Application privacy policy
Cardinate Consulting LLC app privacy.
Last modified: September 19, 2026
Introduction
This Privacy Policy applies to software applications published by Cardinate Consulting LLC and review-stage applications prepared for Apple App Review, including Cardinate Fitness, Cardinate Remote Watch, Saturn PhotoGraph, GPX PhotoGraph, PhotoGraph Watch Tracker, Exif PhotoGraph, Analog PhotoGraph, Crop PhotoGraph, PhotoGraph Shared Album Sync, MPP Viewer, MPP Project Wizard, Metadata Localizator, PaperSnap PDF Scanner, RouteGlance, Recovery PhotoGraph, TreeDeck - File Browser, Pittie's BSL Map, CouchMail, IMAP Archiver & Cleaner, WireSwitch VPN, and related companion apps.
This policy does not apply to our websites or other services, which may be governed by separate privacy terms.
Our Privacy Commitment
- No Cardinate accounts, Cardinate logins, or ads.
- Most Cardinate apps work locally on your device or in your personal iCloud account. The optional MPP Project Wizard AI Planner and Metadata Localizator AI Auto-Translate features are the limited exceptions described below.
- These optional AI features use Cardinate-operated services to verify an active App Store subscription, manage usage allowances, and relay a request to OpenAI only when you choose to use the feature.
- No advertising, analytics, tracking, or sale of personal information.
Data We Do Not Collect
Except for the optional MPP Project Wizard AI Planner and Metadata Localizator AI Auto-Translate features and their subscription and usage services, our apps do not transmit or store your personal information on Cardinate Consulting servers. We do not run advertising or analytics SDKs, use data for tracking, or sell personal information. CouchMail and IMAP Archiver & Cleaner process the email address, mail-server settings, credentials, and messages you provide solely on your device and in direct communication with your chosen email provider.
Data Processed By App
| App | Data processed | Purpose |
|---|---|---|
| Cardinate Fitness / Cardinate Remote Watch | Location, workout metrics, Apple Health | Record and display workout tracks and provide companion watch controls. |
| Saturn PhotoGraph | Location, device motion | Calculate celestial object positions and alignment guidance. |
| GPX PhotoGraph / PhotoGraph Watch Tracker | Location, background location when enabled, GPX files, photo and video metadata, saved places, automation settings | Create GPX tracks, auto-start recordings from saved places or schedules, auto-tag photos, and update photo or video locations. |
| Exif PhotoGraph | Photo library, EXIF metadata, optional location | Display and edit photo metadata. |
| Analog PhotoGraph | Photo library, location | Add photos with updated location information to the photo library. |
| Crop PhotoGraph | Photos | Crop images and export print-ready PDF layouts. |
| PhotoGraph Shared Album Sync | Photo library, shared albums, metadata | Identify and import missing shared-album items. |
| MPP Viewer | .mpp project files | Parse and display project plans and Gantt charts. |
| MPP Project Wizard | Locally: user-selected .mpp and XML project files, project content, settings, and AI Planner conversation history. When you use the optional AI Planner: your prompt, recent chat context, structured project snapshot (including project, task, date, dependency, resource, assignment, and note data), and any reference documents or images you choose to attach. Its service also processes Apple-signed transaction data and retains a pseudonymous subscription identifier, transaction and credit-ledger records, subscription status, AI usage metadata, and timestamps. | Edit projects and create PDFs locally; when requested, verify a subscription, meter AI allowance, and generate a proposed schedule change through OpenAI. |
| Metadata Localizator | Locally: App Store Connect connection identifiers and preferences, optional private key in macOS Keychain, unsent metadata drafts, imported screenshots, and exported files. When you use optional AI Auto-Translate: source metadata or screenshot copy, field names, character limits, language identifiers, and an Apple-signed transaction. Its service retains pseudonymous transaction hashes, subscription period and expiration information, target language, item count, token usage, estimated model cost, request status, and timestamps. | Load and edit localized App Store metadata; when requested and confirmed, verify an AI Auto-Translate subscription, meter reasonable monthly usage, and translate selected text through OpenAI. |
| PaperSnap PDF Scanner | User files, camera, photo library | Create and export user-generated PDF files. |
| RouteGlance | Saved addresses, route destinations, route options, weather and traffic requests | Compare commute routes and display weather, alerts, radar, travel time, and distance on iPhone, iPad, and Apple TV. |
| Recovery PhotoGraph | Selected disks, folders, photo libraries, recovered photo and video files | Scan local storage for recoverable media and export recovered files to a destination chosen by the user. |
| TreeDeck - File Browser | User-selected files and folders, file metadata, image and EXIF metadata, Photos-library items, local media libraries, saved folder bookmarks, app preferences, and optional cleaned movie or TV search terms | Browse, search, organize, copy, move, compare, sync, rename, and back up files or photos on the Mac. Optional movie and TV matching sends only a cleaned title and, when available, year, season, and episode numbers directly to Wikidata or TVmaze. |
| Pittie's BSL Map | Location, selected dog breeds, destination searches, recent address queries, map route data, locally bundled legal restriction data | Show current-area and route-based breed-specific-law guidance, map overlays, and driving navigation support. |
| CouchMail | Email address, mail-server settings, credentials, mailbox folders, message headers, email content, attachments, local account preferences | Connect directly to the user's chosen email provider to read, manage, and process mail as requested by the user. |
| WireSwitch VPN | WireGuard profiles, endpoint information, connection status, endpoint and public-IP location details | Connect to a user-selected WireGuard VPN server and display saved profiles and connection-location details. See the WireSwitch VPN privacy policy for app-specific details. |
| IMAP Archiver & Cleaner | Email address, IMAP server settings, credentials, mailbox folders, message headers, email content, attachments, archive/export files, local account preferences | Connect directly to the user's chosen IMAP provider to archive, export, clean, or delete mail as requested by the user. |
| Review-stage or template apps | Only the data types required by each app's stated function, such as photos, files, location, health, maps, or user-created settings | Provide the app feature under review by Apple. These apps follow the same no-account and no-ads principle unless their own privacy disclosure explains a service-based feature. |
Third-Party Services
Some features may use Apple system services, Apple Maps, Apple Health, iCloud, mail providers, or government and meteorological services to provide route, weather, location, health, storage, email, or platform functionality. Those services are governed by their own terms and privacy policies.
MPP Project Wizard’s local file opening, editing, conversion, saving, and PDF generation do not require the Cardinate service. If you choose the optional AI Planner, the app sends your request, recent planner conversation, a structured snapshot of the open project, and any reference documents or images you explicitly attach to the Project File AI service. That service verifies the Apple-signed subscription transaction and forwards the AI request to OpenAI. It does not upload the original .mpp file or grant OpenAI direct access to your device or file system, but the structured project snapshot and attached reference material may contain sensitive project information.
The Project File AI application database does not store project snapshots, chat text, attached reference-document contents, raw files, or AI responses. It does retain the pseudonymous identifier derived from an App Store transaction, transaction and subscription status, credit balances and ledger events, request identifiers, task count, model, token and cost metadata, status or failure code, timestamps, and OpenAI request ID where supplied. OpenAI API requests use store: false, which disables Responses API application-state storage. OpenAI may nevertheless retain API inputs, outputs, and related abuse-monitoring logs for up to 30 days under its API data controls, unless it has approved different controls for the service. OpenAI does not use API data to train its models by default.
Metadata Localizator communicates directly with Apple’s App Store Connect API to load supported app, version, product, subscription, subscription-group, and Game Center achievement metadata. Its .p8 private key signs authentication tokens on your Mac and is not uploaded to Cardinate Consulting. Sending reviewed edits updates the selected metadata at Apple, and creating a language immediately creates that localization. The app does not submit content for review or release an app version.
If you confirm an AI Auto-Translate request, Metadata Localizator sends the selected source metadata or screenshot copy, field names, character limits, and language identifiers to Cardinate’s translation service and then to OpenAI. Screenshots themselves and App Store Connect credentials are not sent. The service verifies the signed App Store transaction without intentionally retaining the raw transaction. It does not retain submitted translation text or translated responses, but stores the pseudonymous subscription and usage records described above to provide the feature, apply reasonable monthly fair-use limits, and prevent abuse. Cloudflare hosts the translation service and database and may process ordinary network and security information, such as IP addresses and request headers, to deliver and protect the service. OpenAI’s separate security and retention rules may apply.
Manual editing in Metadata Localizator is included with the app purchase. AI Auto-Translate is a $4.99 monthly auto-renewing subscription processed by Apple and includes reasonable monthly fair use. Usage may be rate-limited, and repeated, automated, or unusually heavy use may be paused to protect service availability; manual editing remains available. Apple processes App Store Connect requests, subscription purchases, and transaction verification. See the Apple Privacy Policy, OpenAI Privacy Policy, and Cloudflare Privacy Policy.
TreeDeck operates locally unless you explicitly use its movie or TV metadata lookup. For that optional feature, TreeDeck cleans the selected filename on your Mac and sends only the resulting title and, when available, year, season, and episode numbers directly to Wikidata or TVmaze. It does not send the file contents, full filename, file path, EXIF data, Photos-library data, or usage information. Lookup results are cached locally and can be cleared in TreeDeck's Settings.
When you use CouchMail or IMAP Archiver & Cleaner, the app connects directly from your device to the incoming mail server you configure. Your email provider processes your account credentials, mailbox requests, and message data under that provider's own terms and privacy policy. Neither app routes email or credentials through Cardinate Consulting.
Contact
For privacy questions, contact [email protected].
Permissions
Apps only request permissions necessary for their core functionality. You can review or revoke permissions at any time in Settings under Privacy & Security, including Location Services, Photos, Health, Camera, and Files access where applicable.
Data Sharing
We do not sell personal information or share it for advertising, analytics, or tracking. Any sharing you initiate, such as AirDrop, export, archive creation, or the standard Apple share sheet, is handled by Apple’s system interfaces and selected destinations.
MPP Project Wizard shares data with Cardinate’s Project File AI service and OpenAI only when you use AI Planner. The service uses your Apple-signed transaction information to validate the subscription and sends the planner material described above to OpenAI to generate a response or proposed schedule change. It does not share that material with advertising or analytics providers.
Metadata Localizator shares selected text and related translation instructions with Cardinate’s translation service and OpenAI only after you confirm an AI Auto-Translate request. It shares signed transaction information with the service to validate the subscription. Screenshots and App Store Connect credentials are not sent, and neither translation content nor service usage records are shared for advertising.
CouchMail and IMAP Archiver & Cleaner send mailbox requests and credentials only to the mail server selected or configured by the user. Common-provider templates may automatically fill server addresses, but the connection remains directly between the user's device and that email provider. Archive or export files from IMAP Archiver & Cleaner are sent to another service only when the user selects that service or storage destination.
User Rights And Data Deletion
Our apps have no Cardinate user accounts. You can delete data created by our apps directly from your device, iCloud account, or selected storage destination. Removing an app removes its local app data subject to Apple platform behavior and any separate files you exported.
MPP Project Wizard stores its planner conversation, app settings, and any open or exported project files locally under your device and the locations you choose. You can clear the planner conversation from the AI Planner and remove files through Files or Finder. Removing the app removes its local app-container data but does not remove documents you saved elsewhere. The Project File AI service retains the subscription, transaction, credit, and AI-usage ledger described above while needed to provide the subscription, manage purchases and refunds, prevent abuse, resolve support matters, and meet legal obligations. It does not retain a server-side copy of the project or planner content. To ask about, access, correct, or request deletion of service-held data, contact [email protected]; we may need enough purchase information to locate and verify the relevant record.
Metadata Localizator keeps connection identifiers and preferences on your Mac. If you enable “Remember private key,” the key remains in macOS Keychain until you remove the saved credentials; otherwise it is used only in memory for the current session. Unsent drafts and imported screenshot projects remain in Application Support until you send, discard, or delete them. Exported files remain wherever you save them. The translation service retains its pseudonymous usage records as reasonably necessary for subscription operation, accounting, security, abuse prevention, and legal obligations. To request access to or deletion of those records, contact [email protected]; we may need transaction information to locate the record and may retain information when legally required.
TreeDeck stores interface preferences, rename templates, security-scoped folder bookmarks, metadata lookup results, and review-reminder timing in its local app container. Its Transfer Deck is held only in memory and clears when the app quits. You can clear the lookup cache in TreeDeck's Settings; removing TreeDeck and its container removes the remaining locally stored app data but does not remove files you copied or exported.
In CouchMail and IMAP Archiver & Cleaner, you can remove a configured account to delete its settings and Keychain credential from the device. Deleting either app removes its locally stored account configuration but does not automatically delete archive files the user previously exported to another location. Email messages remain controlled by your email provider; deleting a message in either app sends a deletion request to that provider.
Minors
Our apps are not designed for or directed at children, and we do not knowingly collect personal information from minors.
How We Safeguard Your Information
Most Cardinate app data is stored on your device and, where applicable, in your iCloud account, and is protected by those services’ security controls. MPP Project Wizard uses HTTPS for its optional AI Planner connection; its service limits its application database to the subscription, purchase, credit, and usage records described above. CouchMail and IMAP Archiver & Cleaner store mail-account passwords or app-specific passwords in the device Keychain. Account preferences are stored locally on the device. Connections to mail providers use TLS when enabled in the account configuration; users should keep TLS enabled and use an app-specific password whenever their provider supports or requires one.
Metadata Localizator stores a remembered App Store Connect private key in macOS Keychain. Its local drafts, imported screenshots, and exported files are not encrypted by Metadata Localizator, so you are responsible for securing your Mac and exported files.
Archive files created by IMAP Archiver & Cleaner may contain email content and attachments. Users are responsible for securing, retaining, sharing, and deleting those exported files.
Updates
We may amend this Privacy Policy from time to time. The Last Modified date reflects the most recent revision.