Privacy Policy

Last updated September 26, 2026

Bespoke Byte, LLC ("we", "us") makes Katami. We are a limited liability company registered in the State of Wyoming, United States, and we are the controller of the personal data described here. You can reach us about anything in this policy at support@katami.io.

We wrote this policy to be read, not skimmed past. If something in it is unclear, or you think it is wrong, tell us.

The short version

Your photographs never leave your Mac. Katami has no cloud. It does not upload, sync or back up your library, and every model it runs — detection, recognition, reading text, captions — runs on your Mac. We never receive a photo, a thumbnail, a face, a caption or a filename unless you choose to send one to us in a problem report.
The app has no analytics. No usage tracking, no crash-reporting service, no advertising identifier. There is an automated test in the app's build that fails if one is ever added.
One thing leaves your Mac automatically, and it goes to Apple, not us: the GPS coordinates of photos that have them, so Katami can show the place name. Only the coordinates, over an encrypted connection. It has its own section.
This website counts visits without cookies, records a sample of them with everything you type masked, and does neither if your browser asks us not to track you.
We never sell, rent or share your data — your email address or anything else — with anyone. Not for advertising, not to partners, not for anything. The few companies that do a job for us (sending email, for example) handle it only to do that job for us, and are all listed.

The app

What stays on your Mac

Everything Katami learns about your library stays in a database on your Mac: the people it recognises, the faces it groups, the captions and text it reads, the place names, and the estimates it makes (such as whether a photo is sensitive). None of it is sent to us, and we could not read it if we wanted to. Because it never leaves your Mac, it is also covered by your Mac's own protections, such as FileVault.

Some of this — face recognition in particular — is the kind of processing many laws treat with special care. It is yours: it is created on your Mac, from your photos, for your use, and it stays there. We are not the controller of it and never receive it.

Your license

To check that your license is valid and to manage the two Macs it covers, the app talks to our licensing service at api.bespokebyte.io. When you sign in on a Mac it sends:

a device identifier — a one-way hash of your Mac's hardware UUID, so we can tell your two Macs apart without learning the UUID itself;
your Mac's name (as set in System Settings ▸ General ▸ About), so the License Manager can show you which Macs are linked. It is often your first name; you can rename your Mac before signing in if you prefer;
the app version.

After that, the app checks in about once a day, and when you open it, to confirm the license is still valid. Those check-ins send the device identifier and your sign-in token. Like any internet request, they also reveal your IP address and a standard header naming the app and the macOS version.

Katami keeps working offline. It never locks because it could not reach us. It stops only if our service positively answers that the license was refunded, revoked or unlinked from that Mac.

Updates and models

Once a day, and at launch, the app asks our service whether there is an update or a new version of its on-device models, and downloads them from our own server (models.bespokebyte.io). These requests carry the same device identifier and sign-in token, so that only licensed Macs can download. Updates are delivered by Sparkle, and no system profile is sent with them.

Place names and maps

When a photo has GPS coordinates, Katami shows where it was taken — "Lisbon, Portugal" or a street name, rather than two numbers. It gets that name from Apple Maps, the same service behind Maps on your Mac, by sending Apple the photo's coordinates. It does this automatically in the background, for each place in your library, and remembers every answer on your Mac, so a place is looked up once.

What Apple receives, and what it does not:

Only the coordinates. Never the photo, its filename, the people in it, your name, your email address or your license.
Encrypted in transit. The request travels over an encrypted (TLS) connection, so nobody between your Mac and Apple can read it.
Not to us. These requests go from your Mac straight to Apple. We never see them.

The same service draws the maps you open inside Katami, and answers when you search for a place to tag a photo with (the search text goes to Apple).

Apple handles these requests as the controller, under its own privacy policy for Maps. In it, Apple says Maps usage "is associated with an identifier that rotates multiple times per hour, and is not tied to your Apple Account", and that Apple does "not collect or retain personal data associated with your Maps usage".

Problem reports

When you choose Help ▸ Report a Problem, Katami shows you everything the report contains before it is sent, and you can remove any part of it, down to single lines. A report can contain:

Part	What it is	Included
Your note	what you write	if you write one
Katami's notes	up to 40 recent log lines. Your home folder, email address, Mac's name and user name are replaced with placeholders. Folder and file names can appear in these lines	yes, removable
What Katami has been doing	timings, no names	yes, removable
Your library overview	nine counts — photos, RAW files, sources, albums, named people, sizes. Never the names	yes, removable
Your Katami version and your Mac	app version and channel, installed models, Mac model, chip, memory, macOS version	always
Pictures	screenshots or images you add yourself. Katami never takes one on its own	only if you add one

Before a picture is sent, Katami redraws it as a new image, at most 1,600 pixels on its longest side. The new image carries none of the original's metadata: no location, no date taken, no camera, lens or serial number, no caption or credit. Only its size and colour space remain. What is visible in the picture itself is, of course, still in it, so look before you attach a photo you would rather keep to yourself.

When Katami notices a problem itself, it may offer to report it for you, at most once a week on each Mac. The offer says what it will send, and if you press Tell us, the report goes straight away, without the preview above — that is the point of it: one press, and you are back to your photographs. If you would rather not, press Not now and nothing is sent.

A report sent this way contains the same parts as the table above, apart from the ones only you can add:

Katami's notes, what Katami has been doing, your library overview (the nine counts), and your Katami version and your Mac;
a short description Katami writes of what went wrong, and an identifier for the fault, so reports of the same problem from different Macs are grouped together;
never a picture, and never a note, since you did not write one.

Why this much: a fault Katami notices on its own is one nobody saw happen. The notes say what failed, the timings and the counts say what it was doing and at what scale — a slow import of 200 photographs and one of 200,000 are different problems — and the version and Mac say where. Together they are what lets us find and fix it without asking you anything. Nothing is collected beyond what this section describes, and nothing is sent at all until you press the button.

A report is linked to your license, so we know who to reply to. It arrives with your email address and device identifier, and we keep it for two years, then delete it. We track reports in Linear, our issue tracker. Linear holds a report, your email address and any pictures for 60 days at most: by then the problem has become a task of ours that carries nothing about you, and the original is removed.

Export Diagnostics writes a file to wherever you save it. Nothing is sent.

Buying a license

Paddle.com Market Limited is the Merchant of Record for every purchase: it takes the payment, handles tax, and issues your receipt. For that, Paddle is the controller of the payment data it collects, under its own privacy policy. We never see your card details.

From Paddle we receive what we need to issue and support your license: your email address, your country, and Paddle's references for you and your purchase (so that a refund can find the right license).

We do not ask for your name. Your email address is how we know you. The only names we hold are ones we already know: if we gave you a license — as a member of the team, a tester, or a member of the press — we record the name we know you by, so the License Manager can greet you properly. You can change it there, or clear it, at any time.

The License Manager

The License Manager is where you sign in, download Katami and manage your Macs. It has no password: you sign in with a link we email you, which works once and expires after ten minutes.

It uses cookies, only to keep you signed in — they are strictly necessary, contain no tracking identifier, and expire when you sign out or after 30 days without a visit. For security, each sign-in records the IP address and browser or app it came from, which we keep while the sign-in is active and delete within 30 days of it ending.

The License Manager counts page views and clicks, like the website below, but is never recorded, because it shows your email address.

This website

No cookies. katami.io sets none. It keeps two small values in your browser's local storage: your light/dark choice (bb-theme) and, if you make one, your analytics choice (umami.disabled). Neither leaves your browser. Our fonts are served from our own site, so no font service sees your visit.

Analytics. We use Umami, self-hosted on our own server. There is no third-party script and nothing that identifies you: no name, no email address, no account and no IP address stored alongside what you did. We measure:

which pages are viewed, where visitors came from (the referring site or a campaign tag on the link), approximate country, and device and browser type;
clicks on our own buttons and links — for example "buy" or opening a question in the FAQ;
how far down a page people scroll and how long it stays in view;
how a checkout ends: completed, closed or failed, the amount and whether a discount code was used. Never the card, the email address or the order number;
page speed, so we notice when the site gets slow.

It is read in aggregate, to learn what people care about and where the site gets in their way. There is no profile of any one visitor.

Session recordings. A sample of visits is recorded as a replayable reconstruction of the page — what was clicked and scrolled — which shows us where the site is confusing and produces heatmaps.

Recording is sampled: most visits are not recorded.
A recording is capped at a few minutes.
Anything you type is masked in every recording, on every page.
The checkout page is never recorded — the whole page, not only Paddle's payment frame.
The newsletter form is excluded.
A visit that arrives through a link carrying a personal code, such as a discount code, is not recorded at all.
Recordings are held on our own server, not a third party's, and deleted after 30 days.

Your choice, respected automatically. We honour Global Privacy Control and Do Not Track: if your browser or an extension sends either signal, nothing is counted and nothing is recorded, with no action from you. Many privacy-focused browsers and extensions send GPC by default. You can also switch it off here, for this browser — it takes effect immediately, analytics and recordings alike:

Anonymous analytics

Email

Email we send. Sign-in links, your license, and — if you asked for them — discount codes and the newsletter, delivered by Resend. If you hold a license, we may also email you about Katami itself, such as an announcement for its users. We do not track whether you open our emails or which links you click. The logo in our emails loads from our own server, which, like any web request, sees your IP address in its log; we do not use it to count opens.

The newsletter. Subscribing is one step: there is no confirmation email. We store your address and add it to our newsletter contact list at Resend. Every issue carries a one-click unsubscribe, and unsubscribing removes your address from that list. We keep your address until you unsubscribe, then delete it within 30 days.

If you hold a license. When you buy a license, accept one we give you, or sign in, we add your address to a second contact list at Resend, for Katami's users. Being on it sends you nothing by itself. We use it to email users about Katami, and every such email carries a link to unsubscribe from them. The two lists never overlap: joining the users' list takes your address off the newsletter list.

Email you send us. Mail to our katami.io addresses is received and held by Resend, the same service that sends ours; there is no other mailbox. When you write to us — for support, a discount, or anything else — we keep the conversation only as long as it takes to help you, and it is deleted within three months. A student discount claimed on our Discounts page, or a discount request by email, is answered automatically where it can be; we keep the address, its domain and our answer for 12 months, to stop codes being claimed twice.

Server logs

Like every web server, ours log requests: the IP address, the browser or app, the page requested and the time. We use them to keep the service running and to stop abuse, and delete them after 14 days.

Why we use your data

The law in some places (the EU and UK, for example) asks us to name the reason each use is allowed. Ours are:

What	Why it is allowed
Issuing your license, signing you in, managing your Macs, updates	to perform our contract with you
Problem reports, and replying to them	our legitimate interest in fixing what you reported
Sign-in records, server logs, rate limits	our legitimate interest in keeping the service secure
Website analytics and recordings	our legitimate interest in improving the site — you can object at any time, and GPC does it for you
The newsletter	your consent, which you can withdraw with one click
Emails to Katami's users	our legitimate interest in telling people who use Katami about it — you can unsubscribe from them
Keeping purchase records	our legal obligations (tax and accounting)

We make no decisions about you by automated means that have legal or similarly significant effects.

How long we keep it

Data	Kept
Your account and license	while you hold a license, or until you ask us to delete it
A linked Mac (identifier, name, version)	until you unlink it
Sign-in IP address and browser/app	while signed in, deleted within 30 days after
Problem reports	two years
Server logs	14 days
Website session recordings	30 days
Discount requests	12 months
Support email	three months at most
Newsletter address	until you unsubscribe, deleted within 30 days
Record of a purchase (Paddle's reference, date, country)	as long as tax and accounting law requires, even after deletion

We do not sell, rent, trade or share your email address or any other personal data with anyone — not advertisers, not data brokers, not "partners", and not in exchange for anything. We do not use it to build a profile of you, and we do not let anyone else do so.

A handful of companies do a job for us — delivering email, hosting our server, tracking problem reports — and handle your data only to do that job, on our instructions. They are all on the Subprocessors page, with exactly what each receives. The only other time data leaves us is if the law requires it, such as a valid court order; we would tell you unless the law forbids it.

Paddle and Apple are not on that list because they are not working for us: you deal with them directly — Paddle when you pay, Apple when Katami looks up a place name — under their own policies.

Where your data is

We are a US company. Our service and this website run on a server we manage ourselves, rented from Hetzner in Germany. Some of the companies we use are in the United States. Where your data moves out of the EU or UK, we rely on the safeguards the law provides for it, such as the European Commission's Standard Contractual Clauses.

Your rights

Wherever you live, you can ask us to:

see the personal data we hold about you, and get a copy you can take elsewhere;
correct it;
delete it. Deleting your account ends your ability to sign in and to download Katami, so we will confirm that is what you want first. We keep only the purchase record the law requires;
restrict or object to how we use it.

Email support@katami.io from the address on your license. We answer within 30 days — sooner in practice — and if a request is complex we will tell you why we need longer, up to two months more. It is free, and asking will never change how we treat you.

You can already do some of this yourself: the License Manager shows your license and your Macs, unlinks a Mac with one click, and — if we gave you your license — lets you change the name we know you by.

California residents: we do not sell or share personal information as the CCPA defines those words, and we honour Global Privacy Control as an opt-out.

If you are in the EU, the UK or Switzerland and think we got something wrong, you can complain to your data protection authority. We would rather you told us first; it is usually faster.