Privacy

Where your data lives

Everything you keep in CottonDB is written to a single database file on the Mac that runs CottonDB for Mac: one file, in a folder you can see. (It is one SQLite database file on the Mac, a standard format.) Photos, documents and other files sit in a folder beside it on the same Mac. Your iPhone holds a copy of the database and of the files you have opened, so it works offline; that copy is excluded from iCloud backup on purpose.

There is no CottonDB cloud. No copy of your database exists on any machine the makers of CottonDB operate.

Backups

If you turn backups on, the Mac app streams an encrypted copy of the database to a storage bucket you name. It is encrypted on your Mac before it leaves, with a key the app shows you when you ask for it and stores nowhere else. Without that key the backup is unreadable, including to whoever operates the bucket.

The relay

Your Mac is reachable from your phone and from an assistant through relay.cottondb.com, a service the makers of CottonDB run. Your Mac dials out to it and keeps the connection open. The relay forwards encrypted traffic by hostname and holds no certificate for your address, so it cannot decrypt what passes through it. What it can see is that a connection to your name happened, and when. It keeps no content, because it never has any.

There is no sign-in

CottonDB has no accounts. You never give it an email address, a password or a phone number. A device is admitted to your server by a key it generated, which you approve by pairing: the Mac shows a code, the phone shows six digits, you type the six digits on the Mac. Every request after that is signed by the device's key, which never leaves the device. You can remove a device from the list on the phone or the Mac at any time.

What an assistant can reach

When you connect an assistant such as Claude, it talks to your own Mac directly, over the open tool standard (MCP). Read access is granted when you approve it from a device you hold; write access is a separate checkbox. Every call it makes is recorded in an audit table in your database, with its arguments redacted, so you can see what was read and when.

What the assistant reads passes into that assistant's provider. If you connect Claude, what Claude reads from your database reaches Anthropic under Anthropic's terms, not CottonDB's. Choose the assistant, and the write checkbox, with that in mind.

Some things are never returned by any tool: a document's password (the assistant gets the unlocked copy), the value of a stored secret, your alarms, and the backup key. An assistant can list what is in the bin, and restore or erase it. It cannot write to memory anything you did not say, and it cannot erase a note or a journal entry.

You can revoke an assistant's access from the Connected AIs list in the app. Revocation is immediate.

Your own AI key

Features that call a model, such as an assistant session over your data, nightly summaries or reading a bank statement, use an API key you supply from your model provider. The key is stored encrypted in your database on your Mac and is never shown again, not even to an assistant; the model provider receives the text those features send it, under that provider's terms. Without a key, none of those features run and nothing leaves your Mac.

Sharing with another person

A chat, a group, a project or an album you share travels from your Mac to the other person's Mac, and each side keeps its own copy. What you star, read, mute or draft stays on your devices and is never sent. The other person's server learns your relay name and what you shared; it does not learn your phone numbers or anything else in your database.

Nothing is trained on your data

The makers of CottonDB never see your database, so nothing in it can be used to train anyone's models, sold, or advertised against. That is not a policy; it is a consequence of where the data is.

What this website keeps

cottondb.com sets no cookies and runs no analytics. If you type an email address into the notify form, it is stored with the time you sent it and a one-way hash of your connection's address, used only to limit repeated submissions. You will receive one email when the first build lands. Write to hello@cottondb.com to have the address removed.

The site is served by Cloudflare, which keeps the request logs any hosting provider keeps.

Changes and questions

This page is rewritten when the software changes, and the date at the top moves with it. Questions go to hello@cottondb.com.