Back to Toone

Privacy Policy

Updated: October 3, 2026

Toone is built around local organization files and working context. This policy distinguishes that local product data from information you choose to submit through the website, waitlist, contact form, or account service, and from the features that send information off your Mac.

Toone Editions

Toone for Mac comes in two editions: Toone (Direct), downloaded from trytoone.com, and Toone (Mac App Store), distributed by Apple. Where the editions handle information differently, this policy says so.

Local Product Data

Toone does not receive your local organization files or working context merely because you use the desktop app. That includes:

Information You Submit

We receive information you deliberately provide when you create or sign in to an account, join the early-access waitlist, or send a contact request. Depending on the action, this can include your name, email, company, message, and authentication data. Waitlist entries are sent to the Toone backend, contact requests are delivered to the team's communications system, and account data is processed by the Toone account service. We use this information to provide the requested service, respond to you, protect the service, and administer early access.

If you choose Sign in with Apple on the website or in Toone (Mac App Store), Apple returns an identity token: a statement signed by Apple that contains a stable Apple account identifier and, when available, your email address. That address may be an Apple private relay address if you chose to hide your email. The first time you authorize Toone, Apple may also provide your name. The website or the app sends the identity token and that name to the Toone account service, together with any invitation code you are redeeming on the website. The account service checks Apple's signature and uses the identifier, email address, and name to find or create your Toone account. Neither the website nor the app sends Apple's authorization code to Toone, and Toone does not store Apple access or refresh tokens. The Mac app also keeps Apple's account identifier with your session on your Mac, so it can sign you out if you stop using Sign in with Apple with Toone. Apple handles your authentication under its own privacy policy.

Website analytics events do not include form text, names, email addresses, passwords, authentication tokens, or account identifiers.

Usage Analytics

Toone (Direct) sends usage events, such as "an organization was created," to our self-hosted analytics (Umami). Events never include prompts, conversations, file contents, file paths, routine steps, agent instructions, or organization names. When you are signed in, events are linked to your Toone account ID, and your email, name, and public handle (if you have claimed one) are stored with the analytics session. When you are signed out, events use a random per-install identifier instead. You can turn usage analytics off at any time in Settings, which also discards events that have not been sent. Toone (Mac App Store) does not include usage analytics.

With your permission, this website loads our self-hosted, cookieless analytics to count visits and clicks. Website analytics is not linked to your account. It sets no analytics cookies and does not track you across sites. Declining analytics does not affect your access to the site. You can change your choice at any time using .

Cookies & Browser Storage

Choosing a language in the language menu or the language suggestion stores a cookie named toone_locale for up to 12 months, so trytoone.com opens in that language next time. Dismissing the language suggestion stores toone.locale.dismissed in your browser's local storage, which is not sent to Toone. The site stores your analytics choice in your browser for up to six months. Sign-in stores an account session in your browser for authenticated features, until you sign out or the session expires. If you decline analytics, its script is not loaded; allowing it adds no analytics cookie. When a sign-in page shows the Sign in with Apple button, it loads Apple's sign-in script and button image from Apple's servers, so Apple receives ordinary connection information such as your IP address.

Local-First Architecture

Conversations, files, and project data are stored on your device. Toone does not upload that local working context to its account, website, or analytics services on its own. It leaves your Mac when you use a feature that needs it: requests to your AI provider, the cloud relay, a Business, Live Share, and sharing a routine on Explore, each described below. If you use speech input, macOS speech recognition turns your voice into text; depending on your language and system settings, Apple may process that audio on its servers. Account data, waitlist requests, contact requests, and Toone Pro purchases are handled separately as described in this policy.

Third-Party AI Providers

Toone connects to AI providers by letting you connect your own account. Toone (Direct) supports Anthropic Claude and OpenAI Codex; Toone (Mac App Store) supports OpenAI Codex only. You sign in through each provider's own command-line tool, which Toone runs for you and which opens the provider's sign-in page in your browser. When you send a message or run a routine, the request is transmitted directly from your device to the provider's API. A request can include your prompts and the files, tool output, and built-in browser content the agent works with. Toone does not proxy, log, or retain these requests. Please refer to your chosen provider's privacy policy for how they handle your data:

Mobile Companion App

The Toone mobile app connects to a running Toone Desktop instance over a direct local-network WebSocket or the optional Toone cloud relay. The cloud-relay transport uses TLS plus application-level end-to-end encryption, so the relay forwards encrypted application frames rather than readable conversation or project content. To pair and route connections, the relay stores the Mac and phone device identifiers and the IP address that created the connection. AI execution and project access remain on the Mac. The mobile connection is available in Toone (Direct), not in Toone (Mac App Store).

Business, Live Share, and Explore

These features are available in Toone (Direct). If you set up a Business, Toone stores its name, the email address and role of each person you invite, and the names of the organizations you add to it, and emails each invited person an invitation that shows the Business name and your email address. When you use Live Share, Toone's services receive the information needed to run the share, including the email address of each person you invite, and pass the live session between your Mac and the people you approve. Those people can see the workspace content you make available to them.

When you share a routine on Explore, the app sends Toone a public copy of it for review: its steps, agents, Skills, and any included files you confirm, together with its listing page and cover image. Approved listings are published on trytoone.com with your account name as the author.

Toone Pro (Mac App Store)

In Toone (Mac App Store), Toone Pro is an in-app purchase. Apple processes the payment under its own terms and privacy policy; Toone does not receive your payment card details. The app attaches a random identifier for your Toone account to the purchase, then sends Toone's server the signed transaction record Apple provides and, for subscriptions, Apple's signed renewal information. Toone's server can also receive signed notifications from Apple when a purchase renews, expires, or is refunded. The server checks Apple's signature and stores what it needs to grant Pro: the purchase identifier, the product, whether it is a subscription or a lifetime purchase, its status, its expiry, grace-period, and revocation dates, whether it renews automatically, the App Store environment, and when Apple signed the latest update.

Without Pro, an account can create a limited number of routines. To count them, Toone's server records each routine creation with a random ID, the time, and whether it counted. The app also sends Apple's signed app-transaction record when it can, and Toone stores its app-transaction ID so the free limit applies once per Apple Account.

If you have Pro, you can give someone a guest month by entering their email address. Toone's server stores that address with the guest pass and emails the person an invitation that shows your account name, or your email address if your account has no name. So that each person receives at most one guest month, Toone also keeps a keyed hash of every address that activates one. If Toone gives you complimentary Pro, the grant is recorded with your email address, and Toone may email you before it ends.

Crash Reports & Diagnostics

Toone does not include any crash reporting or diagnostic SDKs. If you choose to report an issue via GitHub, any information you share is voluntary and governed by GitHub's privacy policy.

Updates

Toone (Direct) installers are available through authenticated Toone downloads. The service receives your account session token and ordinary connection information to authorise delivery. Existing Direct apps check public update feeds hosted by GitHub, which is subject to GitHub's privacy policy. GitHub receives ordinary connection information such as your IP address during an update check. Toone does not send your account credentials to GitHub for that check. Apple delivers Toone (Mac App Store) and its updates under Apple's own terms and privacy policy.

Changes to This Policy

If we make material changes to this policy, we will update the effective date at the top of this page and note the changes in our release notes.

Contact

If you have questions about this policy, contact our support email or reach out to the maintainers directly.

Toone is published by Hexagonal.io.