End User License Agreement

Version 2.1 · 26 October 2026

This End User License Agreement (the "Agreement") is a contract between you and the Licensor for the Cowork Island application for macOS and Windows (the "Software"). It applies from the moment you install, launch or buy the Software. If you do not accept it, do not install or use the Software.

This Agreement covers both editions. A passage naming macOS or Windows applies to that edition; the editions need not offer the same features. Its date is the Mac 2.1 launch date, shown above when this revision is published.

1. The Licensor

The Software is published by Daniel Pau Castro Engström, a sole trader established in Spain (the "Licensor", "we", "us"). Support is reached at support@coworkisland.com, and our full identification details, including our postal address, are available from that address on request.

Those details are also published in the legal notice at coworkisland.com (wording revised on 20 September 2026: the notice is live); the email address above remains the place to ask for them.

2. Who you buy from

The Software is sold through Polar (Polar Software Inc.), which acts as the merchant of record — that is, Polar is the seller in the transaction with you. Polar charges the price, applies and remits the tax due in your country, issues your receipt or invoice, and makes your license key available to you (section 9). Your purchase is therefore subject to Polar's own terms and refund policy in addition to this Agreement, and those terms govern anything to do with payment, invoicing, refunds and the statutory right of withdrawal (see section 10).

The Licensor is the party that licenses the Software to you and provides support for it. The Windows edition is coming soon to the Microsoft Store as a free download; its paid licenses and packs will be bought from Polar, not through the Store.

3. What is on offer

The prices above are reference prices. The macOS 2.1 shop and Pro window ask our license service which currency applies to your connection. Cloudflare supplies the country inferred from that connection; our service selects euros for the supported euro regions and US dollars elsewhere, with US dollars as the fallback. When it creates a Polar checkout, it requests that same currency. If a service request fails, the app keeps its last connection-based price policy, or uses its regional estimate if it has none; a checkout failure may open a direct Polar link, where Polar selects the currency. Tax depends on your billing address: in countries such as the United States, Canada and India, applicable tax is added at checkout; elsewhere it is included. The total and currency shown at Polar's checkout before you pay are what Polar charges.

Pro does not include the cosmetic packs. They are separate purchases, and buying Pro neither grants them nor discounts them. Conversely, a pack works at any tier: if you buy a pack without Pro, you keep that collection on the free tier described in section 5.

4. The license we grant you

On payment, we grant you a personal, non-exclusive, non-transferable, perpetual license to install and use the purchased version of the Software for your own purposes — private or professional — subject to this Agreement.

One license key may be activated on the number of computers your purchase names (one, two or three), provided that you own or control each of them. You may free a seat at any time from the Software's license settings (on macOS, Settings → License → "Deactivate this Mac"), or from Polar's customer portal, and use it on another computer.

The same license key covers the macOS and Windows editions. Each computer on which the key is activated counts against the same seat limit, whichever edition it runs. If we publish an edition for another operating system, which we do not promise to do, the same applies to it.

A cosmetic pack is licensed on exactly the same terms: it is a content license to use the artwork inside the Software, and nothing more.

The license is perpetual: it is not a subscription, it does not lapse, and the Software does not require a network connection to keep working once activated.

5. The free tier

The Software remains permanently usable without paying. On the free tier you keep one live session on the island, the Celestial mascots and, on macOS, the classic mascot, and — always, without exception — the fact that one of your sessions needs your attention. The free tier is offered under this Agreement too; sections 4 (grant), 7 (restrictions), 8 (ownership), 13 (no warranty) and 14 (liability) apply to it in the same way, with the obvious exception that nothing has been paid.

6. The trial

The Software offers one 7-day trial of the Pro tier per installation, with no card and no account. The trial is anchored on our server so that reinstalling the Software or clearing its preferences does not start a second one, and it is granted once per installation; we may decline to start one where it has already been used.

In the macOS edition, from version 1.3.1 the trial starts by itself, once per Mac, on the free tier. On a new installation it starts when the welcome card closes, or at the next launch if the Software quits while that card is still open. On a Mac updated to version 1.3.1 that has not had its trial, it starts at the first launch of version 1.3.1. Starting it sends our license service the same request as the "Start 7-day trial" button, described in section 12.1. If a connection problem prevents the Software from receiving a response, including a timeout, a provisional 7-day trial starts on the Mac and is checked with the service at later launches. If the service returns an error other than confirmation that this Mac has already used its trial, or its response cannot be verified, the Software leaves the trial unchanged and tries again at its next launch. If the service answers that this Mac has already used its trial, no trial is given (a provisional trial started this way ends) and the Software does not ask again by itself. Until this Mac has had its trial, the "Start 7-day trial" button remains as a way to start it yourself.

When the trial ends, the Software does not stop working: it returns to the free tier of section 5. Nothing you created is deleted, and any mascot assignments you made during the trial are preserved and return if you buy.

7. What you may not do

You may not:

• resell, rent, lend, sublicense, publish or otherwise distribute the Software or a license key, in whole or in part, whether for payment or free of charge;
• share a license key outside the seats described in section 4, or use one on more computers than your key permits;
• remove, alter or obscure any copyright, license or attribution notice in the Software;
• circumvent, disable or interfere with the license check, the entitlement verification or the trial anchoring, or forge an entitlement;
• use the Software in breach of applicable law.

Nothing in this section restricts the rights you have by law. In particular, Spanish law grants you rights that may not be excluded, including the acts necessary to use the Software as intended, the making of a backup copy, observing and testing the Software, and decompilation for interoperability purposes (Royal Legislative Decree 1/1996, articles 100.5 to 100.7). Where this Agreement and those rights conflict, those rights prevail.

8. Ownership and open-source components

The Software is licensed, not sold. All rights in the Software that are not expressly granted to you remain with the Licensor and, where applicable, with the authors of the components it incorporates.

Portions of the Software are derived from open-source work © 2026 wxtsky, used under the MIT License. That work's copyright notice and permission notice are reproduced in full inside the Software (on macOS, under Settings → About → Acknowledgments) and in the file THIRD-PARTY-NOTICES.md distributed with it. Those components remain under their own licenses; this Agreement governs the Software as distributed, and nothing in it reduces the rights those licenses give you in respect of the components themselves.

9. License keys, activation and revocation

Polar shows you your license key when your purchase is complete: on the page that confirms your order or, if you have bought from us before with the same email address, in Polar's customer portal once you sign in. The key can be looked up again at any time in that portal. Activating a key tells our license service which installation the key is used on, so that the seat limit in section 4 can be applied; what is sent, and what is kept, is set out in section 12.1.

In macOS 2.1, a purchase opened through our license service can activate automatically when you return from Polar. The app sends the checkout identifier and its install id to our service, which checks the paid order with Polar and returns only that order's license keys for the usual activation. Automatic claiming is available for 24 hours from checkout creation; if it cannot complete, you can still paste the key from Polar. Section 12.1 explains the temporary purchase record.

The Software revalidates a license when it starts, once at least 14 days have passed since its last successful revalidation. A check that fails, for example because your computer is offline, changes nothing, and the Software tries again the next time it starts. If a purchase is refunded or charged back, the key is revoked and the entitlement it granted ends: the Software returns to the free tier at its next revalidation. We accept that an installation which never reconnects will not learn of a revocation, and we do not require it to phone home in order to keep working.

10. Refunds and the right of withdrawal

Because Polar is the merchant of record (section 2), refunds are governed by Polar's refund policy, and any statutory right of withdrawal for digital content — including the 14-day right EU and UK consumers have, and the point at which it may be waived in order to get immediate access — is presented and handled at Polar's checkout. Please read Polar's terms and refund policy before purchase; they are linked from the checkout page. Requests can be made through Polar's customer portal, and we will help if you write to us.

11. Updates

We may publish updates to the Software. We are not obliged to do so, and we do not promise any particular feature, release schedule or period of support.

The following update mechanism and controls apply to the macOS edition.

Nothing is installed on your Mac without you. The Software contains an update mechanism (the Sparkle framework, credited in the Software's acknowledgments). As the Software is delivered to you, that mechanism's automatic check is switched on in this version: about once a day while the Software is running, it asks our website whether a newer version exists, in the way set out below. You can switch that off.

The automatic check is yours to switch off, and yours to switch on again. In Settings → About, under Updates, there is a switch labelled "Check for updates automatically", and a new installation has it on. Switch it off and the automatic check stops; switch it on again and the Software resumes looking for a new version by itself: once shortly after you switch it on, unless it has looked in the past day, and about once a day thereafter while it is running. A check made that way goes to the same address and carries the same things as one you ask for, both set out below. Either way, an update is shown to you and is downloaded and installed only if you accept it. There is no setting, in the Software or in the update mechanism it embeds, that installs an update for you: the choice is made on the update itself, every time.

A check goes to our website rather than to the license service, and carries your IP address — as any web request does — together with an identification of the Software, the version you are running and the version of the update mechanism itself. It carries no installation hash, no license key and no profile of your Mac.

The Windows edition is coming soon to the Microsoft Store. Its planned update mechanism checks for updates through the Store after launch and about once a day, and can ask the Store to install an available update. Those requests will go to Microsoft, not to our update feed. Windows will have no Sparkle updater. Store updates will also follow Microsoft's terms and your Store settings, which may allow automatic installation; the Mac promise above that each update needs your acceptance does not govern those future Store updates.

An update may be published together with a revised version of this Agreement. Installing it does not move your licence onto those revised terms. Section 17 is the single rule about which version binds you, and it is that your purchase stays under the version in force when you bought it. Every build carries the version it shipped under, readable under Settings → License → License Agreement, and the current text will also be published at coworkisland.com once that page is live; the copy inside the build you are running is the authoritative statement of the terms that bind that build.

12. Privacy

The Software contains no advertising and no user accounts, and it never sends us the content of the work you do in the tools it watches. It does send us the usage statistics described in section 12.3, which you can switch off. From macOS version 2.1, they include one yes-or-no detail about that work: whether the Software has had a session to show in its panel since counting began.

On a Mac that holds no license key, on which no remote Mac is set to connect automatically, and on which you have switched off both the automatic update check of section 11 and the usage statistics of section 12.3, while you are not using the shop or Pro window and have no pending purchase, the only network call it makes to us automatically is the request that starts the trial of section 6. That request is sent when the trial is due to start, and again at later launches only until our license service has started the trial or refused it. Apart from that request, such a Mac makes no other automatic network calls to us. With those two switches on, the other automatic calls to us are the update check and usage reports described in sections 11 and 12.3.

A remote Mac that you add under Settings → Advanced → Remote Macs and set to connect automatically is reached over SSH each time the Software starts, and again after a dropped connection: the Software installs its hooks on that computer and receives its session events through the connection. That connection goes to the computer you named, not to us. The local usage-meter refresh described below asks your own provider programs, which may contact their providers; it sends us nothing.

That condition is about what is on the Mac and what you switch off, not about which tier you are on. A cosmetic pack (section 4) is bought outright and works on the free tier, so a free-tier installation that has activated a key does make the revalidation described in section 9 — when the Software starts, once 14 days have passed since the last successful one.

The calls it does make to our license service cover trials, license activation, deactivation and revalidation, price lookup, checkout creation, purchase claiming and usage statistics. Update checks and accepted downloads on macOS go to our website instead. Section 12.1 explains licensing, purchases and updates; section 12.3 explains statistics.

12.1 What those calls carry

Each of the three license calls sends: a one-way hash of a machine identifier for the computer it runs on (the "install id"). This is a pseudonymous identifier, not an anonymous one: it cannot be reversed, but a holder of the source identifier could compute and compare the hash; where a key is involved, the license key itself, as typed or received from Polar after a purchase — our server forwards it to Polar to check its standing and to manage its seats, and stores only a one-way hash of it. Its logs may record the last four characters of a key, never the whole key. When you activate a key, our server also gives Polar the first 12 characters of the install id, as a label that tells your seats apart in our seller account; it sends Polar no other part of the install id in that activation call. The trial and key-management requests carry no client timestamp: our server notes when each arrives. Those requests carry no name, email address, IP- derived profile or content from your work. The checkout and claim exchanges below carry different data. The revalidation of section 9 runs when the Software starts, once 14 days have passed since the last successful one.

In macOS 2.1, opening the shop or Pro window also asks our service for a price policy. That request contains no install id or license key. Our price handler uses only the country Cloudflare infers from the connection, and stores nothing itself; Cloudflare's request records are described in section 12.3.

Starting a purchase sends our service the install id, selected product, language, displayed currency and any discount code you enter. To create the checkout, we send Polar the product, currency, language, any applicable discount and the connection's IP address for its tax pre-fill and fraud checks, together with a random claim code. The install id itself is not sent to Polar for checkout. The checkout page is opened in your browser under Polar's terms.

To claim the purchase, the app sends our service its install id and the checkout identifier. Our service reads the checkout, order, customer benefit grants and license-key responses from Polar, checks payment and the order association, and returns only that order's keys. The claim works for 24 hours from checkout creation. In our Cloudflare D1 purchase table we retain only the checkout identifier, a further hash of the install id, the random claim code, the product, the creation time and, after success, the first claim time. We store no raw key, IP address, discount code or customer contact or billing details in that table. Records older than seven days are eligible for deletion by the daily cleanup and before each new checkout record; each cleanup removes up to 500, so an outage or backlog can extend retention. D1 recovery history can retain pre-deletion data for up to 30 days on the paid plan. The ordinary license records created by activation have their own retention. Polar keeps its purchase records under its own privacy policy.

The update check carries none of that. It is a request for a file on our website, and what it discloses is your IP address, a header the update mechanism sets to say it expects our feed, and the ordinary headers any web request carries, together with the identification of the Software described in section 11 — no install id, no license key and no profile of your Mac — whether you asked for the check or the switch in section 11 made it. If you accept an update it offers, the download of that update is a request of the same kind to the same website — without the header named above, which belongs to the check alone — and its address names the version you chose. Nothing about it is written to our license service. Our website keeps a record of each check for three months, in Cloudflare Workers Analytics Engine: the date and time, the versions of the Software and of the update mechanism, and a code worked out with a secret key from the date, your IP address and the request's user agent. The code changes every day and does not contain your IP address. Our host no longer makes a routine diagnostic record of these checks. For diagnostics, it keeps the messages and error reports that our website's own code produces when handling them, for up to 7 days. These can include technical details of the request. Where they include a field for the address requested, our host removes its query string (the part after the question mark). From the records of each check we keep daily totals, which are only numbers, with no code or other identifier, and we keep them with no end date.

The Licensor is the controller of the data described in this section and processes the licensing and purchase data to perform this Agreement or take steps at your request before a purchase. Cloudflare runs our service and database as our processor. Two parts rest instead on its legitimate interest (Article 6(1)(f) GDPR): the records of update checks, which help it maintain the Software and plan its updates, and Cloudflare's request records, described in section 12.3, which help keep the license service working and secure. Polar is an independent controller for the payment and customer data you provide at its checkout (section 2). We keep server logs for no more than 30 days.

Local Codex pane linking on macOS. To associate a chat running in Codex's shared background server with the terminal window that started or explicitly resumed it, and find that window's herdr pane, the island reads local process identifiers, executable paths, launch arguments, precise process start times, working directories and that terminal process's own herdr environment variables. It compares the chat's creation time encoded in its identifier with the process start time, or an explicit resume identifier with the chat identifier, alongside folder and herdr pane/title checks. This is a bounded inference, not a Codex-provided identification of the window currently showing the chat. Ambiguous candidates or a contradictory readable title prevent that process association from selecting a pane. The same association supports local workspace grouping and checks whether an archived chat still has a pane.

The macOS kernel read returns the process's environment, not just herdr variables: its temporary buffer and parsed dictionary can include other variables. The island immediately filters that dictionary to exactly HERDR_ENV, HERDR_PANE_ID, HERDR_TAB_ID, HERDR_WORKSPACE_ID and HERDR_SOCKET_PATH. Only those environment values are retained for this linking decision. If the terminal process's own environment cannot be read, this reader does not borrow an ancestor process's environment.

These process observations stay in memory for the decision. A click checks a fresh herdr roster and, before focusing a pane selected from process facts, reads those facts again and requires the same unique association. The new process observations are not saved to sessions.json or included as process records in diagnostics exports. The existing local visibility census can still record the resulting pane and workspace grouping. This linking adds no network request, telemetry field, upload or remote process read.

For each click through this shared-server Codex route, a new local Jump log message records only three counts (codexRows, folderMatches, titleMatches) and two yes-or-no values (cardTitlePresent, lineCut). The counts describe eligible Codex pane rows and their folder/title matches; lineCut reports a recognised title/line cut among folder-matching rows. Unavailable counts are -1. This message contains no session text, title, folder, launch arguments, process or pane identifier, socket path or environment value. Other jump log messages are unchanged. This count-only message may be included among the app's recent log lines in a diagnostics export, which the app writes locally for you to review and send yourself.

Local usage-meter refresh on macOS. With usage meters enabled, Refresh accounts you're not using (Settings → Usage) is on by default and has its own off switch. While the notch panel is expanded, or Settings → Usage is visible and Cowork Island is the active app, the app can ask for a fresh reading for an account with no reading from the last 15 minutes. It runs that environment's own Claude Code /usage command or asks Codex for its rate limits, one at a time, at most once per 15 minutes per environment, with longer waits after unsuccessful attempts. Closing the surface stops new asks; an ask already running may finish. Switching off either usage meters or this refresh switch cancels an ask in progress.

A Claude folder whose effective settings disable non-essential traffic is never asked. To decide this, the island extracts the setting CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC from Claude's configuration and policy files and from its own environment, including the settings for its own working folder and command. The privacy policy lists these sources. It keeps the decision in memory, without logging or saving those settings. If every signed-in folder for an account has usage checks off, its row says so while the reading is old or missing.

For a Codex home served by the Codex app's running daemon, the island asks that existing process over its verified local control socket, then closes the connection. It starts no new program for that route. If no daemon is available, it may start the user's own Codex app-server for an eligible home with no live Codex process, and stop it after the request. Both routes use Codex's own account/rateLimits/read. A reply is accepted only when its account identity matches the account already identified from that home's thread history; a missing or different identity is discarded.

The island identifies itself to Codex as Perch, with its version. Codex reports this client information to OpenAI in its own usage statistics, subject to Codex's analytics settings. Connecting also changes the shared daemon's User-Agent suffix to Perch; <version> until another originating client initializes or the daemon restarts. If the island is the first such client after a restart, Perch may become the daemon's default originator label until it restarts. Threads keep their own clients' names. Closing the connection does not undo these daemon-wide labels.

The provider programs use their own sign-in and contact Anthropic or OpenAI to fetch usage under their providers' terms. Cowork Island does not read their tokens or Keychain credentials for this refresh; it only checks that Codex's auth.json exists, without opening it. Nothing from this refresh is sent to Cowork Island's servers. This switch is separate from Share usage statistics. The island keeps its refresh schedule and the latest Codex readings in memory; they go at quit. Claude Code updates its own local usage cache and may keep its usual housekeeping files; Codex manages its own local state. The island does not retain the programs' raw output or write a new session transcript for this refresh.

To remember Claude account names on the usage meters, the island also saves each account's identifier, email address and recorded last-seen time, plus a file-format version, in ~/.perch/account-names.json on your Mac. This is plain JSON, not encrypted; it is written atomically with permissions that allow only your user account to read and write it (0600). Names are learned on usage scans while Show usage meters is on, as it is by default, from local identity files and session records already in memory. A session record may still name an account after sign-out until you quit the island. The first usage scan deletes entries whose recorded last-seen time is more than 30 days old, unless the account is observed again in that scan. Switching off Show usage meters deletes the whole file. This data is used only to name usage-meter accounts; it is never sent, logged or included in a diagnostics export.

The island also keeps two records in its own preferences on this Mac: usageAccountSelectionV1 holds a format version, an initial-selection flag, the selected accounts' opaque codes in selection order and the chosen main account's code, if any. usageForgottenAccountsV1 holds a format version, the opaque code and removal time of each Claude account removed with the ✕, and codes without times for selected or main former accounts being watched so their selection can be cleared when they leave. Both records use the same unsalted SHA-256 codes, derived from the provider and account key. They are pseudonymous, not anonymous: someone who knows a candidate account key can recompute its code. Neither record contains an email address, raw account identifier, folder, name or usage figure. Neither record's contents are sent, logged or included in a diagnostics export.

The ✕ in the account picker removes a former Claude account's row, clears its selection and clears its main-account choice if it was the main account. It also immediately removes that account's entry from the remembered-name book and rewrites ~/.perch/account-names.json without it. A local file-write or deletion failure can leave the previous disk contents in place. Until a return is confirmed or you quit the island, session records cannot save that address back into the name file; an identity-file observation can still supply it directly. This removes the meter row and remembered name, not every trace of the account: existing account identifiers in sessions.json, for example, remain.

A removed row can reappear when a refresh finds a reading for that account recognised as signed in through a local folder or a known session, or a reading with a usage window that began more than two minutes after removal. Its removal entry is deleted only after successive refreshes consistently show that evidence for at least one minute. Otherwise, the entry is pruned at the first refresh when more than 15 days have passed since removal. Use within a window already open at removal is not, by itself, return evidence. A watched code is removed when the account is neither selected nor main, or when its row is back on screen, is no longer classified as a former account, without a pending automatic deselection. While its row is absent, a selected or main account stays watched. When no removal or watch entries remain, the whole usageForgottenAccountsV1 key is removed.

A former Claude account with a reading, recognised as signed in by neither a local folder nor a known session, leaves the meters at the next refresh once its displayed reading is more than seven days old. Codex accounts are not subject to this expiry. Status-line readings whose usage windows have all reset use available activity evidence to date the reading, subject to the existing grace period and usage-window-start bound; without that evidence they keep their existing timestamp. This adds no file reads or persistent record. Automatic clearing of an expired or watched missing account's selection and main-account choice requires consistent refresh results for at least one minute. The seven-day exit does not delete its remembered name, whose separate 30-day rule still applies.

Turning Show usage meters off deletes the name file, but keeps both preferences records. It starts no new usage refresh; one already running may finish and prune the removals record. With no refresh there is no pruning, so removals may remain beyond 15 days. Selections have no timed expiry beyond the former-account clearing just described; changing a selection updates that record. The 15-day rule does not expire watch codes. The identifiers temporarily withheld from name learning and the codes and first-observed times of pending return or deselection decisions stay only in memory and disappear at quit. If saving the removals record throws an error, the island logs only “Could not save the removed usage accounts”. That fixed line contains no account data and may appear in the log section of a diagnostics export.

Windows and Microsoft. The Windows edition is coming soon to the Microsoft Store. Once available, it will obtain its updates through the Store, with Store checks after launch and about once a day. These will go to Microsoft, not our website; the Store may install updates under its own settings. Microsoft is an independent controller for its Store, Microsoft account and Windows diagnostic processing, under the Microsoft Privacy Statement. Once the Windows edition is available, as publisher we may view acquisition totals, Store reviews (including their published display names) and Windows error reports in Partner Center. We will use them to maintain the Windows edition and read and answer reviews, on our legitimate interest under Article 6(1)(f) GDPR. We will retain no copy outside Partner Center and will be able to view them for as long as Microsoft makes them available. This is separate from the app's own usage reports.

12.2 The Privacy Policy

Section 12.1 is our privacy statement for this version, together with section 12.3 on usage statistics. Both are part of this Agreement rather than a summary of some other document. They say what leaves your computer, what we keep, who the controller is, and for how long. Nothing else is processed.

A fuller Privacy Policy is published at coworkisland.com/privacy, in the legal section of that site. It describes the same processing at more length, and if it ever describes MORE we will give notice under section 17 before beginning it.

If you want anything in section 12.1 or 12.3 explained, or want to exercise a right you have over your data, write to support@coworkisland.com and we will answer.

12.3 Usage statistics

From version 1.3, the Software sends us usage statistics. We use them only to count, in total, how many installations are in use, which versions, plans, platforms and operating-system versions, languages and regions they run, how many trials end in a purchase, how many installations stop reporting and, from version 2.1, in how many of them first setup reaches a usable session and in how many the Pro window is opened.

The timing, notices and settings described below are those of the macOS edition. The shared reporting service also supports a platform field: macos or windows. A Windows report uses windows and an operating-system version with major, minor and build numbers, without the revision number. Mac reports through version 2.1 omit the platform field and are treated as macOS. The platform field changes neither the purpose nor the recipients or retention of a report.

A report is sent about a minute after the Software starts, and then about once a day while it runs. A report that fails is not sent again. If an earlier version of the Software has run in your macOS user account and its settings are still there, nothing is sent until you have closed the window in which the Software shows you a notice that explains these statistics and carries the switch described below. Quitting the Software while that window is still open does not count as closing it, and the window opens again the next time the Software starts. From version 1.3, that notice is part of the What's new window. If no earlier version has run in your macOS user account, or its settings are gone, as on a new Mac or in a new macOS user account, there is no such notice, and the statistics start at the first launch. For a purchase made under an earlier version of this Agreement, section 17 keeps that version in force, and the notice described above is the one its section 12.2 promises before new processing begins.

From version 2.1, a report also carries the two details described below. If an earlier version of the Software has run in your macOS user account and its settings are still there, these two details are left out of every report until you have closed the What's new window of version 2.1, or of the later version you update to, which carries a notice about them and the switch described below. Having closed the notice of version 1.3, or any other earlier window, does not count. Quitting the Software while that window is still open does not count as closing it either, and the window opens again the next time the Software starts. Until you close it, the two details stay on your Mac and reports are sent without them, under the rules above. On a new installation, they are part of every report from the first one. For a purchase made under an earlier version of this Agreement, section 17 keeps that version in force: where an earlier version of the Software has run in your macOS user account and its settings are still there, the What's new window that carries this notice is the notice its section 12.2 promises before this new processing begins; otherwise, this section is that notice.

Each report carries: a random identifier, created on your Mac the first time a report is sent; the version and build number of the Software; your plan (free, trial, Pro, or free with a mascot pack) and, during a trial, the days it has left; your operating-system version; where supplied, the platform (macOS or Windows); your system language and region; whether it is the report sent after a launch or the daily one; whether our license service has already accepted a report with this identifier; and whether the Software had already run in your macOS user account before the statistics started. The Software works out that last answer on your Mac, from whether certain of its own settings already exist, and sends only the answer.

From version 2.1, a report also carries two details. The first is whether the Software has had a session to show in its panel since counting began: yes or no. Hidden or archived sessions do not count. For this answer the Software uses only whether its panel has a session to show, which the panel already works out for its own display; the statistics receive nothing else about your sessions, such as their content, names, paths, titles or status, or which AI tool they come from, and keep nothing else. The second is how many times the Pro window has opened on your Mac since counting began, including when it opens at its license-key step, up to 100; 100 means 100 or more. Bringing the Pro window forward when it is already open, or moving between its steps, does not count. Neither detail records a checkout click, a purchase, a date or time, or which part of the Software the window was opened from. Because each report is stored with the time it arrived (see below), a change in either detail between two reports shows roughly when it happened. Counting starts with version 2.1; nothing from before it is counted.

A report carries no install id (section 12.1) and nothing derived from it, no license key, no name or email address, and no content from the work you do in the tools the Software watches.

Reports go to our license service, which Cloudflare runs for us. No analytics company or other third party receives them. Our service stores each report, with the time it arrived, in Cloudflare Workers Analytics Engine. It stores no IP address or other detail of the connection with it, and it keeps the reports apart from the license records of section 12.1. Each stored report is deleted automatically three months after it arrives. Until then, Cloudflare Workers Analytics Engine does not let us change or delete a single report. If we keep totals worked out from the reports for longer, those are daily numbers with no identifier. The two details of version 2.1 travel in the same reports, to the same service, under the same random identifier, and are stored and deleted in the same way. They are not joined to the license records of section 12.1.

Cloudflare also keeps for us, for 7 days, a record of every request made to our license service, including these reports and the licensing, price, checkout and claim requests of section 12.1, from either edition. That record includes the IP address the request came from, the approximate location Cloudflare works out from that address (city, postal code, country and coordinates), the network it belongs to (such as your internet provider), and the request's headers, such as its user agent. It does not include the report itself, although a macOS report's user agent names the Software, its build number and the version of the system it runs on. We keep no copy of it. Within those 7 days, the time a report arrived could be matched to that record, and so to an IP address and to any license call made from the same address in those days. The statistics are therefore pseudonymous, not anonymous, and we treat them as personal data.

You can switch them off. In Settings → General, under Privacy, there is a switch labelled "Share usage statistics". It is on unless you turn it off, on a new installation and after an update alike. Switch it off and no further report is sent: a report waiting to be sent is cancelled, the Software stops recording the two details of version 2.1, and the random identifier and those two details are deleted from your Mac. Nothing else in the Software changes. Switch it on again and the Software creates a new random identifier and starts the two details again from scratch. Reports already stored stay until they are deleted as set out above.

The Licensor is the controller of these statistics and of the request records described above. It processes them on the basis of its legitimate interest (Article 6(1)(f) GDPR). For the statistics, that interest is knowing, in total, how the Software and its trial are used, whether its first setup reaches a usable session and whether its Pro window is opened, so that it can maintain the Software and plan its development. For the request records, it is keeping the license service working and secure. Switching the statistics off is how you object to them from then on. You can also write to support@coworkisland.com about either.

13. No warranty, and your legal guarantee

To the fullest extent permitted by law, the Software is provided "as is" and "as available", without warranty of any kind, express or implied, including any implied warranty of merchantability, fitness for a particular purpose, or non-infringement. We do not warrant that the Software will be uninterrupted or error-free, or that it will detect every state of every tool it observes.

This does not affect your statutory rights. If you are a consumer, you have a legal guarantee of conformity for digital content under EU and Spanish law (Directive (EU) 2019/770, implemented in Spain in the consolidated Consumer Protection Act), and nothing in this Agreement excludes or limits it. The Software is a monitoring aid: it is not a safety system, and it should not be relied on as one.

14. Limitation of liability

To the fullest extent permitted by law, our total liability arising out of or in connection with this Agreement or the Software is limited to the amount you paid for the Software. There is no time window on that: a licence sold once and used for years is still a licence you paid for, and a cap that quietly became zero in year two would be no cap at all but a disclaimer wearing one. We are not liable for lost profits, lost data, lost work, or indirect or consequential loss.

Nothing in this Agreement excludes or limits our liability for death or personal injury caused by our negligence, for fraud or fraudulent misrepresentation, for wilful misconduct or gross negligence, or for any other liability that cannot be excluded or limited under applicable law — including your rights as a consumer under section 13.

15. Term and termination

This Agreement applies for as long as you use the Software. It ends automatically if you materially breach section 7 and do not remedy the breach within a reasonable time after we ask you to; on termination you must stop using the Software and remove it from your computers. Sections 8, 13, 14 and 17 survive termination. Ending this Agreement does not affect any refund right you may have against the seller (section 10).

16. Assignment

You may not assign this Agreement or transfer your license key to another person, except that you may transfer your license permanently together with the computer it is installed on, provided you retain no copy and the recipient accepts this Agreement.

We may assign this Agreement, in whole or in part, to a company established and controlled by the Licensor, or in connection with a transfer of the business that publishes the Software. Your rights under this Agreement are unaffected by such an assignment, and you will be told about it in the release notes or by email.

17. Changes to this Agreement

We may publish a revised Agreement. A revision applies only to licenses bought after it is published. It does not change the terms of a license you have already bought, which continues under the version of this Agreement that was in force when you bought it — and continues under it whatever later builds of the Software you go on to install.

There is one rule here and this is it. Nothing installed on your computer, whether by you or, once the Windows edition is available, by the Microsoft Store, and no step you take or omit inside the Software, moves your purchase onto a newer version of this Agreement.

You do not have to take our word for which version that was: every build ships the Agreement it was published under, inside the app, under Settings → License → License Agreement. The copy in the build you bought is the record.

18. Governing law and disputes

This Agreement is governed by Spanish law, excluding its conflict-of-law rules and the UN Convention on Contracts for the International Sale of Goods.

If you are a consumer habitually resident in another country, this choice does not deprive you of the protection of the mandatory consumer-law provisions of that country, and you may bring proceedings in the courts of your own domicile. If you are not a consumer, the courts of the Licensor's domicile in Spain have exclusive jurisdiction.

Before going to court, write to us — most things are quicker to fix than to argue about. If that does not settle it, a consumer may take the complaint to the consumer-protection authority of their own country: in Spain, the municipal or regional consumer office (OMIC / Dirección General de Consumo) and, where the Licensor has adhered to it, the Spanish consumer-arbitration system (Sistema Arbitral de Consumo, governed by Real Decreto 713/2024, de 23 de julio). A consumer resident in another EU country with a cross-border complaint can get free help from the European Consumer Centre network (ECC-Net).

If you are looking for the European Commission's ODR platform, which many online terms still link to: it was shut down on 20 July 2025 and Regulation (EU) 2024/3228 repealed the regulation behind it. The routes above replace it.

If any provision of this Agreement is held unenforceable, the rest remains in force and the unenforceable provision is applied to the fullest extent the law allows.

19. Contact

Questions about this Agreement, about a license key, or about anything the Software does: support@coworkisland.com.

Cowork Island is not affiliated with, endorsed by, or sponsored by Anthropic, OpenAI, Google, Microsoft, Cursor, or any other maker of the tools it observes. All product names and trademarks are the property of their respective owners.