Privacy policy

Pairbar is built so that your work stays on your Mac. This policy explains, in plain language, what personal data is involved in buying and using Pairbar and visiting pairbar.com, who handles it, how long it's kept and what you can ask us to do with it. The full technical detail of what the app reads, stores and sends is further down this page, under The app, in detail.

Who we are#

The controller of your personal data is Roberts Ribakovs, an individual developer in Latvia ("we", "us"). For anything about your data, email support@pairbar.com. A postal address is available on request by email.

The short version#

• The app has no account, no analytics and no crash reporting. It never uploads your chats, files or anything it reads on your Mac.
• The app goes online only to check your licence (and look up its plan), pick up a purchase or an emailed activation link, and check for updates. Buying starts at pairbar.com/buy, which sends you on to Lemon Squeezy's checkout.
• pairbar.com has no analytics and no tracking or advertising cookies.
• Payments are handled by Lemon Squeezy. We never see your card details.

What we collect, and why#

We don't sell your data, use it for advertising, or build profiles.

Who handles it for us#

Some of them are based in, or process data in, the United States. Where data leaves the EU or UK, it's protected by the providers' data-processing terms, including the European Commission's standard contractual clauses or an equivalent safeguard.

How long we keep it#

• Orders and licence records: for as long as your licence exists, and afterwards as long as accounting and tax rules require. Lemon Squeezy keeps its own records under its policy.
• Activation links and codes: a code expires within a day and a link within 30 minutes; the records of them are kept with your licence records.
• The launch list: until the launch email is sent, and afterwards only as long as needed to make sure nobody is emailed twice. Ask us and we delete your address at any time.
• Support emails: as long as we need them to help you, and then for a reasonable time in case the same problem comes back. Ask us and we'll delete them.
• Download counts: they contain no personal data and are kept as statistics.
• Rate-limit counters hold only a one-way hash of an IP address or email, never the value itself, and only count requests over minutes or hours. Our hosts keep request logs for a limited period under their own policies.

Your rights#

Wherever you live, you can ask us to:

• tell you what personal data we have about you and give you a copy (access and portability);
• correct it;
• delete it, unless we must keep it (for example for tax records); deleting your licence records means your licence can't be restored or checked;
• restrict or object to how we use it.

Email support@pairbar.com from the address you bought with, or tell us your order number. We answer within one month. For your purchase and payment data held by Lemon Squeezy, you can also contact them directly. If you're in the EU or UK and unhappy with our answer, you can complain to your local data protection authority; in Latvia that's the Data State Inspectorate (Datu valsts inspekcija).

The website#

pairbar.com uses no analytics, no tracking cookies and no advertising. Your browser stores your light or dark theme choice on your own device (local storage); it never leaves your device. The admin area, used only by us, sets a sign-in cookie. The checkout is Lemon Squeezy's, under their privacy policy.

The app#

Pairbar runs on your Mac and reads the files the Claude and Codex apps keep there. It doesn't upload them: your chats, projects, files and usage never reach us. Its own requests are only the licence check, automatic activation and the update feed, detailed below.

Features that use AI run through your own claude and codex tools, which talk to Anthropic's and OpenAI's services under their privacy policies, on your plans. Pairbar doesn't send anything to those services itself.

Contacting support from the app (Settings → About → Contact support…, the menu-bar menu or ⌘K) opens an email draft in your mail app with the app version, macOS version, the Claude and Codex app versions and your plan (never your licence key). You can add a diagnostics report, which shows you exactly what's in it first: recent lines from Pairbar's debug log, with secrets masked and your home folder shown as ~, and never your chats' contents. Nothing is sent unless you send the email yourself.

Voice dictation (if you use it, once it's available in an update) is processed on your Mac, and its history is kept only on your Mac.

Children#

Pairbar is a tool for developers and isn't directed at children under 16.

Changes#

We'll update this policy when what we collect changes. The version and date are at the top of this page, and changes are listed at the bottom. For a significant change we'll tell customers by email or in the app.

The app, in detail#

Pairbar runs on your Mac. It has no account, no analytics, no crash reporting, and it does not automatically upload the chats it indexes or your Notes library. Messages, attachments and workflow prompts you intentionally send go through your configured Claude or Codex provider under its settings. Pairbar itself makes exactly four kinds of network request, all described under Network: checking your licence key with Lemon Squeezy, activating your subscription with pairbar.com (only when you subscribe or ask for an activation email), checking for updates, and, only with Voice → Recognition → Best accuracy, downloading the Whisper speech model once.

What it reads#

What it stores#

Network#

Pairbar itself talks to three services, and nothing else:

1. Lemon Squeezy's licence API (https://api.lemonsqueezy.com/v1/licenses/…), the store Pairbar is sold through. Requests are made:

• when you activate a key: sends the key and this Mac's instance name;
• while activated, when Pairbar starts (at most once an hour) and about once a week in the background, daily while a subscription has ended, and when you press Check now: sends the key and this Mac's activation id (to check it's still valid, and when the subscription renews);
• when you deactivate this Mac: sends the key and the activation id.

The instance name is the Mac's model identifier and a random id, for example Mac14,2 · 3f9a1c07: no name, serial number, user name or account. Lemon Squeezy sees your IP address, as any web request does, and already knows the email you subscribed with. Nothing about your chats, projects, files or usage is sent. During the trial nothing is sent at all. See Lemon Squeezy's privacy policy.

2. Pairbar's activation service (https://pairbar.com/api/activation/…), so you never copy a key:

• after you press Subscribe (or Renew, or one of the plans): your browser opens https://pairbar.com/buy/<plan>, which sends it on to that plan's Lemon Squeezy checkout. The link carries a random one-time code made on this Mac (32 random bytes, kept in the Keychain for at most a day), and Pairbar asks pairbar.com with that code every few seconds (every 15 seconds after two minutes, for up to 30 minutes, and again when you come back to Pairbar or relaunch it within the day) whether the purchase has come through; the answer is your licence key, which is then activated with Lemon Squeezy as above;
• when you click Activate Pairbar in the activation email (a pairbar://activate link): sends that link's one-time token, and gets the key back;
• when you choose Use my email: sends the email address you typed, so pairbar.com can email a link to the address your subscription has;
• after an activation and after a licence check that succeeds (best effort; nothing changes if it fails): sends your licence key to https://pairbar.com/api/activation/plan, which answers with the plan (Monthly, Yearly or Lifetime) and a subscription's renewal date, since Lemon Squeezy's licence check doesn't say. Nothing about the key's buyer comes back.

Nothing else is sent: no name, no Mac details, nothing about your chats. pairbar.com sees your IP address, as any web request does.

3. The update feed (Sparkle): once a day (if "Check for updates automatically" is on) and when you choose Check for Updates…, Pairbar downloads a small appcast.xml from https://downloads.pairbar.com/ listing the newest version, and downloads an update only when you agree to install it. The request carries the usual app and macOS version in its user agent; no system profile or anything else is sent.

4. The Whisper speech model, only with Settings → Voice → Recognition → Best accuracy (the default on Apple silicon): the first time you dictate (or press Download), Pairbar downloads the model files (about 650 MB) from Hugging Face (https://huggingface.co/argmaxinc/whisperkit-coreml, folder openai_whisper-large-v3-v20240930_turbo_632MB) and its tokenizer (openai/whisper-large-v3). These are plain file downloads with no account or token; Hugging Face sees your IP address, as any web request does. Nothing you say is sent: Whisper runs on this Mac.

Everything else that reaches the internet goes through command-line tools you have installed, which talk to their own services:

• claude: starting chats with custom settings, a fork's first message, follow-ups, reading plan limits, and workflows (their steps, planning a workflow from your description, editing one step’s prompt, goal checks and the doctor's suggestions). Plan limits come from Claude Code's status line or the Claude app first; claude -p /usage is a last resort, and isn't started while it would make Claude Code's once-per-version settings update (your own Claude makes it). Pairbar never writes back anything Claude changes in its settings.
• claude and codex also run the helper chats, second opinions, reviews and workflow runs agents ask for (see Agent actions), only as your settings allow or after you approve them; gh pr diff reads a PR's diff for a review an agent asks for. With Deliver results into the chat that asked on, a result the asking chat didn't collect is sent into that chat with codex queue or claude -p --resume (the same as Send a message), and check-ins a chat scheduled on itself are sent the same way.
• codex: forks, follow-ups, archive, renaming a chat (codex app-server, started for that one request and stopped once Codex answers; it changes the thread's name, archives an available local thread or copies a fork of its saved history, in Codex's own files), cloud tasks, listing your cloud tasks (codex cloud list: at most every 5 minutes, only while the sidebar is showing), and the same workflow work.
• claude or codex for Polish (voice dictation), on to start with (Settings → Voice → Polish turns it off): the dictation's text, after the local cleanup, is sent to your Claude (claude -p --model haiku --no-session-persistence --tools "" --strict-mcp-config --setting-sources "", nothing saved, no tools, no extended thinking, and none of your Claude settings, so your own hooks and permissions don't run for it; your sign-in still works) or your Codex (codex exec --ephemeral --ignore-user-config -s read-only with its smallest model) to be rewritten. It uses your plan. So that it's quick, Pairbar keeps one such Claude process ready in the background (started about 10 seconds after launch while Polish is on; not in Low Power Mode): it's sent one short warm-up message ("Reply with OK.", a few tokens of your plan) when it starts, then waits without using anything until a dictation's text arrives; it handles one dictation and is replaced. It's stopped when Pairbar quits, after 30 idle minutes, and when Polish is turned off. Translate to English uses macOS's own translation on this Mac (the language pair downloads from Apple once, when you ask). With Polish on, when Claude or Codex can't polish (or with Polish with → On-device), Apple's on-device model (Apple Intelligence) polishes on this Mac instead: nothing is sent.
• gh: pull-request status, and for the Tasks view each task's PR title and checks (gh pr list --head <branch> in the task's folder, a few at a time, each answer kept for 10 minutes).

Local interactive Codex new chats and handoffs open through codex://new with the first message and folder, without a CLI model turn. Forks copy history with thread/fork and stop the temporary server before opening the fork. The text is prefilled in Codex, and is sent only when you press Send there; requested model, effort and permissions must be chosen in Codex first.

Workflows run only while Pairbar is running, on the schedule you set, and use your plan like any chat. A step's reply is passed to the steps after it as data, framed so it can't pass for instructions. A read-only Claude step runs without the tools that change files or run commands (Edit, Write, MultiEdit, NotebookEdit, Bash), whatever your own Claude settings allow; a step set to run commands gets Bash but not the edit tools; the planner, the goal check and the doctor only get Read, Glob and Grep (no commands, no MCP servers), and on Codex the read-only sandbox. Model and effort names are checked before they reach a command line, and chat ids before they're used in a path or an argument.

Links open only if they're https://, mailto: (the support link), claude:// or codex://. A link in a tool's output (a cloud session or task) opens by itself only when it's on the service that tool belongs to (claude.ai, chatgpt.com); anything else is shown, not opened.

Live status for Claude (hooks)#

Off until you install it (Settings → Integrations; the Integrations page of the docs has the details). Then Claude Code runs Pairbar's helper (Pairbar.app/Contents/Helpers/pairbar hook <event>) on each hook event, and the helper passes Pairbar only:

• the chat's session id, folder (cwd) and transcript path;
• the event's name (PreToolUse, Stop…), and a subagent's id and type;
• the tool's name and the summary Pairbar already shows for it (a command's program and subcommand, a file's name, a URL's host);
• a notification's kind and Claude's short message, a failed stop's error kind, whether a Stop hook is continuing, a session's start source and end reason;
• the helper's parent process id and the time.

Your prompts, tools' inputs and outputs, Claude's replies and anything else in the event are dropped by the helper before anything leaves it. The line goes to Pairbar over a Unix socket in a private folder (only your account can connect, and Pairbar checks that the sender is you); if Pairbar isn't running, it's dropped, never saved. Nothing goes over the network. Pairbar keeps it in memory only, uses it for the chat's status, and never runs, opens or follows anything in it.

Live status for Codex (hooks)#

Off until you install it (Settings → Integrations), and then only once you've trusted Pairbar's hooks in Codex (/hooks). Codex runs ~/.pairbar/bin/pairbar codex-hook <event> (a link to the helper inside Pairbar) on each hook event, and the helper passes Pairbar only:

• the chat's thread id, folder (cwd) and rollout path;
• the event's name (PermissionRequest, Stop…), and a helper thread's id and type;
• the tool's name and a short summary (a command's program and subcommand, the names of the files a patch touches, a URL's host);
• whether a Stop hook is continuing, a session's start source;
• the helper's parent process id and the time.

Your prompts, commands in full, patches, tools' outputs, Codex's replies and anything else in the event are dropped by the helper before anything leaves it. The rest is as for Claude: a private socket, dropped when Pairbar isn't running, never over the network, in memory only, never acted on. Pairbar doesn't use Codex's notify setting or the Codex app's private connection.

Installing it reads and edits Codex's config, which can hold secrets (an MCP server's API key in its env table). Pairbar appends its block without rewriting anything else, checks the result, and never logs, shows or sends the file's contents: a problem is reported by its line number only. The one copy it makes is the private backup above.

Pairbar's tools for Claude and Codex#

Off until you install them (Settings → Integrations; see the Integrations page of the docs). Then a Claude or Codex chat can call Pairbar's tools, through the pairbar helper, over a Unix socket in a private folder (only your account can connect). Nothing goes over the network, and the helper never logs or passes on its environment (Claude's tools inherit its tokens): the only value it passes is CLAUDE_CODE_SESSION_ID, which Pairbar only compares with what it found itself.

What a chat can get from Pairbar:

• the chats and tasks of its own project as metadata: title, app, status, project, folder (as ~/…), branch, PR and its checks, when it last changed, the tool it's running, how many subagents run. Other projects' only when you turn on Agents can see chats in other projects;
• what a chat is asking you, only when Include what the chat is asking is on (Settings → Notifications);
• skills (and a skill's instructions), your agents (their descriptions, tools and skills, not their instructions), workflows (title, schedule, folder, the most their steps may do, whether agents may run them, last run; never their prompts or replies), plan limits as percentages. A workflow run an agent started gives that agent each step's state and chat, and the start of each reply and the last step's reply, like a helper's.

Never a chat's messages or transcript, handoff files, cloud chats' content, your licence, your settings, or any config file's contents. Anything that looks like a key or token is masked in what the tools return.

Agent actions. A chat can also ask Pairbar to start a helper chat, get a second opinion or a review from the other app, or hand itself off. What it asks for runs only as your settings allow or after you approve it, and runs through your own claude or codex (see Network), on your plan: the helper gets the asking chat's brief, and for a review the diff Pairbar reads itself with git (or gh pr diff for a PR). The asking chat gets back only its own helpers' replies, when it asks for them. A handoff uses the same private handoff file as the chat menu's. Nothing is sent anywhere by Pairbar itself.

Every call is kept in the Activity list (above). If Pairbar isn't running when a chat calls, the helper opens it in the background (unless you turn Start Pairbar when an agent needs it off); it never queues anything for later.

On screen#

• Notifications show the app, the chat title and the project. What the chat is asking is only included if you turn that on.
• Screen Recording is optional and used only for the basket's animations and its stand-in while you drag it, and to find the message box under the dictation pill (see above). Pairbar never records your screen, captures only the two docked windows, the area around the basket and the bottom strip of Claude's or Codex's window, keeps only the latest pictures in memory (the strip not even that), and saves nothing.
• Screen sharing: Pairbar's windows show up in screenshots (Coming Soon) and recordings like any app. Turn on Hide Pairbar from screenshots (Coming Soon) and screen sharing (Settings → About & advanced) to keep the sidebar, quick search and the basket out of them (macOS window sharing type "none"). Some capture (Coming Soon) tools may not honour this.
• Shell commands are shown only as the program and its subcommand (for example "git push"), never with their arguments.

Contacting support#

Contact support… (Settings → About & advanced, the menu-bar icon's menu, or ⌘K: "Contact support" / "Report a problem") opens a small window that shows exactly what would go into an email to support@pairbar.com, before anything happens:

• Pairbar's version and build, the macOS version, the Claude and Codex desktop apps' versions (or "not installed"), and your plan (trial, Monthly, Yearly or Lifetime, and whether it's active). Never your licence key, your email or the Mac's activation name.
• Only if you tick Include diagnostics: the last 200 lines of Pairbar's debug log ($TMPDIR/pairbar-debug.log, which exists only if the debug setting is on), each line cut to 300 characters, cleaned the same way as the Activity list (anything that looks like a key, token or password becomes [redacted], your home folder becomes ~, any other user's folder /Users/…) and with quoted text longer than 40 characters, which could be part of a chat, replaced by "[text]".

Email support… opens a draft in your mail app with that text; Copy puts it on the clipboard. Pairbar sends nothing itself and writes no file: the draft goes nowhere until you send it from your mail app. The privacy policy (pairbar.com/legal/privacy) covers what happens to an email you send us.

Voice dictation#

• The microphone is on only while you dictate: from the press to Stop (letting go, the second press, Send, or Esc). The composer's mic turns into a meter and the pill on Claude's or Codex's message box shows that it's listening.
• Speech becomes text on this Mac with macOS's speech recognition. Your voice isn't uploaded, and no audio is kept unless you turn on Keep audio for 24 hours or Keep my last 20 recordings on this Mac to improve recognition.
• The words show in Pairbar's card while you speak. Into Claude's or Codex's message box they're typed, when you press Send or ✓ (insert), as key presses to that app only (Accessibility), with ⇧↩ between lines. Return is pressed only by Send, only into that app, and only while its message box has the cursor.
• Polish sends the dictation's text (never audio) to your own Claude or Codex. It's on to start with; turn it off in Settings → Voice → Polish.

Optional recognition recordings#

Keep my last 20 recordings on this Mac to improve recognition is off by default. When enabled, Pairbar stores 16 kHz mono WAV audio and JSON notes (Apple and Whisper transcripts, final text, vocabulary prompt, microphone name and recognition outcome) in ~/Library/Application Support/Pairbar/recordings. The directory is private (0700), files are readable only by you (0600). At most 20 recordings remain. Turning the option off or choosing Delete recordings removes them. Audio is never sent to Claude or Codex; Polish receives text and the vocabulary only.

Explicit thumbs-up/down ratings, saved word/phrase correction pairs and the original inserted text before a correction are stored in the private dictation history and follow its retention. Corrections are stored in the existing personal dictionary until you remove them in Voice settings; dictionary terms can be included in recognition hints and text sent to your chosen Polish provider. Ratings are not uploaded.

For vocabulary selection Pairbar reads installed app names and recent dictation text already in its local history. Microphone selection reads Core Audio input devices and their transport; it changes the dictation's input, not your system-wide default.

Clipboard#

Pairbar writes to the clipboard only when you choose a Copy action (the dictation card's Copy included), or when a dictation can't be typed where it was going (Accessibility off): then the text is copied and Pairbar says so. When you paste copied files into a prompt field, Pairbar reads only their file URLs from the clipboard to attach them. It does not read clipboard text in the background.

Prompt attachments#

Files dropped, pasted from Finder or picked with Attach files are stored as local paths in workflow steps and check-ins. Their paths are included with the prompt, so your Claude or Codex can read the files using its own tools. Pairbar does not upload or copy Finder file contents; a workflow step using Claude receives read access to their containing folders. Remove a file chip before sending or saving to exclude it.

Clipboard images are read only on an explicit paste in a focused prompt field and converted to private PNG files in ~/.pairbar/attachments/ (directory 0700, files 0600). They remain until you delete them; removing a chip does not delete the original evidence. There is no background clipboard monitoring. Workflow run input, startup answers with a snapshot of their question names, and attachment paths are saved with that run’s history and sent to its steps; they do not modify the saved workflow. Startup question definitions and any default answers are saved in the workflow. Unsaved launch answers stay in memory while Pairbar runs; they are not uploaded independently.

Notes and browser feedback (Coming Soon)#

Only after you choose Capture (Coming Soon), Pairbar captures one display into memory; the selected crop and comment are saved only when you choose Save. Its windows are excluded. Hover preview and single-click selection may read Accessibility position, size, role, subrole, title, identifier, description and explicitly selected static text from the underlying app when macOS permission is granted; it does not read input values. Source app, bundle ID and window title may accompany the crop. Without element geometry, Capture (Coming Soon) selects a clearly labeled window screenshot (Coming Soon). Text, note revisions, groups, image assets and immutable export packages are private local files under ~/.pairbar/notes/. Dictation uses the existing voice settings.

The optional Chromium extension reads explicitly selected elements and a viewport screenshot (Coming Soon), sending them through registered native messaging to the local browser-inbox/. Pairbar saves per-element crops and removes the queued capture (Coming Soon) after successful import. DOM (Coming Soon) attributes/styles/text, sanitized selected HTML, ancestor context, observed CSS custom properties and readable authored CSS rules are bounded; form values, cookies and browser storage are not collected. URLs omit credentials/query/fragment. Visible images/text may contain private data; review before transfer. Browser native-host registration files are read to explain setup status.

Copy for AI writes the exported Markdown brief and its local file URL to the clipboard only when you choose it. DOM (Coming Soon) evidence includes bounded identifying test attributes and selector diagnostics, an explicit role when present (or a basic tag-derived role), and a label from aria-label or captured visible text.

Send to chat prepares a message and file paths; it does not upload the library. Actual sending follows the selected Claude/Codex channel. Exported copies remain after original notes change. No automatic cloud sync or continuous screen capture (Coming Soon).

Native Notes DOM (Coming Soon) capture (Coming Soon) uses read-only JavaScript through Apple Events in explicitly connected Chrome, Brave, Edge, Chromium or Safari windows. macOS Automation permission and the browser’s Allow JavaScript from Apple Events setting are required. Pairbar does not enable developer settings, install an extension, open a debugging port or upload DOM (Coming Soon) evidence. While Capture (Coming Soon) is active, the reader checks the selected window and page/viewport identity and reads bounded element HTML, attributes, computed CSS and observed CSS variables. Form values and script content are omitted; URLs lose credentials, query and fragment in saved evidence. Visible page text and images may still be private. Firefox and embedded Codex/Claude WebViews do not have this native DOM (Coming Soon) bridge.

Per-step AI editing sends the selected step’s prompt and your requested change to your chosen Claude or Codex CLI. It uses the planner’s read-only tool policy in Pairbar’s private temporary folder, without passing the workflow repository or attachments. Its proposal and request remain in memory until applied or discarded; applying changes the unsaved draft only. Temporary schema and reply files are deleted after the request, as with planning.

Workflow planning keeps the last twelve successful durations per app in local preferences to estimate waiting time. These timing samples contain no prompts or replies and are not uploaded. The current activity list stays in memory with the unsaved planner.

Workflows can explicitly enable or disable Codex command-step network access. Enabled lets shell commands contact online services using your existing tool authentication; Pairbar does not copy GitHub tokens. The file sandbox and publication approval steps stay in force. Existing workflows inherit Codex settings unless you choose a network policy.

Codex workflow planning, AI step editing and doctor helpers use --ephemeral, so the CLI does not persist their session files. Claude helper transcripts are retained for live progress; Pairbar records their known session IDs in its local hidden-chat metadata and hides them from its chat list, including imported desktop aliases. No chat title is used to infer helper ownership. Workflow step chats keep their normal history.

Release availability#

The app bundles a copy of its build-time feature catalog in its own resources. Distribution availability is compiled into the app; no user setting, environment variable or remote request can enable an unfinished feature. Disabled features do not delete previously saved data. This catalog contains no personal information.