CursivCursiv Privacy Policy
Effective date: October 20, 2026
This policy describes the Cursiv desktop software and the Cursiv website features reviewed for this release. Local processing is available for supported features, but some website and online features send information to servers or providers. Local storage does not by itself guarantee security.
Desktop app: local processing and storage
When you use an installed compatible model through the local Ollama runtime, your prompt is processed on your computer. Cursiv can also use local conversations, memory, documents, reference material and calculations. What works offline depends on the feature, model, configuration and files already installed.
The desktop app stores conversations and other user data on the computer. Conversations and memories are not encrypted on disk. On a standard Windows install, saved AI keys use Windows DPAPI, which protects those keys for the same Windows account on the same computer. macOS keys use the login Keychain. DPAPI does not encrypt other app data, and portable USB copies may contain readable keys. Protect access to the computer, backups, exports and USB drives.
Phone Field Notebook: browser-local records
The Field Notebook saves entries, photos and settings in IndexedDB, a database stored by the browser on that phone. The notebook code does not automatically upload these records. “Send to laptop” creates a file for you to transfer to the computer; it does not send the records to Cursiv's server.
The browser may clear this storage, and it can be lost if site data is removed or the browser removes stored data. The notebook asks the browser to keep storage persistent where supported, but that request is not a backup or guarantee. Export and keep a separate copy of important records.
Phone AI Companion: server-backed conversations
This is separate from the Field Notebook. When paired and used, the Phone AI Companion sends your message and any photo you submit to Cursiv's Worker service. The service stores user messages, AI replies and submitted images in Cloudflare D1 so the paired phone and desktop can access the conversation.
For an answer, the service sends the prompt, recent conversation text and any submitted image to Google Gemini when configured. If Gemini is not configured or does not return an answer, the service can use Cloudflare Workers AI when available. Those providers receive the content included in that request under their own terms and privacy practices.
When the phone is linked, memory-summary sharing is on by default unless you turn it off on the desktop. Cursiv sends a short memory summary and optional name to the paired space. Turning sharing off sends an empty summary that clears the stored summary. Do not treat this server-backed feature as local-only or offline.
Optional AI providers and internet access
If you configure and select an external AI provider in the desktop app, the prompt and any submitted content needed for that request may be sent to that provider. The provider's own terms and privacy policy govern its handling, retention and possible use of that information. Cursiv cannot make promises about a provider's retention or model-training practices.
The desktop app's optional Cursiv Cloud feature sends the conversation needed for that answer to Cursiv's Worker service. The service tries configured Google Gemini and can fall back to Cloudflare Workers AI. Local-model inference remains on the computer; enabling Cursiv Cloud sends the request to the service and selected provider.
When you ask the desktop app to search the web, your query is sent to DuckDuckGo or Brave, depending on the configured search provider. When you ask it to read a page, it requests the URL you provide from that website. Model/runtime downloads and update checks contact their respective download or GitHub services when you initiate them or enable automatic checks. Some website pages load fonts from Google Fonts; when you view one of those pages, your browser requests font resources from Google. See Google's Privacy Policy.
When you choose a linked external service such as GitHub, Ollama or SignPath, that service's own privacy policy applies to your visit.
Other website services and information they handle
- Cloudflare hosting and logs: the site and API run on a Cloudflare Worker and use Cloudflare D1. The repository enables Worker observability, but does not specify or expose the account's log configuration, access, retention or deletion settings. Cloudflare may process connection and request data to serve and secure the service. See Cloudflare's Privacy Policy.
- Rate-limit counters: the public demo stores the visitor IP address with a count and guard score. The hourly count window resets in the application, but the code does not automatically delete the IP row. Cursiv Cloud stores the visitor IP with daily counts; the app's daily limit resets at UTC midnight, but its code does not automatically delete old counter rows. The demo also stores per-day aggregate counts. The report endpoint stores a truncated SHA-256 hash (16 hexadecimal characters) of the visitor IP for its daily limit; this is pseudonymous data, not a guarantee of anonymity.
- Phone AI Companion data: D1 stores message text, AI replies, timestamps, paired-space identifiers and submitted images. Memory-summary sharing is on by default for a linked phone unless turned off; a desktop user can clear the summary by disabling sharing, but this does not delete the conversation. Pairing codes expire after ten minutes and are single-use; they are removed when used or when another code is generated for that space. The inspected application has no user-facing or automatic deletion/expiry route for saved messages, images, spaces or paired-device records. Do not submit content you do not want stored by the service.
- Public board: usernames, PBKDF2 password hashes and account records are stored in D1. Posts show their text, username and time publicly. You can delete your own posts; the inspected app has no self-service account deletion. The public feed only displays posts from the last 30 days, but this display filter does not delete older posts from the database.
- Sealed letters: the Worker encrypts the subject and body with AES-GCM before storing them in D1. The encryption key is derived from the Worker's
CURSIV_BOARD_SECRET, and the Worker also decrypts letters to display them. This is encryption at rest, not end-to-end encryption: the service can access plaintext. D1 also stores sender and recipient account identifiers/names, a record ID, creation/read timestamps, and encryption fields. The inspected app has no letter deletion or automatic expiry route. - Problem reports: only when you choose Send, the desktop app transmits an install ID, app version, operating-system and Python version information, selected diagnostics (such as Ollama status, installed model names, configured provider names, Cursiv Cloud status and data-folder names), your optional note, and a preview of recent Cursiv log excerpts. The app attempts to remove recognized key/token patterns, email addresses and the OS account name, but this is not a guarantee that all sensitive content is removed; review the preview before sending. The service stores the report and a truncated IP hash used for the daily limit. The inspected app has no user-facing deletion or automatic expiry route and publishes no retention period.
- Browser chat page: the separate chat page stores its settings and memory in browser local storage and sends prompts to the Ollama URL configured on that page, which defaults to the local computer. If you change the URL to a remote server, that server receives the requests.
- Analytics and cookies: the website files reviewed contain no analytics or advertising scripts and do not set first-party tracking cookies. Cloudflare security features may process request details or use security cookies depending on the account configuration.
Deletion, expiration and backups
The application behavior described above is based on the repository routes and database schema. Users can delete their own public-board posts and can clear the optional phone memory summary; the inspected app does not offer account removal, letter deletion, report deletion, or deletion of stored phone conversations and images. Some data has application-level expiry or display limits, as described above; these do not necessarily remove database records.
A maintainer with database access may be able to remove records directly, but the repository does not document an administrative deletion procedure, backup schedule, backup-retention period, or when deleted records are removed from backups. These account and infrastructure practices require maintainer and Cloudflare account review. No specific retention period is promised by this policy.
Cloudflare Worker observability is enabled in the repository configuration. The actual logs available, who can access them, how long they are retained, and whether additional logging or security-cookie settings are enabled must be confirmed in the Cloudflare account. Cloudflare's handling is also subject to its Privacy Policy.
Contact and policy updates
No private privacy-contact address is published in the project materials reviewed. For a privacy question, use the project's GitHub Issues. Issues are public, so do not include passwords, access tokens, private prompts, photos or other sensitive information.
This policy may be updated as the project and its services change. The effective date at the top will be revised when the policy changes. It describes the implementation reviewed and is not a legal certification or guarantee of compliance.