Your things stay on your computer. Here is the little that leaves.

Last updated 18 October 2026. This page says what Cinderpaw and this website collect, why, and what you can do about it. If something here is unclear, write to me and I will fix the page.

Who is responsible

Cinderpaw is made by Darius, through my company BLOOM VENTURES S.R.L., registered in Romania: CUI 50654818, Reg. Com. J2024028239006, Str. Jiului nr. 26, bl. V8, sc. 1, et. 1, ap. 4, 400601 Cluj-Napoca, Romania. The company is responsible (the “data controller”) for the information on this page. Write to me about your data at bloommediacorporation@gmail.com.

The short version

The Cinderpaw app runs on your computer. Your chats, files, memory and API keys stay there. There is no Cinderpaw account, and your chats never pass through a Cinderpaw server.
The app sends me very little, and tells you first: one install count you can untick, a daily usage summary that is off unless you turn it on, and bug reports only when you send one.
This website counts visits by channel (one word, like reddit), and keeps your email only if you sign up to hear about new versions.
No ads. No tracking cookies. No analytics company.

What the app sends to me

Install count, once. On the last screen of first-run setup there is a ticked box. If you leave it ticked, Cinderpaw sends its version number and your operating system (like windows x86_64) one time. If you press one of the buttons for where you heard about Cinderpaw, that one word goes too. Untick the box and nothing is sent. I keep only totals, like “120 installs on Windows”, never one line per person.
Daily usage summary, only if you turn it on. Once a day it sends counts for each model: tasks, how they ended, time ranges, tokens, cost, tool calls and your 👍 and 👎 counts, plus the version, your operating system and a random code that changes every month. Never your messages, file names, links, keys or exact times. How the leaderboard numbers are made lists every part. The summaries are kept as long as that month’s leaderboard is online.
Bug reports, only when you send one. A report holds what you wrote, the version, your operating system and, if you leave that box ticked, the last part of the app’s log. You can read the log before you send it. It can hold file names and the steps the app took. Reports go to a private Discord channel that only I can read. I keep them while I work on the problem, and I delete yours if you ask.

Your IP address

When the app or this website sends me something, my server sees your IP address, like every server on the internet. For bug reports, usage summaries and visit counts I use it for a short time to stop abuse, for example someone sending thousands of fake reports: up to one hour, or up to one day for usage summaries. It is never written to my database or next to your data.

How to check what left your computer

~/.cinderpaw/.install-counted says declined, or sent with exactly what was sent. On Windows, the .cinderpaw folder is inside your user folder.
~/.cinderpaw/telemetry-sent.jsonl has one line for each daily summary, exactly as it left. No file means nothing was ever sent.
In the app, open Settings, then Privacy.

What the app sends to other companies

These happen only for features you use. They go straight from your computer to that company, not through me.

Update check. Each time it starts, Cinderpaw asks GitHub if there is a new version. You can turn this off in Settings, then General.
Local models. A model you pick to download comes from Hugging Face.
Cloud AI models. If you add your own API key for a service like OpenAI or Anthropic, your messages and the context you choose go to that service when you use its model.
Connectors and web tools. If you connect a chat app like Discord, Slack, Telegram or WhatsApp, search the web, or ask Cinderpaw to open a web page, that service gets what it needs to do the job.

Each of those companies has its own privacy policy, and it applies to what you send them.

What stays on your computer

Your chats, memory, settings and model files stay on your computer, mostly in the .cinderpaw folder in your user folder. Your API keys are kept in your system’s safe key storage: Windows Credential Manager, the macOS Keychain or the Linux secret service. To remove your data, uninstall Cinderpaw and delete the .cinderpaw folder.

This website

Hosting. This website is hosted by Vercel. Like every web host, Vercel sees your IP address and browser details to send you the pages, and keeps short technical logs.
Visit count. When you open the site, it sends one word for the channel that brought you (like reddit, youtube or direct), and one more message if you press Download. To count your visit once, that word is kept in your browser tab and is gone when you close the tab. No cookie is used. My server keeps only totals per day and per channel.
Email list. If you type your email under “Tell me when it works”, I keep it with Resend, the service I use to send email, to tell you about new versions. Nothing else. Write to me to leave the list at any time, and every email I send to it will have a link to leave. I keep your email until you leave.
Leaderboard. The leaderboard shows totals from the usage summaries of everyone who said yes, never one person’s data.
Links. Links to GitHub, Discord and X take you to those sites, and their privacy policies apply there.

Companies that help me

Cloudflare: the small server that receives install counts, usage summaries, bug reports and visit counts, and its database.
Vercel: hosting for this website.
Resend: the email list.
Discord: the private channel where bug reports arrive.
GitHub: the code, the downloads and the update check.

Some of them are based in the United States, so your data can be handled outside the European Union. Each one explains in its own privacy policy how it protects data that leaves the EU.

Why I am allowed to do this

Install count, visit count and abuse protection: my legitimate interest in knowing how many people use Cinderpaw and where they find it, and in keeping my server safe. I collect as little as I can, and you can untick the install count before anything is sent.
Daily usage summary and email list: your consent. You can take it back at any time, and the sending or the emails stop.
Bug reports: you send them so I can fix a problem for you.

Your rights

Under the GDPR, the European privacy law, you can ask to see, correct or delete your data, to limit or object to how I use it, to get a copy of it, and to take back your consent. Write to bloommediacorporation@gmail.com and I will answer within one month.

Most of what I get has no name or ID on it, so usually I cannot tell which numbers are yours, and I will not collect more just to find out. Your email and your bug reports are different: I can find and delete those.

You can also complain to the Romanian data protection authority, ANSPDCP, at www.dataprotection.ro.

Children

Cinderpaw is not made for children under 16, and I do not knowingly collect their data.

Changes to this page

When I change this page, I change the date at the top. Big changes also go in what changed. See also my promises and the code signing policy.