets 13 as the age at which a person can consent to an online service themselves (personopplysningsloven § 5). We do not knowingly collect data from anyone under 13. If you think a child has given us data, email us and we will delete it.

12. Automated decisions

We make no decisions about you by automated means that have legal or similarly significant effects. The app’s plan checks (for example, whether a repository belongs to an organisation) decide which features are available, not anything about you as a person.

13. Changes to this policy

We will post changes here with a new date and version. For material changes we will email account holders and show a notice in the app at least 30 days before they take effect. Earlier versions are available on request.

14. Contact

Sources used for this draft (read 2026-10-30 unless stated)