Privacy Policy

Effective date: October 15, 2026

This policy explains how NativePen ("we") handles personal data when you use the NativePen macOS app, the website at https://nativepen.app and your NativePen account (together, the "Service").

1. Data we collect

• Account data: your email address, name and avatar, provided when you sign in with Google, GitHub or email. We also keep sign-in sessions and the Macs you have authorized.
• Text you submit: the text you select in the app and your instruction for each request. See section 3 for how it is handled.
• Request metadata: for each request we log the timestamp, the model used, the character count, the credits used and any error codes.
• Credits and billing data: your credits ledger (credits granted, used, returned and expired), orders and invoices. Payments are handled by our payment processors. We never see or store your full card number.
• Technical data: IP address, browser or app version and similar data needed to run and secure the Service.
• Cookies: see section 7.

2. How we use it

• To provide the Service, including running requests and tracking credits.
• To process payments and keep billing records.
• To secure the Service and prevent abuse, including enforcing the Acceptable Use Policy.
• To answer support requests.
• To send transactional email, such as sign-in links and receipts.
• To understand how the website is used, through analytics.

3. The text you submit

When you make a request, the app sends the selected text and your instruction to our server. Our server forwards them through OpenRouter to the AI model provider that runs the selected model. By default these are Qwen3 235B (Qwen, by Alibaba Cloud) and DeepSeek V3 (DeepSeek). The list of models may change.

We do not store the text you submit or the output by default. We only keep the request metadata described in section 1. OpenRouter and the model providers process the text to produce the result and handle it under their own policies.

Do not submit sensitive personal data, such as health or financial details, unless you are comfortable with it being processed by these providers.

4. Who we share data with

We share data only with service providers that help us run the Service, and only as needed for their job:

• OpenRouter and the AI model providers it routes to, for the text you submit.
• Cloudflare (United States region), for hosting and network delivery.
• Neon (United States), for the database.
• Resend, for transactional email.
• Our payment processors (Stripe or Waffo), for payments.
• Google Analytics 4, for website analytics, if enabled.
• Google and GitHub, when you choose them to sign in.

We do not sell your personal data. We may disclose data if the law requires it or to protect the rights and safety of users and the Service.

5. Data retention

• Account data, sessions and credits ledger: kept until you delete your account.
• Request metadata logs: kept for 90 days.
• Text you submit: not stored by default.
• Orders and invoices: kept as long as tax and accounting law requires, even after account deletion.

6. Your rights

Depending on where you live, including under the GDPR and the CCPA, you may have the right to:

• access the personal data we hold about you;
• correct it;
• delete it;
• export it in a portable format;
• object to or restrict certain processing;
• withdraw consent where we rely on consent.

To use any of these rights, email support@nativepen.app from the address on your account. We will respond within the time the law requires. We do not discriminate against you for using your rights. You may also complain to your local data protection authority.

7. Cookies

We use essential cookies to keep you signed in and to keep the Service secure. These are required for the Service to work. If analytics is enabled, Google Analytics 4 sets cookies to measure how the website is used. You can block or delete cookies in your browser settings. Blocking essential cookies will prevent you from signing in.

8. International transfers

We and our service providers process data in the United States and possibly other countries. These countries may have different data protection laws from the country where you live. Where required, we rely on standard contractual clauses or equivalent safeguards for these transfers.

9. Security

We use encryption in transit and access controls to protect your data. No system is completely secure, so we cannot guarantee absolute security.

10. Children

The Service is not for children under 13, and we do not knowingly collect their personal data. If you believe a child under 13 has given us personal data, email support and we will delete it.

11. Changes

We will post updates on this page and change the effective date above. For material changes we will also notify you by email.

12. Contact

NativePen, https://nativepen.app. Email: support@nativepen.app.