Privacy

Refto keeps your images, videos, PDFs, documents and web pages in libraries on your Mac. The models that understand them (search by what a picture shows, the text in images and PDFs, what is said in a video) run on the Mac. Your files, their index and what the models make of them are never uploaded, and the app has no analytics.

The app goes online only for these:

• Activating and checking your code with refto.one: when you enter it, then about once a week. It sends the code, the app's version, the Mac's name as set in System Settings, its model identifier (such as Mac15,12), the macOS version and an identifier made from the Mac's hardware ID with a one-way hash. Nothing about your files or how you use the app.
• Updates: it reads the update feed on refto.one and downloads new versions from releases.refto.one.
• Models: they are downloaded once, from Hugging Face or a mirror of it (hf-mirror.com, mirror.actnow.dev).
• Things you save from the web: when you save a web page or a picture, Refto (or the browser extension) fetches it from the site it is on.

The browser extension hands what you save to Refto on the same Mac (127.0.0.1) and sends it nowhere else.

You need an account for licence codes, early access, likes and submissions; browsing does not. You sign in with an emailed link or code, a password, Google or GitHub. We keep:

• Your email address, whether it is verified, a name and, if you set one, a profile picture. With Google or GitHub we receive your name, email address and picture from them, and keep the tokens they return.
• A password, if you set one, stored as a hash.
• For each signed-in session: when it started, its IP address and the browser's user agent. Sessions last 7 days; you can end them in your profile.

• Codes: the code (encrypted), its type, the number of Macs, when it ends, and the account and email address it belongs to.
• Macs using a code: what the app sends (above), when it was activated and last seen, and the country and network (the first part of the IP address, such as 203.0.0.0/16) of the last check. You see these on your licences page.
• A log of each code's activations and checks with the same country and network. It is used to limit abuse: a code used from many networks is flagged for us to review.
• Early-access requests: your account, the optional note you write and whether we approved it.
• Emails we send about codes: to whom, which email and whether it was delivered.

When you download Refto from the download page we count it: the version, the time, your IP address, country and browser user agent, and your account if you are signed in. We use this to know how many people download Refto. Update checks from the app are not counted.

• Likes you give, linked to your account.
• Sites you submit: the address, title and description you enter, with your account and email address, and whether we accepted it.
• Views of a site's page, linked to your account if you are signed in, to rank what is trending.

refto.one uses Google Analytics to count page views and a few actions: searches, likes, opening a site or its details, filtering, playing a video and submitting a site. Google sets its own cookies for this. The Mac app does not use it.

The site's own cookies keep you signed in; your browser's storage keeps the theme and recent searches. There are no advertising cookies.

• Cloudflare runs refto.one: the site, its database, files (such as profile pictures and the app's downloads) and caches. It also keeps the site's request logs for a short time, which we use to fix problems.
• Resend sends our email: sign-in links and codes, and emails about licences and early access.
• Google and GitHub, if you sign in with them.
• Google Analytics, as above.

We do not sell your data or share it for advertising.

Your profile shows your account and sessions. Under Data management you can delete your likes, your submissions or the whole account. Deleting the account deletes your sign-ins, sessions, likes, submissions and early-access requests.

Licence codes and the records of Macs using them are kept when an account is deleted, so a code keeps working on the Macs it is on. To have those, your downloads or anything else deleted, or to get a copy, email hi@refto.one from your account's address. We do not delete these records on a schedule yet, so ask us.

When this changes we update this page and the date on it. Questions: hi@refto.one.