Privacy policy for FlosForge Reader

What FlosForge Reader collects about you

Nothing. There is no account, no telemetry, no analytics, no crash reporting and no identifier of any kind. The app has no server of its own to send anything to, and it does not phone home to check for updates — the Mac App Store delivers those.

What it stores, and where

Sources, articles, notes, comments, tasks and settings

In a local SwiftData store inside the app’s sandbox container on this Mac.

Provider API keys

In the macOS keychain, one per configuration, never in the database and never in a backup.

The app-lock passcode

Never stored. What is kept is a PBKDF2-SHA256 verifier and a random salt, compared in constant time, so a copy of the preferences does not reveal it.

Logs

Off by default: a reader should not write a record of everything you read unless you asked it to. Switched on, they are plain-text files per day and per subsystem, kept for a period you choose, and prompt and article text stays out unless you turn on a second switch.

Backups

Everything writes out to a single JSON file you save wherever you like. Provider keys and the passcode are deliberately left out of it.

Everything it can connect to

Each of these is a connection you cause — by adding something, enabling something, or pressing a button — and none of them is made on a schedule you did not set.

The publishers you subscribed to

Their feed, an article’s own page when the feed sends only a summary, a favicon, and an article’s image if a share card asks for it. Publishers see what any browser sees.

A site you pasted while adding a source

To find its feed.

The model provider you configured

Only with AI switched on, both app-wide and in the workspace. Apple Intelligence and Ollama run on this Mac; Google Gemini is reached under your own key, and every hosted run names its destination before you press it.

What never leaves your Mac

• Nothing goes anywhere else, ever. There is no FlosForge server and no request to one.
• Trackers are blocked before the request in the web view, on by default, and the reader view loads no third-party scripts at all.
• A hosted provider is refused outright for anything you did not personally start. Automatic tagging can only ever use a model running on your own machine.
• No identifier of any kind is generated or transmitted.

AI

• Off for the whole app by default, and off again for every workspace separately. Both have to be on before anything is sent anywhere.
• Two acknowledgements, one for models running here and one for providers you send prompts to, each versioned, dated and withdrawable.
• Token limits for hosted providers per run, per day and per month, and a usage ledger that records tokens, never money.

Safeguards

Sandboxed, with the narrowest entitlements that work

Outbound network, files you pick in a panel and permission to remember them, and printing. The app never listens.

App lock

Touch ID, Apple Watch or a passcode, on launch or after a number of minutes. Five wrong entries start an escalating wait, and your Mac login password is the fallback for a forgotten passcode.

Your rights, and who to ask

Because the app holds nothing about you, there is nothing for the controller to access, correct or erase on your behalf: everything it knows is in files on your own Mac, under your own control. Removing the app and its container removes all of it — your library, your notes and the files it kept. The keychain items go with it. For anything else, write to hello@flosforge.eu. The site-wide privacy policy covers this website, your rights under the GDPR, and the supervisory authority you can complain to.

Changes

This statement is checked against each release. If a version changes what the app stores or what it can connect to, the version and date at the top change with it.