Cowork Island ES

Privacy Policy

Revised: 26 October 2026

The website is available to learn about the product. The app, trial and licensing sections describe how they work; visiting this website does not start a trial or activate a license.

What this policy covers

This policy explains what the Cowork Island app and the coworkisland.com website do with data. Cowork Island is a macOS menu bar app that shows the live status of supported AI-agent sessions in a panel at the top of your screen. It is published by Daniel Pau Castro Engström, an independent developer (sole trader) based in Spain.

The launch, settings, Sparkle, SSH, Shortcuts and local-provider mechanisms below describe macOS. The Windows edition is coming soon to the Microsoft Store; its prospective processing is identified separately. Both editions share the license service.

The short version

What the app reads on your Mac, and why

To show session activity and let you return to your work, the app uses local session records and events from the integrations you use. Depending on the integration, these can include session names, working directories, status, prompts, tool activity and recent messages. To list the sessions of Claude Code and of the Codex app, the app also runs those tools' own programs on your Mac while it watches them. Any connection those programs make is their own, under their makers' terms.

These records support the local panel. If you configure a remote host, the related information can pass to the destination you choose, as described below. Your AI tools and their providers have their own data practices. From version 2.0 the app no longer forwards hook events to a webhook address; that setting is gone.

Local Codex linking

Local Codex pane linking on macOS. To associate a chat running in Codex's shared background server with the terminal window that started or explicitly resumed it, and find that window's herdr pane, the island reads local process identifiers, executable paths, launch arguments, precise process start times, working directories and that terminal process's own herdr environment variables. It compares the chat's creation time encoded in its identifier with the process start time, or an explicit resume identifier with the chat identifier, alongside folder and herdr pane/title checks. This is a bounded inference, not a Codex-provided identification of the window currently showing the chat. Ambiguous candidates or a contradictory readable title prevent that process association from selecting a pane. The same association supports local workspace grouping and checks whether an archived chat still has a pane.

The macOS kernel read returns the process's environment, not just herdr variables: its temporary buffer and parsed dictionary can include other variables. The island immediately filters that dictionary to exactly HERDR_ENV, HERDR_PANE_ID, HERDR_TAB_ID, HERDR_WORKSPACE_ID and HERDR_SOCKET_PATH. Only those environment values are retained for this linking decision. If the terminal process's own environment cannot be read, this reader does not borrow an ancestor process's environment.

These process observations stay in memory for the decision. A click checks a fresh herdr roster and, before focusing a pane selected from process facts, reads those facts again and requires the same unique association. The new process observations are not saved to sessions.json or included as process records in diagnostics exports. The existing local visibility census can still record the resulting pane and workspace grouping. This linking adds no network request, telemetry field, upload or remote process read.

For each click through this shared-server Codex route, a new local Jump log message records only three counts (codexRows, folderMatches, titleMatches) and two yes-or-no values (cardTitlePresent, lineCut). The counts describe eligible Codex pane rows and their folder/title matches; lineCut reports a recognised title/line cut among folder-matching rows. Unavailable counts are -1. This message contains no session text, title, folder, launch arguments, process or pane identifier, socket path or environment value. Other jump log messages are unchanged. This count-only message may be included among the app's recent log lines in a diagnostics export, which the app writes locally for you to review and send yourself.

The app runs two of your agents' own programs, on this Mac. While the app watches Claude Code, it runs Claude Code's own command claude agents --json, every 30 seconds while the panel is open and every 2 minutes otherwise, to read the agents Claude Code lists, and claude --version when it installs its hooks. While the Codex app is open and the app watches Codex, it starts the Codex app's own helper (codex app-server) to read its threads. For those session-discovery operations, the app exchanges requests and answers locally; any provider connection is governed by those programs. Usage-meter refresh below additionally asks Claude Code or Codex to fetch usage from their providers, using Codex's existing daemon where available.

Usage meters: refresh, names and removed accounts

Local usage-meter refresh on macOS. With usage meters enabled, Refresh accounts you're not using (Settings → Usage) is on by default and has its own off switch. While the notch panel is expanded, or Settings → Usage is visible and Cowork Island is the active app, the app can ask for a fresh reading for an account with no reading from the last 15 minutes. It runs that environment's own Claude Code /usage command or asks Codex for its rate limits, one at a time, at most once per 15 minutes per environment, with longer waits after unsuccessful attempts. Closing the surface stops new asks; an ask already running may finish. Switching off either usage meters or this refresh switch cancels an ask in progress.

A Claude folder whose effective settings disable non-essential traffic is never asked. To decide this, the island extracts the setting CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC from Claude's configuration and policy files and from its own environment, including the settings for its own working folder and command. These sources are listed below. It keeps the decision in memory, without logging or saving those settings. If every signed-in folder for an account has usage checks off, its row says so while the reading is old or missing.

For a Codex home served by the Codex app's running daemon, the island asks that existing process over its verified local control socket, then closes the connection. It starts no new program for that route. If no daemon is available, it may start the user's own Codex app-server for an eligible home with no live Codex process, and stop it after the request. Both routes use Codex's own account/rateLimits/read. A reply is accepted only when its account identity matches the account already identified from that home's thread history; a missing or different identity is discarded.

The island identifies itself to Codex as Perch, with its version. Codex reports this client information to OpenAI in its own usage statistics, subject to Codex's analytics settings. Connecting also changes the shared daemon's User-Agent suffix to Perch; <version> until another originating client initializes or the daemon restarts. If the island is the first such client after a restart, Perch may become the daemon's default originator label until it restarts. Threads keep their own clients' names. Closing the connection does not undo these daemon-wide labels.

The provider programs use their own sign-in and contact Anthropic or OpenAI to fetch usage under their providers' terms. Cowork Island does not read their tokens or Keychain credentials for this refresh; it only checks that Codex's auth.json exists, without opening it. Nothing from this refresh is sent to Cowork Island's servers. This switch is separate from Share usage statistics. The island keeps its refresh schedule and the latest Codex readings in memory; they go at quit. Claude Code updates its own local usage cache and may keep its usual housekeeping files; Codex manages its own local state. The island does not retain the programs' raw output or write a new session transcript for this refresh.

For the Claude traffic decision, the app reads and parses these files to extract just env.CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC: each Claude folder's settings.json (or cowork_settings.json) and remote-settings.json; the identity file's top-level env; the machine's /Library/Application Support/ClaudeCode/managed-settings.json and managed-settings.d/*.json; the user or device profile at /Library/Managed Preferences/[<user>/]com.anthropic.claudecode.plist; and .claude/settings.json and .claude/settings.local.json inside its own ~/.perch/usage-ask working folder. It also checks that variable in its own environment and its own command's --settings, and checks CLAUDE_CODE_USE_COWORK_PLUGINS in its environment to choose the user settings file. This is not a scan of your projects' settings. The extracted values are used only to decide whether checks are off; the retained decision and whether it was successfully read stay in memory.

To name a Claude plan when its tier code is unknown, the app also extracts oauthAccount.organizationType from the identity file it already reads. Recognised values give the plan name Team, Enterprise, Max or Pro; if neither the tier nor organisation type is recognised, it shows no plan badge.

The app remembers Claude account names for the usage meters in ~/.perch/account-names.json, on this Mac. For each Claude account identifier it saves the email address and a recorded last-seen time, plus a version for the file format; it saves no Codex account in this file. Names are learned only on usage scans while Show usage meters is on, which is the default. Observations come from local Claude identity files and session records already in memory. A session record may still name an account after sign-out until you quit the island, so the last-seen time does not establish whether the account is still signed in. The file is plain JSON, not encrypted, and is written atomically with permissions 0600 (only your user can read or write it). The remembered address is used only to name an account in the meters when no current identity file or in-memory session supplies its address. The first usage scan deletes entries whose recorded last-seen time is more than 30 days old, unless the account is observed again in that scan. If the app has been closed that long, this happens at the next scan after it runs again. Switching off Show usage meters deletes the whole file. Switching meters back on learns names afresh from current observations. Nothing from this file is sent, logged, included in a diagnostics export or copied into sessions.json.

For a departed Claude account with no address available from its current identity, session memory or the remembered names, the existing fallback remains: Previous account on a Mac with one Claude folder, or the former folder's label on a Mac with several, numbered when needed. The plan type described above remains in memory; this new file retains account names, not plan or usage readings.

The island also keeps two records in its own preferences on this Mac: usageAccountSelectionV1 holds a format version, an initial-selection flag, the selected accounts' opaque codes in selection order and the chosen main account's code, if any. usageForgottenAccountsV1 holds a format version, the opaque code and removal time of each Claude account removed with the ✕, and codes without times for selected or main former accounts being watched so their selection can be cleared when they leave. Both records use the same unsalted SHA-256 codes, derived from the provider and account key. They are pseudonymous, not anonymous: someone who knows a candidate account key can recompute its code. Neither record contains an email address, raw account identifier, folder, name or usage figure. Neither record's contents are sent, logged or included in a diagnostics export.

The ✕ in the account picker removes a former Claude account's row, clears its selection and clears its main-account choice if it was the main account. It also immediately removes that account's entry from the remembered-name book and rewrites ~/.perch/account-names.json without it. A local file-write or deletion failure can leave the previous disk contents in place. Until a return is confirmed or you quit the island, session records cannot save that address back into the name file; an identity-file observation can still supply it directly. This removes the meter row and remembered name, not every trace of the account: existing account identifiers in sessions.json, for example, remain.

A removed row can reappear when a refresh finds a reading for that account recognised as signed in through a local folder or a known session, or a reading with a usage window that began more than two minutes after removal. Its removal entry is deleted only after successive refreshes consistently show that evidence for at least one minute. Otherwise, the entry is pruned at the first refresh when more than 15 days have passed since removal. Use within a window already open at removal is not, by itself, return evidence. A watched code is removed when the account is neither selected nor main, or when its row is back on screen, is no longer classified as a former account, without a pending automatic deselection. While its row is absent, a selected or main account stays watched. When no removal or watch entries remain, the whole usageForgottenAccountsV1 key is removed.

A former Claude account with a reading, recognised as signed in by neither a local folder nor a known session, leaves the meters at the next refresh once its displayed reading is more than seven days old. Codex accounts are not subject to this expiry. Status-line readings whose usage windows have all reset use available activity evidence to date the reading, subject to the existing grace period and usage-window-start bound; without that evidence they keep their existing timestamp. This adds no file reads or persistent record. Automatic clearing of an expired or watched missing account's selection and main-account choice requires consistent refresh results for at least one minute. The seven-day exit does not delete its remembered name, whose separate 30-day rule still applies.

Turning Show usage meters off deletes the name file, but keeps both preferences records. It starts no new usage refresh; one already running may finish and prune the removals record. With no refresh there is no pruning, so removals may remain beyond 15 days. Selections have no timed expiry beyond the former-account clearing just described; changing a selection updates that record. The 15-day rule does not expire watch codes. The identifiers temporarily withheld from name learning and the codes and first-observed times of pending return or deselection decisions stay only in memory and disappear at quit. If saving the removals record throws an error, the island logs only “Could not save the removed usage accounts”. That fixed line contains no account data and may appear in the log section of a diagnostics export.

One optional feature edits a file of yours, and sends nothing. Read usage from Claude Code's status line (Settings → Usage → Claude Code, off by default) chains a small Cowork Island step into the statusLine entry of Claude Code's own settings.json, in every Claude Code configuration directory on this Mac that has one. Claude Code then hands that step the plan-usage figures it already computes for its status line, and the step writes them, two percentages and two reset times, to a file under ~/.perch/usage. Your visible status line is unchanged (the original command runs after ours, with the same input), the original entry is kept and restored verbatim when you switch the feature off, and a directory with no status line is named before the switch moves, because adding one there also hides Claude Code's footer hints. No sign-in, token or Keychain item is read — a credential-based reader was measured and declined on Anthropic's credential-use policy — and nothing about this leaves the machine.

Local diagnostics export

The diagnostics export is yours to send, and it is redacted first. Export diagnostics… (Settings → About) writes a zip to a location you choose and opens nothing. It contains versions, macOS version, locale, time zone, the socket's path with your home folder redacted, the ten display settings (hide in full screen, hide with no session, collapse on mouse leave, Smart Suppress, which is always on from version 2.0, session timeout, after how long quiet Pending and Done cards are archived, how long archived sessions are kept, maximum visible sessions, mascot speed, display choice), session states (a short id, status, source, model, the tool in flight, the terminal it runs in, its process id, how many subagents and tool steps it has, when it was last active, and the last folder name of the working directory), recent hook events (time, event name, source, tool name, whether it came through the plugin, which payload FIELDS were present — never their contents — and a short session id), the socket's state, this app's own saved session rows from ~/.perch/sessions.json minus your prose (full session and provider ids, the terminal or pane identifiers a jump resolves from, the transcript file's name, process id and timestamps), two hours of this app's own log lines, sw_vers, and up to five of this app's own crash reports. It leaves out your prompts, replies, prompt drafts, captured environment variables, session titles and hook prompt previews; it rewrites your home path to ~ in every file; and in the copied agent configuration files it blanks the value of any key whose name suggests a secret. The row says so, and the archive is for you to review before you attach it anywhere.

Licensing and optional connections

License verification after activation does not require a continuous connection. Optional integrations, update checks and provider tools may require one. The End User License Agreement describes the purchased entitlement.

Prices, purchase and automatic activation in macOS 2.1

In macOS 2.1, opening the shop or Pro window also asks our service for a price policy. That request contains no install id or license key. Our price handler uses only the country Cloudflare infers from the connection, and stores nothing itself; Cloudflare's request records are described in section 12.3 of the EULA.

Starting a purchase sends our service the install id, selected product, language, displayed currency and any discount code you enter. To create the checkout, we send Polar the product, currency, language, any applicable discount and the connection's IP address for its tax pre-fill and fraud checks, together with a random claim code. The install id itself is not sent to Polar for checkout. The checkout page is opened in your browser under Polar's terms.

To claim the purchase, the app sends our service its install id and the checkout identifier. Our service reads the checkout, order, customer benefit grants and license-key responses from Polar, checks payment and the order association, and returns only that order's keys. The claim works for 24 hours from checkout creation. In our Cloudflare D1 purchase table we retain only the checkout identifier, a further hash of the install id, the random claim code, the product, the creation time and, after success, the first claim time. We store no raw key, IP address, discount code or customer contact or billing details in that table. Records older than seven days are eligible for deletion by the daily cleanup and before each new checkout record; each cleanup removes up to 500, so an outage or backlog can extend retention. D1 recovery history can retain pre-deletion data for up to 30 days on the paid plan. The ordinary license records created by activation have their own retention. Polar keeps its purchase records under its own privacy policy.

Pending purchases on your Mac. To resume a checkout after a restart, the app keeps its checkout identifier, product, creation time, checkout URL and currency in its own preferences. It removes an entry after successful activation or a final refusal; when it next checks pending purchases, entries that have reached 24 hours are removed without asking the service. If the app is not run again, that local record can remain in its preferences. It holds no license key or install id in the pending-purchase entry.

The app checks a pending purchase when you return from Polar, return to the purchase window or retry: it sends the install id and checkout identifier to license.coworkisland.com/v1/claim, followed by the usual activation. After 24 hours, you can still paste the key from Polar.

The macOS installation identifier is a 64-character SHA-256 hash, stable across reinstalls and preference wipes. It cannot be reversed into the hardware identifier, but it is not anonymous: the salt is a constant in the app, so someone who already has a candidate identifier can hash it and check for a match. It is a pseudonymous identifier. You can read it under Settings > License to quote it in a support request.

If your Mac holds no license key, both automatic update checks and Share usage statistics are off, no remote Mac is set to connect automatically, you are not using the shop or Pro window and have no pending purchase, the only automatic call the app makes to us is the trial-start request, when due and at later launches only until the service starts or refuses the trial. This is not a free-tier condition: a pack activated on Free still requires revalidation. SSH connections go to the computer you named, and local meter refresh may make your provider programs contact their providers; it sends us nothing. The automatic-update and usage-statistics switches are both on by default.

Mac trial and key-management requests carry no cookies, advertising identifier, user agent set by us, or session or usage data. Update checks do carry Sparkle’s user agent naming the app, its version and Sparkle’s version, the ordinary macOS headers and a header requesting an RSS file; they carry no install hash, key or system profile, and we add no header or query string. An accepted download carries the same user agent and system headers, without the feed-only header, and its address names the version chosen. The Beta updates switch only selects which entries of that same feed are offered; the address and request do not change.

Usage statistics from the app

From version 1.3, the app sends us usage statistics. We use them only to count, in total, how many installations are in use, which versions, plans, macOS versions, languages and regions they run, how many trials end in a purchase, how many installations stop reporting and, from version 2.1, in how many of them first setup reaches a usable session and in how many the Pro window is opened. A report is sent about a minute after the app starts and then about once a day while it runs. A report that fails is not sent again. If an earlier version of the app has run in your macOS user account and its settings are still there, nothing is sent until you have closed the window in which the app shows you a notice that explains these statistics and lets you switch them off. Quitting the app while that window is still open does not count as closing it, and the window opens again the next time the app starts. From version 1.3, that notice is part of the app’s What’s new window. Otherwise, for example on a new Mac or in a new macOS user account, the app sends them from its first launch. The two details added in version 2.1, described below, have a notice of their own. If an earlier version of the app has run in your macOS user account and its settings are still there, these two details are left out of every report until you have closed the What’s new window of version 2.1, or of the later version you update to, that carries that notice. Having closed the notice of version 1.3 does not count. Quitting the app while that window is still open does not count as closing it either, and the window opens again the next time the app starts. Until you close it, the two details stay on your Mac and reports are sent without them. On a new installation, they are included from the first report.

Each report contains a random identifier created on your Mac the first time a report is sent, the app version and build number, your plan (Free, trial, Pro, or Free with a mascot pack), the days left while a trial runs, your macOS version, your system language and region (for example, es_ES), whether it is the report sent after a launch or the daily one, whether our license service has already accepted a report with this identifier, and whether the app had already run in your macOS user account before the statistics started. The app works out that last answer on your Mac, from whether certain of its own settings already exist, and sends only the answer. From version 2.1, each report also contains two details. The first is whether the app has had a session to show in its panel since counting began: yes or no. Hidden or archived sessions do not count. For this answer, the app uses only whether its panel has a session to show, which the panel already works out for its own display; the statistics receive nothing else about your sessions, such as their content, names, paths, titles or status, or which AI tool they come from, and keep nothing else. The second is how many times the Pro window has opened on your Mac since counting began, including when it opens at its license-key step, up to 100 (100 means 100 or more). Bringing the Pro window forward when it is already open, or moving between its steps, does not count. Neither detail includes checkout clicks, purchases, dates or times, or which part of the app the window was opened from. Because each report is stored with the time it arrived, a change in either detail between two reports shows roughly when it happened. Counting starts with version 2.1, with nothing from before. A report never contains the installation identifier used for licensing, a license key, your name or email address, or any content from your sessions, such as session names, prompts, replies or file paths.

Reports go to our license service, which runs on Cloudflare in our own account, and no analytics company or other third party receives them. The service stores each report, with the time it arrived, in Cloudflare’s Workers Analytics Engine, without your IP address or other technical details of the connection, and keeps these records apart from the licensing records. Workers Analytics Engine keeps each record for three months after it was written. Cloudflare also keeps for us a record of every request to the license service, these reports included, for 7 days. It holds the IP address the request came from, the approximate location (such as city and country) and the network (such as your internet provider) worked out from that address, and the user agent. We keep no copy of it. Within those 7 days, the time of a report could be matched to that record, and so to an IP address and to any licensing request made from the same address in those days. These are pseudonymous records, not anonymous data.

You can switch the statistics off at any time under Settings > General > Privacy > Share usage statistics. The switch is on unless you turn it off, after an update as on a new installation. When you switch it off, no further report is sent, the app stops recording the two details of version 2.1, and the random identifier and those two details are deleted from your Mac. Nothing else in the app changes. If you switch it on again, the app creates a new random identifier and starts the two details again from scratch.

Forthcoming Windows edition

Windows and Microsoft. The Windows edition is coming soon to the Microsoft Store. Once available, it will obtain its updates through the Store, with Store checks after launch and about once a day. These will go to Microsoft, not our website; the Store may install updates under its own settings. Microsoft is an independent controller for its Store, Microsoft account and Windows diagnostic processing, under the Microsoft Privacy Statement. Once the Windows edition is available, as publisher we may view acquisition totals, Store reviews (including their published display names) and Windows error reports in Partner Center. We will use them to maintain the Windows edition and read and answer reviews, on our legitimate interest under Article 6(1)(f) GDPR. We will retain no copy outside Partner Center and will be able to view them for as long as Microsoft makes them available. This is separate from the app's own usage reports.

In the forthcoming Windows edition, the install id will be SHA-256 of a source tag, a separator, a machine-specific identifier and a fixed Windows application salt. The source will be Windows’ system identification API (backed by TPM or UEFI when available), otherwise a valid SMBIOS UUID, otherwise MachineGuid. The raw identifier will stay on the PC; the hash will be recomputed from the available source and can change if that source changes. The local install-id file will be diagnostic, not the source of licensing identity. Its license requests will use an app-and-version user agent with no install id. The shared reporting service supports a platform field (macos or windows); Mac reports through version 2.1 omit it and are treated as macOS. Windows will report its platform and system version with major, minor and build numbers, without revision. The field changes neither the purpose, recipients nor retention of reports. The timings, notices and controls in the statistics section above describe macOS.

The website

The website does not require an account, shows no advertising and uses no advertising or tracking cookies. Our pages load a small script of our own that counts page views and clicks on the download link. For each view or click we store the date and time, a daily code, what happened (a page view or a download click) and the page. When there is one, we store the link or campaign tag (for example, which download button was used or which campaign link brought you to the page) and, for a page view, the name of the site you came from, when it is another site. We also store whether the device is a Mac, a phone or tablet, or another device. To tell an iPad from a Mac, the script also sends how many touch points the screen supports; we use this only for that and do not store it. The daily code is a short code calculated with a secret key from the date, the IP address and your browser’s user agent. It lets us count how many different people visit each day. It changes every day and differs from the code we use for the app’s update checks, so unless we know the IP address and user agent, we cannot link visits on different days to each other or to an installation of the app. The script uses no cookies or browser storage and creates no identifier on your device. We do not store the IP address, the full user agent or the full address of the page you came from, and we leave out the robots and scripts we can detect and pages your browser loads in advance that you never open. These are pseudonymous records, not anonymous data.

Our server also counts requests for the app download link, as a technical total that includes robots and scripts, which we show separately from the script’s counts. Each of these records holds four facts: the date and time, the name of the website you came from, the link or campaign tag, and your browser family (for example, Safari or Chrome). They contain no IP address, daily code or other identifier. If you open the download link on a Windows, Linux or ChromeOS computer, we send you to a page explaining that Cowork Island is a Mac app instead of starting the download, and that request is not counted in this total. Requests from phones and tablets are not counted in it either. None of these counts measures completed downloads or installations.

Requests from networks we use ourselves are left out of all these counts and of the update-check count. For that, our database keeps codes calculated with a secret key from the networks we choose to exclude, never the addresses themselves; the network of each request is only compared with them and never stored. We also set a functional, first-party cookie on the browsers we use to build and test the site, through a private page that is not linked anywhere, so that our own test visits are not counted. It has the same fixed value on every browser that has it, it carries no identifier, no profile and no analytics, and you never receive it by visiting the site. Cloudflare hosts and protects the website and processes technical request data, including IP addresses. Our hosting no longer makes a routine diagnostic record of the requests handled by the site's own code, such as page loads, the download link, the counting script’s reports and the email forms. For diagnostics, it keeps the messages and error reports that code produces, for up to 7 days. These can include technical details of the request. Where they include a field for the address requested on our site, our hosting removes its query string (the part after the question mark).

If you ask us to email you the Mac link, we send your email address and the message to Resend to deliver the single email you requested, in the language of the page. The email contains a link to the Cowork Island homepage. Asking for the link does not add you to any list, and we do not use your address for marketing. Open and click tracking are disabled for these messages.

When you use one of our email forms, Cloudflare Turnstile checks browser and network signals to help prevent automated abuse. These can include your IP address and technical information about your browser and device. We do not send your email address to Turnstile. Cloudflare processes this information on our behalf to protect the form, and also acts as an independent controller when using Turnstile signals to improve its bot detection, as described in the Cloudflare Turnstile Privacy Addendum.

To limit repeated sends and handle retries, our service stores a random request identifier, keyed identifiers derived from the email address and IP address, the language, timestamps and the request outcome. These security records do not contain the original email address, IP address, verification token or email content. They are pseudonymous records, not anonymous data. The original address is processed while handling your request and by Resend for delivery.

The Windows list

On the page we show to Windows, Linux and ChromeOS computers, you can ask for one email when Cowork Island comes out for Windows. To join, you tick a box to give your consent and then confirm your address: the link we email you opens a page where one click confirms it. We keep the list in our database, hosted by Cloudflare. For each address we store the address itself, the language of the page, the version of the consent sentence you accepted, when you signed up and confirmed, and scrambled copies of the codes in the confirm and remove links. We do not store your IP address or browser details with it. We send the confirmation email and the announcement through Resend, with open and click tracking disabled.

If you do not confirm within 7 days, the link stops working and we delete your address. Once you confirm, we keep it until you leave the list, until we send the Windows announcement (then we delete the whole list), or for at most 24 months from when you signed up. Every email from the list has a link to remove your address: one click on the page it opens deletes it at once. You can also write to support@coworkisland.com.

To prevent abuse, the form uses Cloudflare Turnstile as described above. For each attempt we also keep a code calculated with a secret key from your IP address, and for each confirmation email we send, a code calculated in the same way from your email address, each with its time. These codes limit how often the form can be used from one connection and how many emails one address can receive. They do not contain the IP address or the email address itself, and a daily cleanup deletes them once they are 2 days old. These are pseudonymous records, not anonymous data.

Payments

Polar (Polar Software Inc.) is the merchant of record: Polar is legally the seller and handles checkout, payment details, invoices, and taxes. We never see your card details. Polar's privacy policy applies to checkout: Polar Privacy Policy. Polar is an independent data controller for the customer and payment data it collects.

Your rights and how to reach us

For the licensing data our license server processes (the hashed machine id and, if you bought a license, your license key), the data controller is the publisher, Daniel Pau Castro Engström. The lawful basis is performance of contract (GDPR art. 6(1)(b)): this data is needed to provide the license you asked for and the trial that the End User License Agreement grants you. From version 1.3.1, that trial starts by itself. The same basis covers looking up a price at your request, creating a checkout and claiming its paid order for activation.

Daniel Pau Castro Engström is also the controller for the requested-email service and its abuse-prevention records; the lawful basis is your request (performance of the service you asked for) and, for abuse prevention, our legitimate interest in protecting the form.

Daniel Pau Castro Engström is also the controller for the update-check records. We use them to estimate how many installations of each version are in use, on the basis of our legitimate interest (GDPR art. 6(1)(f)) in maintaining the app and planning its updates. You can switch off automatic checks at any time under Settings > About > Updates > Check for updates automatically. The rights below apply to these records.

Daniel Pau Castro Engström is also the controller for the app’s usage statistics. We use them to count how many installations are in use, which versions, plans, macOS versions, languages and regions they run, how many trials end in a purchase, how many installations stop reporting and, from version 2.1, in how many of them first setup reaches a usable session and in how many the Pro window is opened. The lawful basis is our legitimate interest (GDPR art. 6(1)(f)) in knowing, in total, how the app and its trial are used, whether its first setup reaches a usable session and whether its Pro window is opened, so that we can maintain the app and plan its development. You can object at any time by switching them off under Settings > General > Privacy > Share usage statistics. This stops further reports and the recording of the two details of version 2.1, and changes nothing else in the app. You can also write to us. These records contain a random identifier and not your name, so we cannot tell on our own which ones are yours (GDPR art. 11). The identifier is stored in the app’s settings on your Mac, and switching the statistics off deletes it. If you want us to find your records, write to us before you switch them off, and we will tell you how to read the identifier. Workers Analytics Engine does not let us change or delete individual records, so they stay until they expire, three months after they were written. The rights below apply to these records.

Daniel Pau Castro Engström is also the controller for the website counts: page views, download clicks and download requests. We use them to understand how people find the website and whether they go on to download the app, on the basis of our legitimate interest (GDPR art. 6(1)(f)) in knowing, in aggregate, how the website is used so that we can improve it. You can object at any time. The simplest way is to block the counting script in your browser; the website works the same without it. You can also write to us. These records do not contain your IP address or your name, so we cannot tell on our own which ones are yours (GDPR art. 11). If you give us the date of a visit and the IP address and user agent your browser used that day, we can calculate the daily code for that day. We can then find the page views and download clicks recorded with that code, if they have not expired yet. Workers Analytics Engine does not let us change or delete individual records, so they stay until they expire, three months after they were written. The rights below apply to these records.

Daniel Pau Castro Engström is also the controller for the Windows list. The lawful basis is your consent (GDPR art. 6(1)(a)). You can withdraw it at any time with the link in any email from the list or by writing to us; withdrawing does not affect the lawfulness of what we did before. For the list form’s abuse-prevention records, the lawful basis is our legitimate interest (GDPR art. 6(1)(f)) in protecting the form.

Daniel Pau Castro Engström is also the controller for the diagnostic messages and error reports our hosting keeps for up to 7 days and for the license service’s technical logs. The lawful basis is our legitimate interest (GDPR art. 6(1)(f)) in keeping the website, the app's update checks and the license service working and secure.

When Cloudflare and Resend process your data on our behalf, they may do so outside the European Economic Area, including in the United States. Both companies are certified under the EU-U.S. Data Privacy Framework. Cloudflare’s Data Processing Addendum and Resend’s Data Processing Addendum, which form part of our contracts with them, also include the EU Standard Contractual Clauses for transfers out of the European Economic Area. For more information about these transfers, write to support@coworkisland.com.

Under the GDPR you can request access, rectification, erasure, restriction, or portability of your data, and you can object to processing. Write to support@coworkisland.com and we will respond. You can also lodge a complaint with a supervisory authority; in Spain that is the Agencia Española de Protección de Datos (AEPD).

Data retention

Changes to this policy

If data handling changes materially, we will explain the change and publish an updated policy with a new effective date.

Latest change (26 October 2026): from version 2.1, the app’s usage statistics carry two more details: whether the app has had a session to show in its panel and how many times the Pro window has opened, up to 100, in both cases since counting began. We use them to understand, in total, whether first setup reaches a usable session and whether the Pro window is opened. If you update from an earlier version, the two details are sent only after you close the What’s new window of version 2.1, or of the later version you update to, with the notice about them. Switching the statistics off deletes them from your Mac, with the random identifier. This is described in the sections on usage statistics from the app and on your rights above. Version 2.1 also adds actions for Apple's Shortcuts app and Spotlight, which receive the kind of agent, the state and since when for your sessions, and their names and folders only if you turn that on. This policy now also says what our license service gives Polar when you activate a key, that remote hosts set to connect automatically also reconnect after a dropped connection, and that the app runs Claude Code's and the Codex app's own programs to list their sessions, in the sections on what the app reads on your Mac and on licensing and optional connections. The policy also describes local usage refresh and its controls, account names and selection, former-account removal and its separate retention periods, local Codex pane linking and its limits, price, purchase and automatic-activation data, and the prospective processing of the forthcoming Windows edition.

Previous change (14 October 2026): our hosting no longer makes a diagnostic record of about 1 in 100 requests handled by the site's own code, including the app's update checks. It keeps the diagnostic messages and error reports that code produces, for up to 7 days, and removes the query string from the fields that hold the address requested, as described in the sections on licensing and optional connections, the website and data retention above. Records made before this change expire after their 7 days.