Privacy policy

Effective September 24, 2026. Apple Core is developed and operated by Oliver Ames.

You choose what to share

Apple Core connects AI clients to services on your Mac through the Model Context Protocol (MCP). The services available depend on the permissions you enable. They can include calendars, contacts, reminders, notes, messages, mail, files, location, screen or camera capture, audio, shortcuts, and system information.

Enabling a service makes its available tools accessible to authorized clients. Some tools can change data. Review the permissions and actions requested by your AI client. You can disable services, remove shared folders, disconnect clients, or quit Apple Core to stop access.

Where requests and results go

For a local connection, the client communicates with Apple Core on your Mac.

With Apple Core hosting, requests pass through Cloudflare infrastructure operated for Apple Core and an encrypted connection to your Mac. The relay processes requests and results in memory to deliver them, including authentication information and tool content it can read while forwarding. Its application code does not persist MCP request or response content. Cloudflare may process network and operational information, including IP addresses, to deliver and protect the service. See Cloudflare’s privacy policy.

Your AI provider receives the information returned by the tools you use. Its storage, training, and retention practices are governed by that provider’s policies and your account settings. Disconnecting Apple Core does not delete information already received by an AI provider.

Connection information

Apple Core stores its settings, service choices, connection credentials, and OAuth client authorization records on your Mac. The hosted service stores installation credential hashes, invitation records with expiry times, and associated account or billing identifiers to authenticate and manage your connection. It also stores daily and monthly request counters and pause state to enforce usage limits and suspend access. IP addresses and connection identifiers are used to limit request rates. Treat invitation codes and connection tokens as secrets.

Shared folder access uses macOS permission bookmarks. Removing a folder from Apple Core removes its configured access without deleting the folder’s contents.

Hosted accounts and email verification

When hosted accounts are available, sign-in uses a single-use email link to verify access to your email address. Apple Core sends your address and the sign-in message, including its link, to Resend for delivery. Resend processes recipient addresses, message content, and delivery metadata under its data processing terms.

The hosted account database on Cloudflare stores a keyed hash to find your account. This value is derived from your email address using a secret key. The database does not store the email address itself. The service also stores a randomly generated account identifier, sign-in and session token hashes with expiry times, and sign-in attempt counters. Mac registration records include connection identifiers, setup state, and invitation hashes and expiry times where applicable. These records associate your sign-ins, subscription, and Mac connections with the same account.

Account pages use secure cookies to verify that sign-in finishes in the browser that requested it and to maintain your signed-in session. The service uses IP addresses and attempt counters to limit sign-in requests, and stores shared email delivery counters to limit sending.

Purchases and support

Apple Core is free to use on your Mac. Hosted access is currently an invitation-only beta. A paid hosted plan through RevenueCat Web Billing, with Stripe processing payments, is planned, but paid signup is not yet available.

When checkout is available, Apple Core will send RevenueCat your randomly generated account identifier to associate purchases with your verified account. Apple Core reads subscription identifiers, access, renewal, and expiry information from RevenueCat to check hosted access and provide billing management. Checkout collects the email address and billing information you enter, and Stripe processes your payment details. You enter payment card details directly in the provider’s checkout. See RevenueCat’s privacy information and Stripe’s privacy policy.

If you contact support, the information you provide is used to investigate and respond. Do not post connection tokens, private files, or personal tool results in public support reports.

Control and contact

You can revoke macOS permissions in System Settings and disconnect authorized clients in Apple Core. For hosted enrollment removal or privacy questions, contact Oliver Ames through Apple Core support. A public report should contain only a general description of your request.

This policy may be updated as Apple Core changes. The effective date above identifies this version.