Summary
Moldavite does not operate a service that receives your data. There is no sign-up, no hosted sync, no analytics, and no telemetry. The developer has no access to your notes, your calendar, or any credential you give the app. Everything below is detail on that one fact.
Because your notes and connected-account data never reach a server operated by Moldavite, the developer never becomes a processor or controller of that content. Google, WordPress.com, and hosts you connect handle data under their own policies.
What Moldavite collects
Nothing. Specifically, the app does not collect, transmit, or store on any server:
- the contents, titles, tags, or file names of your notes
- usage analytics, event tracking, crash reports, or feature telemetry
- your IP address, device identifiers, or an advertising profile
- your calendar events, or the account they came from
- any password, token, or application password you enter
Moldavite has no account system, so there is nothing to sign up for and no profile to delete.
Your notes and where they live
Notes are plain Markdown files with optional YAML frontmatter, written inside a Forge
directory you choose. The default root is ~/Documents/Moldavite/. You can open,
move, back up, or delete them with any other tool, with or without Moldavite installed.
- Note locking encrypts individual notes on disk with AES-256-GCM and Argon2 key derivation. The passphrase is never stored and never leaves your machine; if you lose it, the note cannot be recovered by anyone, including the developer.
- Local semantic search is opt-in. After a one-time model download it runs entirely offline; note text is embedded on your own machine and the index stays inside the Forge.
- Trash retains deleted notes locally for 7 days before permanent removal.
- Exports and backups are written where you point them. Encrypted exports use a passphrase only you hold.
If you place a Forge inside a folder synchronised by iCloud Drive, Dropbox, or a similar service, that service receives your files under its own privacy policy. That is your choice to make, and Moldavite is not involved in it.
Every network connection
This is the complete list of outbound connections the app can make. Each is either triggered by an action you take or, in the case of update checks, disclosed here and limited to version information.
| Connection | When | What is sent |
|---|---|---|
| Update check (GitHub) | About 15 seconds after launch and once a day while open | A request for the signed release manifest. No note data, no identifier. |
| Plugin registry (GitHub) | Only when you press Browse in the plugin settings | A request for the registry file and the plugin you choose to install. |
| Semantic model download (Hugging Face) | Once, after you opt in to semantic search | A request for the model files. No note data. |
| Google Calendar | Only while a Google account is connected | An access token and a date range. See below. |
| Plugin requests | When a plugin you installed runs | Only to hosts named in the plugin manifest and approved by you, and only what that plugin sends. |
| Publishing to WordPress | Only when you publish a note | The note you chose to publish, to the site you configured. |
Calendar access
Moldavite can display events from Apple Calendar and from Google Calendar alongside your notes. Both are read-only. The app never creates, edits, or deletes an event, and it never writes calendar content into your notes on its own.
- Apple Calendar is read through macOS EventKit after you grant permission in the system dialog. Nothing leaves your machine.
-
Google Calendar is read through the Google Calendar API after you
explicitly connect an account. Moldavite requests one scope,
https://www.googleapis.com/auth/calendar.readonly, which is the narrowest scope that allows reading events.
Google calendar data is fetched for the date range you are viewing and held in memory while Moldavite draws the timeline. It stays out of disk storage, search indexes, and exports. Network transport is limited to your computer and Google.
You can disconnect at any time from Settings → Calendar, which deletes the stored token from your system keychain. You can also revoke Moldavite's access from your Google Account permissions page, which invalidates it regardless of what is on your machine.
Google API Limited Use
Moldavite's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Concretely:
- Google Calendar data is used only to display your events inside the app.
- It is never transferred to anyone, because it never leaves your device.
- It is never used for advertising, and never sold.
- No human reads it. There is no server-side component and the developer has no way to access it.
- It is not used to train any machine learning or AI model.
Credentials and secrets
Tokens and passwords are stored in the macOS Keychain under the service name
Moldavite. They are never written into notes, settings files, exports, or logs.
The Google connection stores a refresh token there and keeps the short-lived access token in memory only. Disconnecting removes the refresh token.
Plugins
Plugins run in a sandboxed worker with no network access and no direct system access by default. A plugin must declare the exact hosts it wants to reach and the capabilities it wants to use, and you approve that list before it runs. Consent is bound to a hash of the plugin's code, so any change re-prompts.
A plugin you approve can send data to the hosts you approved. Moldavite enforces the boundary; it does not vet what a third-party plugin does inside it. Install plugins you trust, and read the permission sheet.
Children
Moldavite is a general-purpose notes application and is not directed at children. It collects no personal information from anyone, including children.
Changes to this policy
If the app gains a capability that changes what leaves your device, this page changes in the same release, and the network table above is kept exhaustive. Material changes are also noted in the changelog.
Last updated: 9 August 2026
Contact
Questions about this policy, or about how the app handles something not covered here, can be raised as an issue on GitHub. Moldavite is open source under the MIT License, so every claim on this page can be checked against the source code.