Therafolio

1. Data collection

We collect nothing. The app has no account and no sign-in, and there is no server of ours that could hold your records, because there is no server. We do not receive your name, your email address, your clients' details, your notes, your calendar, your AI requests, or any record of how you use the app. No analytics, advertising, tracking or crash-reporting software is included in the app.

2. Where your records live

Client files, session notes, appointments, templates and attachments are written as Markdown files into the folder you pick when you first open the app. That folder can be on one computer only, or inside a sync service such as iCloud Drive, Dropbox or OneDrive. The app does not provide sync and does not require it.

• Folder names are coded (for example c-0042), so a client's name does not appear in Finder, in File Explorer or in a sync service's file list. Names do appear inside the files.
• Process notes are kept in a separate folder and are never included in the official record the app exports to PDF.
• Backups of the previous version of each file the app changes are kept inside the same folder, in .attune/backups/, and are protected exactly as the files are.

If you keep the folder in a sync service, that service holds a copy of your records. That is its job, and it is what lets you work on two devices. Your relationship with it is your own, and its privacy policy, not this one, applies to it.

3. Data stored on your device only

Outside the folder, the app keeps a few things on this device only, in its own data folder (on the Mac, ~/Library/Application Support/com.yybd.attunetherapy/, or the same folder inside the app's sandbox container in the Mac App Store version):

• a search index of your records, built from the files and rebuilt from them when deleted;
• drafts of notes you have not finished, so a half-written note does not sync to your other devices;
• which folder to reopen, and your app-lock settings. The passcode itself is never stored: only a salted Argon2id hash of it;
• the on-device AI model, if you downloaded one (3.3 or 5.2 GB). It is kept outside your records folder, so it does not sync, and it can be removed in Settings;
• the AI audit log described in section 5.

If you enter an Anthropic API key, it is kept in your operating system's keychain (Keychain on Apple devices, Credential Manager on Windows), never in a file, and is read only at the moment of a request.

None of this is sent anywhere. Deleting the app and its data folder removes it. Your records stay in the folder you chose until you delete them.

4. Encryption: what protects your records, and what does not

The app does not encrypt your files. They are ordinary Markdown files, on purpose: that is what lets them open in any text editor or in Obsidian, and stay readable if the app is ever gone. Encryption inside the app would add a failure with no way back: a forgotten password would mean losing every record, backups included.

What protects them:

• The app lock: a passcode, Touch ID, Face ID or Windows Hello, with automatic locking. On iPhone and iPad the app-switcher preview is blurred. The lock can be switched off in Settings, and the app says plainly what that means when you do. While an API key is stored, the passcode must be at least 8 digits.
• Your device's encryption: FileVault on the Mac, BitLocker or Device Encryption on Windows, and the built-in encryption of iPhone and iPad. This is the main protection, and it is yours to switch on. Please make sure it is.
• Your sync service's encryption, if you use one.

The app lock protects the app, not the files: anyone who can open your device's folders can read them. Keep your device locked and encrypted.

5. AI features

The app can help with four tasks: preparing for a session, a periodic summary, rewording a rough note in professional language, and turning a dictation transcript into a draft note. They are off until you use them, and two rules apply whichever model does the work:

• Consent first. No AI request can be built for a client until the date of that client's consent to AI processing is recorded in their file.
• Every result is a draft. You accept or discard it; nothing is written into the record on its own.

The on-device model (the desktop app, on Mac and Windows). The default is Gemma 4, Google's open model, which runs inside the app on your computer. You download it once, at your request, from Hugging Face (section 7). After that, AI tasks run offline: no text from your records leaves the computer, and no key, account or pseudonymisation is involved. iPhone and iPad have no on-device model.

Claude, optional, with your own key. If you enter an API key from your own Anthropic account, you can choose Claude for a task instead. Then:

• before anything is sent, the names, ID numbers and contact details held in the client's file are replaced mechanically with placeholders, and restored when the answer comes back;
• you see exactly the text that will be sent before you send it;
• the request goes from your device directly to Anthropic (api.anthropic.com). Nothing passes through us, and we never see your key, your requests or Anthropic's answers.

This is pseudonymisation, not anonymisation. Only what the app knows as fields of the client file is replaced. A clinical note can identify a person by other details, such as an employer, a school, a family member mentioned in a session, or a rare diagnosis in a small town, and those are sent as written. Read the preview with that in mind.

What Anthropic does with the text is governed by your agreement with Anthropic, not by this policy. At the time of writing, Anthropic states that for API users it deletes inputs and outputs within 30 days, with exceptions such as a zero-data-retention agreement, enforcement of its Usage Policy, or legal requirements (Anthropic Privacy Center), and that by default it does not use API inputs or outputs to train its models (Anthropic Privacy Center). Check Anthropic's current terms before relying on them.

The AI audit log. Each AI request, local or Claude, adds one line to a log on this device (ai-log.jsonl in the app's data folder): when, which client (by its coded folder name), which task, which model, which file versions (by hash), how many tokens, and whether you accepted the result. The log has no field for content, so it never holds clinical text.

6. Professional guidance for Israeli psychologists

The Israel Psychological Association's ethics committee published guidelines for the use of AI on 23 March 2026 (עקרונות וכללי אתיקה לשימוש בכלי בינה מלאכותית בעבודת הפסיכולוג, PDF, Hebrew). They say that psychologists may not enter client information into public commercial AI tools, and name Claude among them, even when identifying details are changed. Client-specific work is allowed only in dedicated systems secured for therapeutic work, with the client's written consent.

The pseudonymisation described in section 5 does not make the Claude option compliant with these guidelines, and we do not present it as such. If you are a psychologist in Israel, use the on-device model, or no AI. Therapists in other professions and countries should check the rules that bind them.

7. Network connections

The app connects to the network only in these cases:

• Downloading the on-device model, once, when you ask for it: from huggingface.co, at a fixed version, checked against its SHA-256 checksum before use. The request carries no data about you or your clients; like any web request it reveals your IP address to Hugging Face (privacy policy).
• Claude, only if you entered your own key and send a request, as described in section 5.
• The update check, in the versions downloaded from our website (Mac and Windows) only. To find out whether a newer version has been released, the app fetches a small file from storage.bdtech.app, hosted on Cloudflare R2. That request carries no personal data, no identifier and nothing about your clients; it reveals your IP address and the app version to the host, and Cloudflare may log it as part of operating the service. If an update is available, the app asks you before installing it, and updates are verified with a cryptographic signature first. App Store versions are updated by the App Store.

If you neither download the model nor use Claude, the App Store versions make no network connection at all. Files you keep in a sync service are moved by that service, not by the app.

8. Calendar

If you choose to publish appointments to a calendar, the app asks for access to your device's calendars (on Mac, iPhone and iPad) and writes into the one you pick. It writes the time and length of each appointment only. The title is "Session", or the client's initials if you choose that; no name, no content and no notes are written. Cancelled appointments are removed. Your calendar provider (iCloud, Google, Exchange) then syncs those entries with the account you added to your device; the app holds no account and no token for it. The .ics export follows the same rule.

9. Your rights, and your clients'

The records are yours. They are in your files, in your folder: you can copy, back up, move, open in another program or delete them without asking us, and without our knowing. Because we hold no data about you or your clients, there is nothing for us to access, correct, export or delete on request.

As the therapist, you are responsible for your clients' records under the law that applies to your practice, including the consent you obtain before using AI on their records. The app exports an official record to PDF so you can give it to a client who asks to see theirs; your process notes are not included in that export.

10. Third-party services

The app embeds no third-party analytics, advertising, tracking or crash-reporting SDK. It can connect to:

• Hugging Face, which hosts the on-device model files (section 7);
• Anthropic, only with your own key (section 5);
• Sparkle (Mac) and WinSparkle (Windows), the open-source updaters in the versions downloaded from our website, which talk only to our own update feed.

The on-device model is Gemma, published by Google; it runs on your computer and sends nothing to Google.

11. Purchases

The app is free during the beta. It has no account, subscription or in-app purchase, and so holds no billing information. Claude usage is billed by Anthropic to your own Anthropic account.

12. Children

The app is a professional tool for therapists and is not directed at children. It may hold records about clients who are minors, which you enter and which stay in your folder, as described above.

13. Changes to this policy

If this policy changes, the updated version will be published on this page with a new "last updated" date. Material changes, including any new way data can leave your device, will also be noted in the app's release notes before they take effect.