Privacy Policy
Ask Alway · Last updated: 15 August 2026
Webnow AS, org. no. 831 434 252, Norway, is the data controller for the limited personal data described here. Contact: kontakt@webnow.no.
Alway watches what you do on your Mac. That is an unusual amount of trust, so this page is written to be read, not to be survived.
The short version
- Everything Alway captures stays on your Mac. Screen text, screenshots, voice recordings, transcripts, your memory, your journals. We never receive them, and we could not hand them over if we were asked.
- To answer a question, Alway sends a short, redacted extract — the words of your question plus the small amount of context needed to answer it — to an AI provider, through our relay. Never your whole screen, never your files, never your memory database.
- We hold almost nothing about you: your email address, a Stripe customer reference, which plan you are on, and counters of how much you have used. No content, ever.
- You can export everything and delete everything, both on your Mac and on our side, from inside the app.
1. What stays on your Mac and never leaves it
Stored under ~/Library/Application Support/HumanAOS, encrypted, readable only by your user
account:
- text read from the windows you use, and screenshots where an app does not expose its text
- recordings and transcripts of what you say while holding the voice key
- the memory Alway builds — cards, people, projects, decisions, summaries
- anything you write into Alway, and every conversation you have with it
- what Alway has learned about how you write
We never receive any of this. There is no sync, no backup and no upload of your captures.
You control how long raw captures are kept (Settings → Dev Privacy), you can pause capture at any time, exclude specific apps and sites, delete the last 30 minutes with one click, and delete everything.
2. What leaves your Mac, and when
When you ask Alway something
Alway sends, through our relay, to an AI provider:
- your question or transcribed speech
- a short context extract: relevant fragments of your memory, a summary of what is on screen, and a few recent turns of the conversation
- for “show me” and Mac-control tasks, a picture of the relevant window
Before anything is sent it passes a redaction step that removes recognisable secrets — passwords, API keys, card numbers and similar — and anything from an app or site on your exclusion list.
The providers are Anthropic (Claude) and OpenAI, both processing under agreements that forbid using your data to train their models. Data may be processed outside the EEA under Standard Contractual Clauses. Our relay does not store the content of these requests; it counts them.
When you use web lookups or maps
The search terms or place names go to the relevant provider. Your location is used only when you ask for a route or nearby places, and only for that request.
When something crashes, and only if you allow it
Diagnostics are off unless you turn them on (Settings → App → Help fix crashes). They contain the crash type, the app version and your macOS version. They never contain anything you wrote, said, or looked at.
3. What we store on our servers
One row per customer, on Cloudflare (EU) and Stripe:
| What | Why | How long |
|---|---|---|
| Email address (from Stripe checkout) | To restore your subscription on another Mac, and to reach you about your account | Until you delete your account |
| Stripe customer and subscription id | To know what you have paid for | Until you delete your account |
| A hashed device token per Mac, and a hashed restore key | So a Mac can prove it belongs to your subscription | Until you remove that Mac or delete your account |
| Counters: questions, minutes, actions, tokens, cost | To apply your plan’s limits and to run the business | Until you delete your account |
| Payment records | Norwegian bookkeeping law (bokføringsloven § 13) | 5 years, held by Stripe |
No prompt text, no response text, no captured content is ever written to our servers.
Payment details are handled entirely by Stripe, who are a separate controller for them. We never see or store your card number.
4. Why we are allowed to do this
- To perform our contract with you (GDPR art. 6(1)(b)): running your subscription, applying your limits, sending your question to an AI provider so it can be answered, restoring your purchase.
- Our legitimate interests (art. 6(1)(f)): preventing abuse and fraud, keeping the service secure and affordable. We have weighed these against your privacy — which is why the data is counters rather than content.
- Your consent (art. 6(1)(a)): crash diagnostics, and letting an external AI read your memory through the connector. Both are off until you turn them on, and you can withdraw at any time.
- Legal obligation (art. 6(1)(c)): keeping payment records.
Capture itself is not something we have a legal basis for, because we never receive it. It is your data, on your machine, under your control.
5. Other people’s data
Alway will inevitably capture things about other people — names in your inbox, faces in a call, a colleague’s message. That data stays on your Mac and we never see it, but you are the one deciding to run a tool that records your screen. Use the pause control, the exclusion list and the 30-minute delete when you are working with something that is not yours to record, and follow whatever rules apply where you work.
6. Your rights
You can, at any time and free of charge:
- See and export everything — Settings → Your data → Export everything. It is all on your Mac already, in readable Markdown and JSON.
- Delete your data on this Mac — Settings → Your data → Delete everything on this Mac, or delete just the last 30 minutes.
- Delete your account with us — Settings → Your data → Delete your account. This cancels your subscription immediately and erases your email, your Macs and your usage history from our servers. Stripe keeps the payment records it is legally required to keep.
- Correct anything wrong, object to or restrict our processing, and receive your data in a portable format — the export does this already.
- Withdraw consent for diagnostics or connector access, without affecting anything before.
Write to kontakt@webnow.no. We answer within 30 days. If you are not satisfied you may complain to the Norwegian Data Protection Authority (Datatilsynet), or to the authority where you live.
7. Security
Captures are encrypted on your Mac with keys held in the macOS Keychain, and files are created so only your user account can read them. Deleting everything destroys the keys first, so any blob that survives a partial deletion is unreadable. Traffic to our relay is HTTPS only. Access tokens are stored hashed on our side and can be revoked per Mac.
No system is perfect. If a breach ever affects you, we will tell you and Datatilsynet without undue delay, as GDPR art. 33–34 require.
8. Children
Alway is not for anyone under 18 and we do not knowingly collect data from children. If you believe a child has an account, write to us and we will delete it.
9. Changes
If we change this policy materially we will tell you in the app or by email at least 30 days before it takes effect. The date at the top always reflects the current version.
Webnow AS · kontakt@webnow.no · https://alway.app