Who we are and what this covers
Cortex Labs is the name under which Rafael Augusto, an independent developer, publishes software. In this policy, "we" and "us" mean Cortex Labs. We are the controller of the limited data described here.
This policy covers the website at getcortexlabs.com and these apps:
- Ted Agent — Your AI agent, living in your menu bar.
- Orbit — Your servers. Your cloud. Zero complexity.
- Marshall MQ — Kafka and RabbitMQ, from a guy who can't lie.
- Lily DB — One beautiful client for every database.
- Barney Kube — Kubernetes, without the 500 MB suit.
- Cortex Shelf — The smart notch for macOS.
- Cortex — Memory that remembers what matters.
Yummo Restaurant OS is a separate web service operated by Yummo Tecnologia da Informacao LTDA. It has its own privacy policy; the statements below about our own apps do not describe Yummo.
It also applies to apps we release later, unless an app ships with its own policy.
The apps collect nothing
None of our apps require an account, and none of them contain analytics, advertising, tracking or crash-reporting code. We have no server that receives your content, so we could not look at it even if we wanted to.
Everything an app works with stays on your machine: connection details, query history, saved queries, notes, clipboard history, files, memories and settings. Secrets the apps keep for you, such as passwords and tokens, are stored in the macOS Keychain or in local files on your computer. Deleting an app and its local data removes all of it; there is no copy anywhere else.
Orbit is the one that does not run on your Mac: it runs on the Linux servers you own or rent, and everything it keeps lives there instead. The paragraphs above apply to it the same way, with that server in place of your computer — see the note on Orbit below.
Connections you make
The apps connect to the systems you point them at: your databases, Kubernetes clusters, message brokers, messaging accounts and so on. That traffic goes directly from your computer to those systems. It does not pass through us, and we never see the credentials or the data.
Those systems are run by you, your employer or a third party, and their own privacy terms apply to whatever they log about your connection.
Update checks
The macOS apps check for new versions automatically, using the open-source Sparkle framework. A check is a single request for a small file that lists the latest version. The request states which app is asking and which build it is running, so the app can decide whether to offer an update. It does not include your name, any identifier for you or your Mac, or anything from inside the app.
From these checks we keep one thing: a daily count of how many checks came from each version of each app. It tells us roughly how many copies are in use and how quickly a new release is adopted. We do not store IP addresses with these counts, and they cannot be traced back to a person or a machine.
As with any internet request, your IP address is visible to the infrastructure that answers it, which for us is Cloudflare. Updates are downloaded from Cloudflare's storage as well.
Cortex is installed from PyPI and does not check in with us at all. The Python Package Index has its own privacy policy for package downloads.
AI features
Some apps offer optional AI features, such as explaining a database schema, suggesting an index or summarising a sample of messages. We do not run an AI service and we do not receive these requests.
Instead, the app hands the request to an AI command-line tool already installed and signed in on your computer, such as Claude Code or Codex. When you use an AI feature, the content needed for that request (for example schema metadata, a query, or the sample you asked about) is sent by that tool to its provider, under your own account and that provider's terms and privacy policy. If you never use an AI feature, nothing is sent.
Where an app can tell that content is sensitive, it reduces what is shared. Lily DB, for example, flags columns that look like personal data and redacts them before any AI feature samples a row. You remain responsible for deciding what is appropriate to send to an AI provider.
Notes for each app
Ted Agent
Ted Agent is in private beta. It connects to the accounts you choose to link, such as WhatsApp, Telegram, Slack and email, and reads and sends messages on your behalf. Those messages, and the memory Ted builds from them, are stored on your Mac. They include information about the people you talk to; it stays on your machine with everything else. Content Ted reasons about is sent to your AI provider as described under AI features, and messages travel through the services you linked, as they always do.
Ted asks for macOS permissions only for the features that need them: microphone and speech recognition for voice, screen capture for "capture and ask", Accessibility and automation for controlling other apps, contacts to show names instead of numbers, and notifications. You can refuse or revoke any of them in System Settings.
Orbit
Orbit runs on the Linux servers you own or rent, and that is where everything it handles stays: the console, your applications and databases, logs, metrics, activity and Orbit's own data. We operate no part of it and receive nothing from it. Orbit reaches out only for what it needs to run — releases and the install script from GitHub, and container images from quay.io — and to the services you connect yourself: the GitHub App you install, so a push can deploy, and the S3-compatible storage you choose for backups. The credentials for those stay on your server.
Ted inside the Orbit console is a preview. It answers from what the console already holds, following fixed rules, and shows the evidence for each answer. No AI service is connected to it, and it cannot change anything.
Lily DB
Lily DB talks only to the databases you connect it to. Query results, schema analysis and the personal-data scan are all computed and kept on your Mac. The support link in the app opens GitHub Sponsors in your browser; any donation is handled by GitHub under its own terms.
Marshall MQ
Marshall MQ talks only to the Kafka and RabbitMQ brokers you connect it to. The messages it reads are shown to you and are not uploaded anywhere.
Barney Kube
Barney Kube reads your kubeconfig and talks only to the clusters it describes, authenticating the same way kubectl does. Manifests, logs and secrets stay between your Mac and your cluster.
Cortex Shelf
Cortex Shelf keeps your clipboard history, notes, shelved files and screenshots on your Mac. If you allow it, it reads your calendar to show today's events and uses the camera for an on-screen mirror; the camera image is displayed and never recorded or sent anywhere. Touch ID is used to unlock locked notes and is handled entirely by macOS.
Cortex
Cortex stores its memory in a database file on your machine and makes no network calls of its own.
The website
The website is where we do collect some data. It comes from three places.
- Google Analytics. We use Google Analytics 4 to understand how the site is used. It sets cookies and records the pages you view, your approximate location derived from your IP address, your browser and device type, the site that referred you, and clicks on download buttons along with the app and version. We do not use it for advertising and we do not combine it with anything that identifies you.
- Download counts. When you download an app, our server adds one to a running total for that app and version. No IP address, cookie or identifier is stored with it.
- Hosting. The site and the downloads are served by Cloudflare, which processes IP addresses and standard request data to deliver pages and protect against abuse.
The site works normally with analytics blocked. You can block it with your browser's tracking protection or a content blocker, or with Google's Analytics opt-out add-on, and you can clear the cookies at any time in your browser settings.
When you write to us
If you email us, we receive your address and whatever you include in the message. We use it to reply and to fix what you reported, and we keep the conversation for as long as it is useful for that purpose. Please do not send passwords, production data or other people's personal information.
How long things are kept
- Download and update-check counts are anonymous totals and are kept indefinitely.
- Google Analytics data is kept for the retention period configured in Google Analytics, which is at most 14 months.
- Emails are kept for as long as they are needed to help you, and deleted on request.
- Everything inside an app is kept on your machine until you delete it.
Your rights
Depending on where you live, laws such as the GDPR in Europe, the LGPD in Brazil and the CCPA in California give you rights over your personal data: to know what is held, to get a copy, to have it corrected or deleted, and to object to or restrict its use. Where we rely on your consent you can withdraw it, and you can complain to your local data protection authority.
We process website data on the basis of our legitimate interest in running and improving the site, and on your consent where the law requires it. To exercise any right, email rafaelaugusto.developer@gmail.com. Because the apps send us nothing that identifies you, in most cases the only data we can look up is an email conversation.
Children
Our apps are tools for developers. They are not directed at children, and we do not knowingly collect personal data from anyone under 13.
Changes to this policy
If an app or the website starts handling data differently, we will update this page and the date at the top before the change takes effect. A change that reduces your privacy will also be called out in the release notes of the app it affects.
Contact
Questions about privacy, or a request about your data: rafaelaugusto.developer@gmail.com. See also our Terms of Use.