Privacy

Where your data lives

Everything you keep in CottonDB is written to one SQLite database file on the Mac that runs CottonDB for Mac. Photos, documents and other files sit in a folder beside it on the same Mac. Your iPhone holds a copy of the database and of the files you have opened, so it works offline; that copy is excluded from iCloud backup on purpose.

There is no CottonDB cloud. No copy of your database exists on any machine the makers of CottonDB operate.

Copies and backups

Your copies are your own devices: the database in full on the Mac and on every phone you have joined, and every photo and file on at least two of them. A second Mac can take over as the server. CottonDB sends nothing to a cloud unless you point it at storage you name, and a copy sent there is encrypted on your Mac first, with a key the app shows you once and stores nowhere else.

There is no sign-in

CottonDB has no accounts. You never give it an email address, a password or a phone number. A device is admitted to your server by a key it generated, which you approve by pairing: the phone shows six digits, the Mac shows the same six, and you approve the match on the Mac. Every request after that is signed by the device's key, which never leaves the device. You can remove a device from the list on the phone or the Mac at any time.

What an assistant can reach

When you connect an assistant such as Claude, it talks to your own server over MCP. Read access is granted when you approve it from a device you hold; write access is a separate checkbox. Every call it makes is recorded in an audit table in your database, with its arguments redacted, so you can see what was read and when.

What the assistant reads passes into that assistant's provider. If you connect Claude, what Claude reads from your database reaches Anthropic under Anthropic's terms, not CottonDB's. Choose the assistant, and the write checkbox, with that in mind.

Some things are never returned by any tool: a document's password (the assistant gets the unlocked copy), the value of a stored secret, your alarms, anything in the bin, and your recovery key. An assistant cannot write to memory anything you did not say, and it cannot erase a note or a journal entry.

You can revoke an assistant's access from the Connected AIs list in the app. Revocation is immediate.

Your own AI key

Features that call a model, such as an assistant session over your data, nightly summaries or reading a bank statement, use an API key you supply from your model provider. The key is stored sealed in your database on your Mac and is never shown again, not even to an assistant; the model provider receives the text those features send it, under that provider's terms. Without a key, none of those features run and nothing leaves your Mac.

Nothing is trained on your data

The makers of CottonDB never see your database, so nothing in it can be used to train anyone's models, sold, or advertised against. That is not a policy; it is a consequence of where the data is.

What this website keeps

cottondb.com sets no cookies and runs no analytics. If you type an email address into the notify form, it is stored with the time you sent it and a one-way hash of your connection's address, used only to limit repeated submissions. You will receive one email when the iPhone app is out, and nothing else. Write to hello@cottondb.com to have the address removed.

The site is served by Cloudflare, which keeps the request logs any hosting provider keeps.

Changes and questions

This page is rewritten when the software changes, and the date at the top moves with it. Questions go to hello@cottondb.com.