Privacy Policy

Klavadabra reads your typing in order to fix wrong-layout typos. That's it. No keystroke, word, statistic, or correction example is sent to any server we control. Two thin allowed network calls (update check, license-revocation check) are documented below — both opt-out.

What Klavadabra reads

• Global key events, after you grant Input Monitoring in System Settings → Privacy & Security. Used to detect word boundaries and your fix hotkeys.
• The frontmost app's bundle identifier, to decide whether your per-app rules say "skip this app".
• Selected text in the focused field, after you grant Accessibility, only when you press a fix hotkey or auto-fix triggers.

What Klavadabra stores

In RAM only

• The last ~50 characters you typed. Cleared on app switch, secure-input dialog, context change, or app exit.

On disk

Path: ~/Library/Preferences/com.klavadabra.menubar.plist

• Settings, hotkeys, app blacklist, per-app profiles.
• Custom terms and learned correction pairs, when enabled. Auto-learning writes only when you fix a word manually with the hotkey.
• Impact counters: lifetime corrections, monthly auto-correction count, estimated time saved (a number, not the text).
• Up to 20 most-recent correction examples (token pair plus app name), filtered: no emails, no URLs, no newlines, no strings over 80 characters. You can clear them in Settings → Privacy.
• Your Klavadabra Pro license token after Pro activation.

Klavadabra never writes raw typing history to disk. Counters live on disk; your words don't.

What Klavadabra sends

Free users: nothing. Paid users: two narrow, opt-out network calls below. Either can be disabled in Settings → General.

Both calls are made by the standard macOS networking stack and are subject to your firewall, VPN, and "Block all incoming connections" settings. We do not retry on failure beyond the next-day attempt.

We do not use analytics SDKs, crash reporters, account systems, push notifications, or remote dictionaries.

What Klavadabra does not do

• Does not store the keystrokes themselves.
• Does not upload your typed text — ever — to anyone.
• Does not learn from your typing on a server.
• Does not ship a third-party analytics or crash-reporting SDK.
• Does not require an account or a sign-in.
• Does not sell, share, or rent any data.

Permissions and why

Both can be revoked at any time in System Settings → Privacy & Security.

Secure input

When macOS reports IsSecureEventInputEnabled() as true (e.g. you're typing into a password field), Klavadabra:

1. Clears its in-RAM buffer.
2. Stops appending new characters.
3. Refuses to perform text replacement.
4. Shows a secure-input indicator in the menu.

License-purchase data

If you buy Klavadabra Pro, the payment provider (Lemon Squeezy worldwide; Т-Касса for Russian sales) collects your payment details under their own privacy policy. Our license-issuer Worker stores only the license id, your email, the provider's order id, and the issue/revoke timestamps in a Cloudflare D1 database. We use this exclusively to email you the license, fulfill refunds, and answer support. We never join purchase data with app-side behaviour because the app sends us no behaviour data.

Children

Klavadabra is not designed for or directed to children under 13. If a parent or guardian believes that a child has provided personal information, contact us and we will delete it.

Changes

If we add a networked feature beyond the two listed above, this page is updated before the new version ships. The change shows up in CHANGELOG.md with the same release.

Contact

Email [email protected]. We reply within one business day.