Privacy Policy

This privacy policy covers the CoIsland Mac app and this website, coisland.app. In short: the app keeps what it learns on your Mac and talks only to the tools you connect, our update server and, once you buy it, our license server. None of them receives the data from your tools. The app has no account, and sends no usage data unless you turn on one anonymous count, described below: which kinds of connector you add.

What the app keeps on your Mac

File or place	What it holds	How long
watches/	One .sql file per monitor: name, connector, schedule, rule, query. No secrets.	Until you delete the monitor (it goes to the Trash)
state.json	Hashes of the row keys each monitor last saw, never the values	Cleared at launch once the monitor is deleted
alerts.json	Your alerts, with the rows or items that fired them, their status and your notes	The 500 newest alerts
checks/	One line per check: monitor, connector, time, duration, outcome, row counts, error category. No rows, no error messages.	62 days
connectors.json	Your connectors, each with its name and where it connects: a Snowflake account with its user, role, warehouse, database and schema; a GitHub host; a GitLab host; a Jira or Confluence site; a Databricks workspace and warehouse; a dbt access URL and account ID; a PostHog project address; a Supabase project; a PostgreSQL or MySQL host, port, database, user and TLS setting; a ClickHouse address, port, database and user; a Sentry address, organization and region; a PagerDuty region with its API and web addresses; a Datadog site outside US1; a New Relic account ID, and its region when it is the EU; a Langfuse region outside the EU or a self-hosted Langfuse’s address, and the project’s public key; the API address of Vercel, Asana, ClickUp, Todoist, Cloudflare or Render; whether a Stripe key is live or test; an HTTP / JSON or feed site, with the header or user name you gave; a Shell command’s folder and timeout, if you set them; a Docker socket’s path, if you gave one; a calendar feed’s host; a Linear workspace, if you gave one. The email of a Jira Cloud, Confluence or Gmail account. No token or password.	Until you delete it
snowflake-imported	A note that the Snowflake CLI’s connections were imported, with their names, so they are imported only once	Until you delete it
agents.json	The agent sessions CoIsland started: which agent, what about, when, the conversation’s id	Until you delete it
agents/briefs/	The brief of each alert you hand to an agent	Until you delete it
Login Keychain	Each connector’s secret: the Snowflake, GitHub, GitLab, Jira, Confluence, Databricks, dbt, Supabase, Sentry, PagerDuty, Vercel, Cloudflare, Asana, ClickUp, Todoist, Notion, Shortcut and Airtable tokens; the Linear, Render, PostHog and New Relic keys, Datadog’s API and application keys, the Langfuse secret key, and the Stripe restricted key; the Gmail app password and a PostgreSQL, MySQL or ClickHouse password; an HTTP / JSON key or a feed’s password or token, if you gave one; a calendar feed’s secret address. Your license key and the license’s signed file.	Until you delete them
~/.snowflake/	The Snowflake CLI’s connections and token files, which CoIsland only reads, to import them	CoIsland never writes or deletes them
macOS preferences	Display settings, such as where the island sits, how each monitor shows in it and the dashboards’ period. Whether you share the connector count, and, while you do, its random id and the month it was made	Until you delete them

watches/ and agents/ are in ~/.coisland/; state.json, alerts.json, checks/, connectors.json, snowflake-imported and agents.json are in ~/Library/Application Support/CoIsland/. That folder and agents/ can be read only by your macOS user. alerts.json is the one file that keeps values from your tools’ results (rows, issues, emails, events, a container’s last log lines), which is why it keeps only 500 alerts. Monitor files hold no secrets and can be shared.

When it opens with no Snowflake connector yet, CoIsland imports, once, the Snowflake CLI’s connections that sign in with a token: their settings go to connectors.json, their tokens to the Keychain. The add form can import one later. The Calendar connector keeps no password: macOS asks you once to let CoIsland read your calendars, and the events are read on your Mac. A calendar feed’s secret address is kept in the Keychain, and its events only in memory. The Reminders, Dock badges and Apple Mail connectors keep no password either: macOS asks you once for Reminders, Accessibility (to read the badges on Dock icons) or permission to control Mail, and everything is read on your Mac. The Docker and Local dev connectors keep no password either, and read Docker, the ports and the processes on your Mac.

Which servers the app contacts

• Each connector’s own service, and only for the connectors you add:

  • Snowflake: your account (<account>.snowflakecomputing.com, or the host its connection names).
  • GitHub: api.github.com, your GHE.com API (api.<name>.ghe.com) or your GitHub Enterprise Server.
  • Jira: your Jira site, Cloud or Data Center.
  • Confluence: your Confluence Cloud site (<name>.atlassian.net).
  • Databricks: your workspace’s address.
  • Linear: api.linear.app.
  • Sentry: sentry.io and the regional address it gives for your organization (such as us.sentry.io or de.sentry.io), or your own Sentry server.
  • PagerDuty: api.pagerduty.com, or api.eu.pagerduty.com for an account in the EU. Testing a new token tries the first, then the second.
  • Vercel: api.vercel.com.
  • Gmail: imap.gmail.com, over IMAP encrypted with TLS, signed in with your address and app password.
  • GitLab: gitlab.com, or your own GitLab server.
  • Cloudflare: api.cloudflare.com.
  • Render: api.render.com.
  • Asana: app.asana.com.
  • ClickUp: api.clickup.com.
  • Todoist: api.todoist.com.
  • Notion: api.notion.com.
  • Shortcut: api.app.shortcut.com.
  • Airtable: api.airtable.com.
  • Datadog: the API address of your Datadog site, such as api.datadoghq.com or api.datadoghq.eu.
  • New Relic: api.newrelic.com, or api.eu.newrelic.com for an account in the EU.
  • Langfuse: your region’s host, cloud.langfuse.com, us.cloud.langfuse.com, jp.cloud.langfuse.com or hipaa.cloud.langfuse.com, or your own Langfuse.
  • dbt: your account’s access URL, such as cloud.getdbt.com or <prefix>.us1.dbt.com.
  • PostHog: your project’s host: us.posthog.com, eu.posthog.com or your own PostHog.
  • Supabase: api.supabase.com.
  • PostgreSQL and MySQL: your database server, at the host and port you give, over the database’s own protocol, encrypted with TLS (unencrypted only for a server on your own Mac).
  • ClickHouse: your ClickHouse server or ClickHouse Cloud service, at the address and port you give, over its HTTP interface with HTTPS (plain HTTP only for a server on your own Mac).
  • Stripe: api.stripe.com.
  • HTTP / JSON and RSS / Atom: the address each monitor names. A key or password goes only to its connector’s site.
  • Status pages: the public status page of the service you pick (such as www.githubstatus.com) or of the address you give, with no secret.
  • Shell command: no server. CoIsland runs the command you wrote on your Mac; whatever that command contacts is up to it.
  • Calendar: no server. CoIsland reads the events macOS Calendar keeps on your Mac; macOS, not CoIsland, syncs the accounts Calendar shows, such as iCloud, Google or Exchange. A calendar feed is fetched from the address you paste (such as calendar.google.com or outlook.office365.com), following https redirects only.
  • Docker: no server. CoIsland reads Docker on your Mac through its local socket (Docker Desktop, OrbStack, Colima, Rancher Desktop or Podman), with GET requests only.
  • Local dev: no server. CoIsland reads the ports and processes on your Mac. A Local server down monitor connects to the port, or the address, it names.
  • Reminders, Dock badges and Apple Mail: no server. CoIsland reads Reminders.app’s lists, the Dock’s badges and, while Mail is open, Mail’s unread messages, all on your Mac.

  Requests use https (http only for a Snowflake connection, an HTTP / JSON address, a feed or a Local dev url: check on your own Mac), each token goes only to its own service, and the app follows no redirect but a calendar feed’s https ones, which carry no token.

• Pictures in what you open. An item from GitHub, GitLab, Jira, Confluence, Linear, Shortcut, Todoist, Sentry or PagerDuty shows its avatars and images, loaded over https from the addresses it gives: that service’s image servers, or any site its author linked. Those servers see an ordinary image request from your Mac. An email’s images are blocked: they load only when you click Load Images on it, and then, as in any mail app, the servers they come from see the request and can tell that the email was opened. A feed entry’s images wait for Load Images the same way.

• Links you click, which open in your browser.

• Updates. Once a day, and when you click Check Now in Settings, the app asks updates.coisland.app, served by Cloudflare, whether a new version is out. The request carries the app’s version and nothing about you or your Mac. An update downloads from the same address, and installs only if its signature matches ours.

• The connector count, only if you turn it on. Settings › General › Privacy has “Share which connector types I add, anonymously”. It is off until you turn it on; the Connectors page invites you once, and Not Now puts the invitation away for good. While it is on, each time you add a connector, the app sends api.coisland.app three things: the kind of connector (such as github), the app’s version, and a random id made on your Mac and replaced every month, so one Mac adding one kind twice in a day counts once. It never sends the connector’s name, address, account, token or anything from your tools, and it sends nothing when you edit, import or use a connector. The request is sent once, retried once if it fails, and never holds up the app. The server stores the day, the kind, the version and a SHA-256 hash of the id, never the id itself or your IP address. Turn it off and nothing more is sent; the counts already made are not linked to you.

• The license server, Keygen, only once you enter a key: to activate your Mac, to confirm the license at launch and every six hours, and to deactivate. It receives the key, a SHA-256 hash of your Mac’s hardware UUID (never the UUID itself), your Mac’s name as set in System Settings, and “macOS”.

Apart from that count, when you turn it on, the app sends no analytics or crash reports. It sends no email and shows no macOS notifications. Send Feedback and Report a Problem, in Settings › About, open a draft in your own mail app with the app’s and macOS’s versions filled in; nothing goes until you send it. If you install an agent from Settings, its maker’s install command runs in a terminal you watch and downloads from its maker, Homebrew or npm.

When you hand an alert to an agent

When you hand an alert to Claude Code (made by Anthropic), Codex (OpenAI) or Cortex Code (Snowflake), CoIsland writes a brief to ~/.coisland/agents/briefs/: the alert’s facts, the monitor’s query, the items, comments and rows it kept, and what was done about it. It then starts that agent’s own command-line tool on your Mac, under your account with its maker, with the brief as its first message.

The agent sends what it reads, the brief included, to its maker’s service, under the terms and privacy policy of your account there: Anthropic, OpenAI, or your Snowflake account. CoIsland shows the agent’s terminal while the app runs, but does not save that conversation, send it anywhere, or take part in the agent’s connection to its maker. Each agent keeps its own history on your Mac, as its maker documents.

A brief can hold data from your tools and from other people: row values, issue text, comments. Hand an alert to an agent only when your company’s rules allow that data to go to that service.

To show whether a session is working or waiting for you, CoIsland reads the session files each agent writes on your Mac, such as ~/.claude/sessions/, and nothing leaves your Mac.

When you buy a license

• Payment. You pay on Stripe’s checkout page, and the sale goes through Link, Stripe’s merchant of record. Stripe and Link collect your email, payment details and billing address, calculate the tax, send the receipt and pay back refunds, under Link’s privacy policy and Stripe’s. Their pages may set their own cookies. We never see your card number.
• Your license. When Stripe confirms the payment, our license service at api.coisland.app, which runs on Cloudflare, creates your license at Keygen. The license holds its key, your email, when it ends for Pro, the Stripe orders, payments and subscription that bought it, the Macs activated with it and, if it was refunded, that it was and when. It emails you the key from licences@coisland.app, through Cloudflare’s email service.
• Refunds. When you request a refund, on the refund page or from Settings › Licence, you send our license service your key. If the purchase can be refunded, it emails a confirmation link to the email on the license, from licences@coisland.app; the link works for one hour. When you confirm, it asks Stripe to refund the payment, and the license records that it was refunded and when.
• The thanks page asks api.coisland.app for the key of the order in its address. It shows the key for 24 hours after the purchase, and never after.
• How long. We keep the license for as long as it can be used: for good for Lifetime, which never stops working, and until its subscription ends for Pro. Stripe keeps the order for as long as the law requires.

When you request a connector

The request form, on /connectors/request/ (where the app’s Request a connector button leads) and at the foot of the connectors page, sends api.coisland.app your email, the name of the tool you want connected, and what you would need it to watch, if you wrote it.

• What is stored. Those three, and when you sent them, in a database at Cloudflare (D1) behind api.coisland.app. The tool’s name is stored in one spelling (Pipedrive CRM as pipedrive-crm), and the same email and tool are kept once. When that connector ships we also note when we told you, and the discount code we sent you.
• The emails it brings. Two, from licences@coisland.app through Cloudflare’s email service. The first confirms your request at once. The second says the connector is ready, when it ships, and carries a single-use discount code. The code is made at Stripe, with the connector and the number of your request attached, not your email. We send nothing else to that address: no newsletter, and it goes on no list.
• The bot check. The form uses Cloudflare Turnstile, which loads from challenges.cloudflare.com once you start filling in the form, or when the request page opens. It reads signals from your browser to tell a person from a bot, under Cloudflare’s Turnstile privacy notice, which says they are not used for advertising. To confirm the check, our server sends Cloudflare the check’s token and your IP address.
• Rate limits. Your IP address also counts how many requests arrive from it in a minute, at Cloudflare. It is not stored with your request.
• How long. Until you ask us to delete it: write to hello@coisland.app from that address.

What the website collects

coisland.app is a set of static pages served by Cloudflare.

• Request data. Cloudflare receives what every request carries: your IP address, the page, the time, your browser’s user agent and the page you came from. It uses this to deliver and protect the site, under Cloudflare’s privacy policy. The site keeps no logs of its own. Cloudflare’s dashboard shows us traffic totals and, for a short time, a sample of the requests it blocked or challenged as threats, with their IP addresses.
• Cookies. The site sets no cookies and uses no browser storage. The connector request form’s Turnstile check runs in a frame from challenges.cloudflare.com, which keeps what it needs there, under its own rules, as described above. Cloudflare may set a security cookie while it checks that a visitor is not a bot, such as __cf_bm (expires after 30 minutes of inactivity) or cf_clearance (after a challenge). Cloudflare lists these cookies as strictly necessary.
• Error reports. If a page fails to load, your browser may report the failure to Cloudflare through Network Error Logging. Cloudflare says it drops the IP address once it has processed the report.
• No analytics. The site runs no analytics or advertising. Its only third-party script is Cloudflare Turnstile on the connector request form, loaded as described above. Its fonts and images come from coisland.app. If we add analytics, this page will say so before it goes live.
• Downloads. The download button fetches the app from updates.coisland.app, served by Cloudflare like the site.
• Buying. The buy page sends you through api.coisland.app to Stripe’s checkout. The refund page sends it the key you type, and then the confirmation link’s token when you confirm.

Email you send us

Mail to hello@coisland.app reaches us through an email forwarding service. We keep your address and message to answer you, and for nothing else. Ask us and we will delete them.

Your choices and how to delete your data

You can read, move or delete anything the app keeps. To remove CoIsland completely, quit it and delete the app, ~/.coisland/, ~/Library/Application Support/CoIsland/, the Keychain items named com.dontizi.coisland.connectors (one per connector, its account named after the connector, such as github/work) and com.dontizi.coisland.licence, and its preferences (defaults delete com.dontizi.coisland). CoIsland leaves the Snowflake CLI’s connections in ~/.snowflake/ as they are; an earlier version added the Snowflake connections you created there, in connections.toml with a <name>.token file beside it, which you can remove with the Snowflake CLI. Each agent’s own files are managed by that agent.

To see, correct or delete what we hold about you, write to hello@coisland.app: the email you send us, your connector requests, and, if you bought a license, the license at Keygen. Deleting the license ends it on every Mac. For your order, Link and Stripe answer requests themselves. For what an agent sent or what Cloudflare processed, use the choices Anthropic, OpenAI, Snowflake or Cloudflare offer.

Children

CoIsland and this site are made for work and are not directed at children. We do not knowingly collect personal information from children. If you think a child has sent us information, write to us and we will delete it.

Changes to this policy

When what the app or the site does with data changes, we update this page and the date at the top. A change that collects more, such as analytics, appears here before it takes effect. The terms of service cover the rest.

Contact

CoIsland is made by DonTizi, an independent developer based in Montreal, Quebec, Canada, who is responsible for this policy and for protecting personal information. Questions about this policy or your data go to hello@coisland.app.