Cardinate Consulting LLC app privacy.

Introduction

This Privacy Policy applies to software applications published by Cardinate Consulting LLC and review-stage applications prepared for Apple App Review, including Cardinate Fitness, Cardinate Remote Watch, Saturn PhotoGraph, GPX PhotoGraph, PhotoGraph Watch Tracker, Exif PhotoGraph, Analog PhotoGraph, Crop PhotoGraph, PhotoGraph Shared Album Sync, MPP Viewer, MPP Project Wizard, Metadata Localizator, PaperSnap PDF Scanner, RouteGlance, Recovery PhotoGraph, TreeDeck - File Browser, Pittie's BSL Map, CouchMail, IMAP Archiver & Cleaner, Pirate’s Treasure, WireSwitch VPN, and related companion apps.

This policy does not apply to our websites or other services, which may be governed by separate privacy terms.

Our Privacy Commitment

• No Cardinate accounts, Cardinate logins, or ads.
• Most Cardinate apps work locally on your device or in your personal iCloud account. The optional MPP Project Wizard AI Planner and Metadata Localizator AI Auto-Translate features are the limited exceptions described below.
• These optional AI features use Cardinate-operated services to verify an active App Store subscription, manage usage allowances, and relay a request to OpenAI only when you choose to use the feature.
• No advertising, analytics, tracking, or sale of personal information.

Data We Do Not Collect

Except for the optional MPP Project Wizard AI Planner and Metadata Localizator AI Auto-Translate features and their subscription and usage services, our apps do not transmit or store your personal information on Cardinate Consulting servers. We do not run advertising or analytics SDKs, use data for tracking, or sell personal information. CouchMail and IMAP Archiver & Cleaner process the email address, mail-server settings, credentials, and messages you provide solely on your device and in direct communication with your chosen email provider. Pirate’s Treasure processes vault data locally and communicates directly with websites, a user-selected WireGuard provider, ipwho.is when its optional IP location lookup is enabled, and devices you choose for local transfers; Cardinate does not receive that data.

Data Processed By App

Third-Party Services

Some features may use Apple system services, Apple Maps, Apple Health, iCloud, mail providers, or government and meteorological services to provide route, weather, location, health, storage, email, or platform functionality. Those services are governed by their own terms and privacy policies.

MPP Project Wizard’s local file opening, editing, conversion, saving, and PDF generation do not require the Cardinate service. If you choose the optional AI Planner, the app sends your request, recent planner conversation, a structured snapshot of the open project, and any reference documents or images you explicitly attach to the Project File AI service. That service verifies the Apple-signed subscription transaction and forwards the AI request to OpenAI. It does not upload the original .mpp file or grant OpenAI direct access to your device or file system, but the structured project snapshot and attached reference material may contain sensitive project information.

The Project File AI application database does not store project snapshots, chat text, attached reference-document contents, raw files, or AI responses. It does retain the pseudonymous identifier derived from an App Store transaction, transaction and subscription status, credit balances and ledger events, request identifiers, task count, model, token and cost metadata, status or failure code, timestamps, and OpenAI request ID where supplied. OpenAI API requests use store: false, which disables Responses API application-state storage. OpenAI may nevertheless retain API inputs, outputs, and related abuse-monitoring logs for up to 30 days under its API data controls, unless it has approved different controls for the service. OpenAI does not use API data to train its models by default.

Metadata Localizator communicates directly with Apple’s App Store Connect API to load supported app, version, product, subscription, subscription-group, and Game Center achievement metadata. Its .p8 private key signs authentication tokens on your Mac and is not uploaded to Cardinate Consulting. Sending reviewed edits updates the selected metadata at Apple, and creating a language immediately creates that localization. The app does not submit content for review or release an app version.

If you confirm an AI Auto-Translate request, Metadata Localizator sends the selected source metadata or screenshot copy, field names, character limits, and language identifiers to Cardinate’s translation service and then to OpenAI. Screenshots themselves and App Store Connect credentials are not sent. The service verifies the signed App Store transaction without intentionally retaining the raw transaction. It does not retain submitted translation text or translated responses, but stores the pseudonymous subscription and usage records described above to provide the feature, apply reasonable monthly fair-use limits, and prevent abuse. Cloudflare hosts the translation service and database and may process ordinary network and security information, such as IP addresses and request headers, to deliver and protect the service. OpenAI’s separate security and retention rules may apply.

Manual editing in Metadata Localizator is included with the app purchase. AI Auto-Translate is a $4.99 monthly auto-renewing subscription processed by Apple and includes reasonable monthly fair use. Usage may be rate-limited, and repeated, automated, or unusually heavy use may be paused to protect service availability; manual editing remains available. Apple processes App Store Connect requests, subscription purchases, and transaction verification. See the Apple Privacy Policy, OpenAI Privacy Policy, and Cloudflare Privacy Policy.

TreeDeck operates locally unless you explicitly use its movie or TV metadata lookup. For that optional feature, TreeDeck cleans the selected filename on your Mac and sends only the resulting title and, when available, year, season, and episode numbers directly to Wikidata or TVmaze. It does not send the file contents, full filename, file path, EXIF data, Photos-library data, or usage information. Lookup results are cached locally and can be cleared in TreeDeck's Settings.

When you use CouchMail or IMAP Archiver & Cleaner, the app connects directly from your device to the incoming mail server you configure. Your email provider processes your account credentials, mailbox requests, and message data under that provider's own terms and privacy policy. Neither app routes email or credentials through Cardinate Consulting.

Pirate’s Treasure encrypts vault content and metadata on the device. Its browser connects directly to the websites you visit. Those websites receive your public IP address, request headers, and information you submit, subject to their own privacy practices. Browser cookies are held in memory, optional saved tab URLs are encrypted in the vault, and downloads use an ephemeral session and the browser’s in-memory cookies. Media downloads require appropriate rights and do not bypass technical protections.

When you connect a user-supplied WireGuard profile in Pirate’s Treasure, the provider named in that profile receives your public IP address and tunnel authentication data and processes traffic and DNS requests covered by the profile under its own privacy policy. Pirate’s Treasure presents this information before the first VPN connection, does not operate a VPN service, and does not retain connection logs. Profiles are encrypted locally, and the tunnel extension receives only a temporary system-protected configuration.

Pirate’s Treasure’s optional IP location lookup is disabled until you enable it. When enabled, the app sends your public IP address directly to ipwho.is after unlocking and when VPN state changes to estimate your city, region, and country. It sends no GPS location or vault content, keeps the result only in memory, and lets you disable the feature in Settings.

Pirate’s Treasure’s nearby-sharing feature advertises the app and device name on the local network only while sharing is open. Selected names and file content are sent to connected peers over encrypted transport. Received files remain temporarily under system file protection until accepted or discarded. Its optional Local Web Interface listens only while that screen is open and uses a random access URL. A device with that URL on the same local network can view filenames, download files or folder ZIP archives, and upload files into the encrypted vault. This local HTTP transport is not end-to-end encrypted, so the app advises using a trusted network and stopping the interface after transfers finish.

Contact

For privacy questions, contact support@cardinate-apps.com.

Permissions

Apps only request permissions necessary for their core functionality. You can review or revoke permissions at any time in Settings under Privacy & Security, including Location Services, Photos, Health, Camera, Files, Local Network, and VPN access where applicable.

Data Sharing

We do not sell personal information or share it for advertising, analytics, or tracking. Any sharing you initiate, such as AirDrop, export, archive creation, or the standard Apple share sheet, is handled by Apple’s system interfaces and selected destinations.

MPP Project Wizard shares data with Cardinate’s Project File AI service and OpenAI only when you use AI Planner. The service uses your Apple-signed transaction information to validate the subscription and sends the planner material described above to OpenAI to generate a response or proposed schedule change. It does not share that material with advertising or analytics providers.

Metadata Localizator shares selected text and related translation instructions with Cardinate’s translation service and OpenAI only after you confirm an AI Auto-Translate request. It shares signed transaction information with the service to validate the subscription. Screenshots and App Store Connect credentials are not sent, and neither translation content nor service usage records are shared for advertising.

CouchMail and IMAP Archiver & Cleaner send mailbox requests and credentials only to the mail server selected or configured by the user. Common-provider templates may automatically fill server addresses, but the connection remains directly between the user's device and that email provider. Archive or export files from IMAP Archiver & Cleaner are sent to another service only when the user selects that service or storage destination.

Pirate’s Treasure shares data only when required by a feature you choose: browsing data with visited websites, VPN authentication and covered traffic with the provider in an imported WireGuard profile, your public IP address with ipwho.is when optional IP location is enabled, or selected files and names with devices used for nearby sharing or the Local Web Interface. Cardinate does not receive this data. Files, encrypted backups, or other content you export remain under the recipient or destination’s control.

User Rights And Data Deletion

Our apps have no Cardinate user accounts. You can delete data created by our apps directly from your device, iCloud account, or selected storage destination. Removing an app removes its local app data subject to Apple platform behavior and any separate files you exported.

MPP Project Wizard stores its planner conversation, app settings, and any open or exported project files locally under your device and the locations you choose. You can clear the planner conversation from the AI Planner and remove files through Files or Finder. Removing the app removes its local app-container data but does not remove documents you saved elsewhere. The Project File AI service retains the subscription, transaction, credit, and AI-usage ledger described above while needed to provide the subscription, manage purchases and refunds, prevent abuse, resolve support matters, and meet legal obligations. It does not retain a server-side copy of the project or planner content. To ask about, access, correct, or request deletion of service-held data, contact support@cardinate-apps.com; we may need enough purchase information to locate and verify the relevant record.

Metadata Localizator keeps connection identifiers and preferences on your Mac. If you enable “Remember private key,” the key remains in macOS Keychain until you remove the saved credentials; otherwise it is used only in memory for the current session. Unsent drafts and imported screenshot projects remain in Application Support until you send, discard, or delete them. Exported files remain wherever you save them. The translation service retains its pseudonymous usage records as reasonably necessary for subscription operation, accounting, security, abuse prevention, and legal obligations. To request access to or deletion of those records, contact info@cardinate-consulting.com; we may need transaction information to locate the record and may retain information when legally required.

TreeDeck stores interface preferences, rename templates, security-scoped folder bookmarks, metadata lookup results, and review-reminder timing in its local app container. Its Transfer Deck is held only in memory and clears when the app quits. You can clear the lookup cache in TreeDeck's Settings; removing TreeDeck and its container removes the remaining locally stored app data but does not remove files you copied or exported.

In CouchMail and IMAP Archiver & Cleaner, you can remove a configured account to delete its settings and Keychain credential from the device. Deleting either app removes its locally stored account configuration but does not automatically delete archive files the user previously exported to another location. Email messages remain controlled by your email provider; deleting a message in either app sends a deletion request to that provider.

Pirate’s Treasure lets you delete files and folders within the app. Its live vault is excluded from automatic device backups, but you may export encrypted backups to destinations you choose. Exported backups and files shared outside the app must be deleted separately from each recipient or destination. Removing the app removes its local app data according to operating-system behavior. There is no Cardinate server account to delete.

Minors

Our apps are not designed for or directed at children, and we do not knowingly collect personal information from minors.

How We Safeguard Your Information

Most Cardinate app data is stored on your device and, where applicable, in your iCloud account, and is protected by those services’ security controls. MPP Project Wizard uses HTTPS for its optional AI Planner connection; its service limits its application database to the subscription, purchase, credit, and usage records described above. CouchMail and IMAP Archiver & Cleaner store mail-account passwords or app-specific passwords in the device Keychain. Account preferences are stored locally on the device. Connections to mail providers use TLS when enabled in the account configuration; users should keep TLS enabled and use an app-specific password whenever their provider supports or requires one.

Metadata Localizator stores a remembered App Store Connect private key in macOS Keychain. Its local drafts, imported screenshots, and exported files are not encrypted by Metadata Localizator, so you are responsible for securing your Mac and exported files.

Archive files created by IMAP Archiver & Cleaner may contain email content and attachments. Users are responsible for securing, retaining, sharing, and deleting those exported files.

Pirate’s Treasure encrypts vault content, metadata, imported WireGuard profiles, and saved browser-tab URLs locally. Nearby transfers use encrypted transport, and received files use system file protection while awaiting acceptance or deletion. Preview, download, and incoming-transfer temporary files are removed when the operation completes, is cancelled, or the feature cleans up; temporary files left by an interrupted process are swept on the next launch. The Local Web Interface uses unencrypted HTTP on the local network, so users should use it only on a trusted network and stop it when transfers are complete.

Updates

We may amend this Privacy Policy from time to time. The Last Modified date reflects the most recent revision.