UniOne privacy

Where requests go

UniOne contacts seven places and no others. Two of them are ours. The other five are ones you choose: your university's Canvas, the AI you pick, your timetable link, a page you paste into Ori, and the one download of Ori's voice.

Where	Whose	What goes, and when
Your accountuniplus-api-kappa.vercel.app	Ours	When you create an account or sign in: your email, your password and a random identifier UniOne made up for this Mac, plus your name when you create the account, and the 6-digit code we email you when you type it back. After that, a signed token instead of your password, when the app opens and about once a day while you are online. A message you send the UniOne team from Help, or a request for AI access, when you press Send. On UniOne access, each AI request you send, passed on to Anthropic and not kept. What it keeps.
Updatesuniplus-site.vercel.app, this site	Ours	A plain read of one small file listing the latest version, once each time the app opens after you have signed in, and when you press Check for updates in Settings. Nothing you typed and nothing that identifies you or this Mac.
Canvascanvas.sydney.edu.au	Yours	Your Canvas token, with read requests for units, deadlines, announcements, modules, files and marks, straight from your Mac. A file download goes to whichever of Canvas's own storage hosts Canvas hands back (`.canvas-user-content.com`, `.inscloudgate.net`, `.instructure.com`, `.amazonaws.com`, `*.cloudfront.net`), and your token is deliberately not attached to that request.
Your AIapi.anthropic.com, api.openai.com, generativelanguage.googleapis.com or api.x.ai	Yours	Only when you use an AI feature and press Send on your own key: the key, your question, and only the notes, slide or Canvas text that feature works on, to the one company you chose: Anthropic (Claude), OpenAI, Google (Gemini) or xAI (Grok). More on this.
Your timetablethe calendar link you pasted	Yours	A plain request for the calendar file at the link you added, and nothing else, when the timetable refreshes.
A link you pastethe page you copied the link from	Yours	Only when you press Paste link in Ori: a plain read of that page's title, author and date, so UniOne can write the reference for you. No key, no Canvas data and nothing from your notes.
Ori's voicehuggingface.co and raw.githubusercontent.com	Yours	Once, in the background, the first time UniOne opens after you sign in: a plain download of the voice model and its pronunciation dictionaries, about 340 MB, each file checked against a fixed fingerprint before it is kept. Hugging Face hands the files over from its own `*.hf.co` file service. Nothing about you goes with it, and Ori's voice then runs on this Mac: nothing Ori says and nothing you say is sent anywhere to make or hear it.

That is the complete list. There is no analytics and no crash reporting, and nothing reports which pages you open, what you write or what you ask.

Two of those places do record that UniOne was used, and both are ours: the account server keeps when you signed in and when each of your Macs last checked in, and the update check tells this site that a copy of UniOne opened, and from which internet address. On UniOne access the account server also keeps how many tokens each AI request used and what it cost. Neither keeps anything about what you opened, wrote or asked.

Your account

Your account lives on the UniOne account server. Your password travels to it over HTTPS to be checked and is stored only as a scrypt hash, so nobody can read it back, us included.

Kept: your email address, your name, a hash of your password, whether your account is active, when it was created, when your password was set, when your email address was confirmed, when you last signed in, a note we may write for our own use, and for each Mac signed in to it, the random identifier UniOne made up for that Mac and the dates it was first and last seen. If you ask for AI access: when you asked, your note, the answer, the allowance set for you, and the token counts and cost of each request you send on it. A code we email you is kept only as a scrambled form, and stops working after 30 minutes.
Not kept in the account database: your password, and your internet address. Sign-in attempts are counted against a keyed hash of the address so nobody can sit there guessing passwords, and that count expires within a day. Vercel, which hosts the account server, keeps its usual request logs, as it does for this website, and Resend keeps its own record of the emails it sent.
Never sent to it: your student number, your Canvas token, your AI keys. Text from Canvas or your notes reaches it only inside an AI request you send on UniOne access, and is passed on to Anthropic, never kept. The Mac identifier is a random number, not your serial number or your computer's name.

We email you a code, or a short note you asked for. When you create an account, the account server emails your address a 6-digit code from hello@mail.unione.study to confirm it is yours, and when you choose Forgot password it emails one to reset your password. If you ask for AI access and it is turned on, it emails you to say so. If somebody tries to create an account with an address that already has one, that address gets a one-line note instead of a code. Each email carries the code or the note and nothing more: no link, no image and no tracking. Confirming the address shows it reaches you; it is not proof of who you are.

Resend sends those emails for us. Resend (Resend, Inc., in the United States) is the email service the account server uses. It is given your email address and the message, which is the code or the note and nothing else, and it keeps its own record of what it sent. It also carries the emails that go to the UniOne team: a help message, and a request for AI access. Your Mac never contacts it, which is why it is not in the table above: the account server does.

Help messages go to the UniOne team. When you press Send in Help, the account server emails your message to the UniOne team at hello@unione.study, with your account's email address as the reply address so we can answer, plus the app version and the screen you were on if you chose to include them. The account server does not keep the message. It sits in the UniOne inbox, and in Resend's record of what it sent.

A forgotten password is reset with an emailed code. Choose Forgot password, and the 6-digit code we email you sets a new password and signs your other Macs out. It works for 30 minutes. If email is not getting through, we can still make a one-time reset code by hand (hello@unione.study); only a hash of that code is kept, and it works once, for three days. How to reset.

An account can be deactivated. If it is, the app signs out at its next check and says so. Your notes folder is never touched.

If you used an invite code before accounts, the name and email you typed then were copied into your account, so you only add a password. The earlier record of that code stays with it: a hash of the code, a label we wrote, the name and email, and the dates each Mac checked in.

You can have your account deleted. Write to hello@unione.study and it goes: your email, your name, your password hash and the list of your Macs, and every Mac is signed out. You do not have to say why. If you once used an invite code, that code is revoked and the name and email held with it are deleted. Its hash, its label and the dates each Mac checked in with it stay.

Your AI

AI is optional, and you choose how it runs. On your own key, for Claude (Anthropic), OpenAI, Gemini (Google) or Grok (xAI), every request goes straight from your Mac to that company, and nothing passes through a server of ours on the way. That company's API terms apply. On Gemini's free tier, Google may use what you send to improve its products, and people may review it; its paid tier is not used that way.

On UniOne access, which UniOne turns on when you ask for it, your requests go from your Mac to the UniOne account server, which passes them to Anthropic on UniOne's own key and streams the answer back. The server reads each request only to check it fits the allowance and to count its cost. It does not store or log what you asked, what you included or the answer: it keeps the token counts and the cost, and nothing else. Anthropic's API terms apply to UniOne's key.

Nothing is sent until you ask: a question goes when you press Send, and a tool like Clean notes when you press it. Each takes only what it works on: your question, and the notes, slide or file it is about.
AI can be turned off for a unit, or everywhere with one switch, and then nothing goes at all. Skip AI when you set up, and nothing ever does.
If you use Explain my screen, a picture of the one window you picked goes too. It goes as soon as you pick the window, and it is never saved anywhere.
In an Ori project, a question carries the project's file list, the text of the files you added to it, your instructions for it and what its chats settled. Ori writes in the project's folder only when you press Save, never over a file, and never deletes one.
Ori's memory is short notes of what earlier chats settled, kept in your notes folder. A chat says when it uses them, and you can edit or delete any of them. Incognito chats are never saved and never remembered.

This website

The site is static, hosted on Vercel, with no analytics and no cookies. Its fonts and scripts are served from this site, so no other company sees your visit. Vercel keeps standard request logs, and we do not use them to identify anyone.

What never leaves

Your keys go only to the service that issued them: the Canvas token to Canvas, an AI key to the company that made it. None is sent anywhere else or stored outside the macOS Keychain. UniOne access needs no key of yours at all.

Your notes folder never leaves as a whole. Your notes, drafts, marks, cards, chat history, Ori's projects and memory, and your AI-use log stay in it. Their contents reach an AI only inside a request you send, and you see that request first.

Dictation is turned into text on your Mac, never on a server.

Where things are stored

What	Where
Canvas token, AI keys	The macOS Keychain
Notes, downloaded files, drafts, cards, chat history, Ori's projects, artifacts and memory	Your notes folder, as Markdown and the original files
Settings and a small cache	The app's own folder, `~/Library/Application Support/com.joshbotha.unione`
Your account, and your AI access and its spend if you asked for it	The UniOne account server, as listed above

Nothing on your Mac is encrypted beyond what macOS does for the Keychain and your disk. Treat the notes folder like any other documents folder, and keep your own backups.

Deleting everything

Revoke your Canvas token and your AI key, as the setup guide describes.
Move UniOne to the Bin and remove ~/Library/Application Support/com.joshbotha.unione.
Delete your notes folder, or keep it. It is just Markdown.
Ask us to delete your account, at hello@unione.study.

Changes

This page changes when the app does. It was last edited on 13 October 2026 and describes UniOne 0.7.8, which sends an AI request as soon as you press Send or a tool, and an Explain my screen picture as soon as you pick the window, without the previews it used to show first. 0.7.5 was the first version with Ori's voice, a one-time download and the seventh place on the list above.

Privacy