# UniOne privacy

Short version: UniOne runs on your Mac and talks to Canvas from there, so your Canvas token never leaves your laptop. Your coursework is never kept by UniOne. It goes to an AI only when you send it: on your own key, straight from your Mac to the company you chose, or on UniOne access, through UniOne's server to Anthropic, which passes it on and keeps none of it. UniOne's own server holds your account: your email, your name, a hash of your password and when you signed in. Web page: https://unione.study/privacy

UniOne is run by Josh Botha. Contact hello@unione.study.

## Where requests go

UniOne contacts seven places and no others. Two of them are ours. The other five are ones you choose: Canvas, the AI you pick, your timetable link, a page you paste into Ori, and the one download of Ori's voice.

| Where | Whose | What goes, and when |
|---|---|---|
| Your account, uniplus-api-kappa.vercel.app | Ours | When you create an account or sign in: your email, your password and a random identifier UniOne made up for this Mac, plus your name when you create the account, and the 6-digit code we email you when you type it back. After that, a signed token instead of your password, when the app opens and about once a day while you are online. A message you send the UniOne team from Help, or a request for AI access, when you press Send. On UniOne access, each AI request you send, passed on to Anthropic and not kept. |
| Updates, uniplus-site.vercel.app (this site) | Ours | A plain read of one small file listing the latest version, once each time the app opens after you have signed in, and when you press Check for updates in Settings. Nothing you typed and nothing that identifies you or this Mac. |
| Canvas, canvas.sydney.edu.au | Yours | Your Canvas token, with read requests for units, deadlines, announcements, modules, files and marks, straight from your Mac. A file download goes to whichever of Canvas's own storage hosts Canvas hands back (*.canvas-user-content.com, *.inscloudgate.net, *.instructure.com, *.amazonaws.com, *.cloudfront.net), without your token. |
| Your AI, api.anthropic.com, api.openai.com, generativelanguage.googleapis.com or api.x.ai | Yours | Only when you use an AI feature and press Send on your own key: the key, your question, and only the notes, slide or Canvas text that feature works on, to the one company you chose: Anthropic (Claude), OpenAI, Google (Gemini) or xAI (Grok). |
| Your timetable, the calendar link you pasted | Yours | A plain request for the calendar file at that link, when the timetable refreshes. |
| A link you paste, the page you copied the link from | Yours | Only when you press Paste link in Ori: a read of that page's title, author and date. No key, no Canvas data and nothing from your notes. |
| Ori's voice, huggingface.co and raw.githubusercontent.com | Yours | Once, in the background, the first time UniOne opens after you sign in: a plain download of the voice model and its pronunciation dictionaries, about 340 MB, each file checked against a fixed fingerprint before it is kept (Hugging Face serves them from its *.hf.co file service). Nothing about you goes with it, and Ori's voice then runs on this Mac: nothing Ori says and nothing you say is sent anywhere to make or hear it. |

That is the complete list. There is no analytics and no crash reporting, and nothing reports which pages you open, what you write or what you ask.

Two of those places do record that UniOne was used, and both are ours: the account server keeps when you signed in and when each of your Macs last checked in, and the update check tells this site that a copy of UniOne opened, and from which internet address. On UniOne access the account server also keeps how many tokens each AI request used and what it cost. Neither keeps anything about what you opened, wrote or asked.

## Your account

Your password travels to the UniOne account server over HTTPS to be checked and is stored only as a scrypt hash, so nobody can read it back, us included.

- Kept: your email address, your name, a hash of your password, whether your account is active, when it was created, when your password was set, when your email address was confirmed, when you last signed in, a note we may write for our own use, and for each Mac signed in to it, the random identifier UniOne made up for that Mac and the dates it was first and last seen. If you ask for AI access: when you asked, your note, the answer, the allowance set for you, and the token counts and cost of each request you send on it. A code we email you is kept only as a scrambled form, and stops working after 30 minutes.
- Not kept in the account database: your password, and your internet address. Sign-in attempts are counted against a keyed hash of the address, and that count expires within a day. Vercel, which hosts the account server, keeps its usual request logs, as it does for this website, and Resend keeps its own record of the emails it sent.
- Never sent to it: your student number, your Canvas token, your AI keys. Text from Canvas or your notes reaches it only inside an AI request you send on UniOne access, and is passed on to Anthropic, never kept.

We email you a code, or a short note you asked for. When you create an account, the account server emails your address a 6-digit code from hello@mail.unione.study to confirm it is yours, and when you choose Forgot password it emails one to reset your password. If you ask for AI access and it is turned on, it emails you to say so. If somebody tries to create an account with an address that already has one, that address gets a one-line note instead of a code. Each email carries the code or the note and nothing more: no link, no image and no tracking. Confirming the address shows it reaches you; it is not proof of who you are.

Resend sends those emails for us. Resend (Resend, Inc., in the United States) is the email service the account server uses. It is given your email address and the message, which is the code or the note and nothing else, and it keeps its own record of what it sent. It also carries the emails that go to the UniOne team: a help message, and a request for AI access. Your Mac never contacts it, which is why it is not in the table above: the account server does.

Help messages go to the UniOne team. When you press Send in Help, the account server emails your message to the UniOne team at hello@unione.study, with your account's email address as the reply address so we can answer, plus the app version and the screen you were on if you chose to include them. The account server does not keep the message. It sits in the UniOne inbox, and in Resend's record of what it sent.

A forgotten password is reset with an emailed code. Choose Forgot password, and the 6-digit code we email you sets a new password and signs your other Macs out. It works for 30 minutes. If email is not getting through, we can still make a one-time reset code by hand (hello@unione.study); only a hash of that code is kept, and it works once, for three days.

An account can be deactivated. If it is, the app signs out at its next check and says so. Your notes folder is never touched.

If you used an invite code before accounts, the name and email you typed then were copied into your account. The earlier record of that code stays with it: a hash of the code, a label we wrote, the name and email, and the dates each Mac checked in.

You can have your account deleted. Write to hello@unione.study and it goes: your email, your name, your password hash and the list of your Macs, and every Mac is signed out. If you once used an invite code, that code is revoked and the name and email held with it are deleted. Its hash, its label and the dates each Mac checked in with it stay.

## Your AI

AI is optional, and you choose how it runs. On your own key, for Claude (Anthropic), OpenAI, Gemini (Google) or Grok (xAI), every request goes straight from your Mac to that company, and nothing passes through a server of ours on the way. That company's API terms apply. On Gemini's free tier, Google may use what you send to improve its products, and people may review it; its paid tier is not used that way.

On UniOne access, which UniOne turns on when you ask for it, your requests go from your Mac to the UniOne account server, which passes them to Anthropic on UniOne's own key and streams the answer back. The server reads each request only to check it fits the allowance and to count its cost. It does not store or log what you asked, what you included or the answer: it keeps the token counts and the cost, and nothing else.

- Nothing is sent until you ask: a question goes when you press Send, and a tool like Clean notes when you press it. Each takes only what it works on: your question, and the notes, slide or file it is about.
- AI can be turned off for a unit, or everywhere with one switch. Skip AI when you set up, and nothing ever goes.
- If you use Explain my screen, a picture of the one window you picked goes too. It goes as soon as you pick the window, and it is never saved anywhere.
- In an Ori project, a question carries the project's file list, the text of the files you added to it, your instructions for it and what its chats settled. Ori writes in the project's folder only when you press Save, never over a file, and never deletes one.
- Ori's memory is short notes of what earlier chats settled, kept in your notes folder. A chat says when it uses them, and you can edit or delete any of them. Incognito chats are never saved and never remembered.

## This website

The site is static, hosted on Vercel, with no analytics and no cookies. Its fonts and scripts are served from this site. Vercel keeps standard request logs, and we do not use them to identify anyone.

## What never leaves

Your keys go only to the service that issued them, and are stored only in the macOS Keychain. UniOne access needs no key of yours. Your notes folder never leaves as a whole; its contents reach an AI only inside a request you send, and you see that request first. Dictation is turned into text on your Mac.

## Where things are stored

| What | Where |
|---|---|
| Canvas token, AI keys | The macOS Keychain |
| Notes, downloaded files, drafts, cards, chat history, Ori's projects, artifacts and memory | Your notes folder |
| Settings and a small cache | ~/Library/Application Support/com.joshbotha.unione |
| Your account, and your AI access and its spend if you asked for it | The UniOne account server |

## Deleting everything

1. Revoke your Canvas token and your AI key.
2. Move UniOne to the Bin and remove ~/Library/Application Support/com.joshbotha.unione.
3. Delete your notes folder, or keep it.
4. Ask us to delete your account, at hello@unione.study.

## Changes

Last edited 13 October 2026. Describes UniOne 0.7.8, which sends an AI request as soon as you press Send or a tool, and an Explain my screen picture as soon as you pick the window, without the previews it used to show first. 0.7.5 was the first version with Ori's voice, a one-time download and the seventh place on the list above.

## For agents

- UniOne is run by Josh Botha. Contact hello@unione.study.
- Seven destinations, two of them UniOne's own (the account server and this site's update file). The other five are chosen by the student; one of them, Ori's voice, is a single download of about 340 MB from huggingface.co and raw.githubusercontent.com, after which the voice runs on the Mac.
- Canvas requests never pass through a UniOne server. AI requests go from the student's Mac, only when the student sends one, either to the provider the student chose (Anthropic, OpenAI, Google or xAI) on the student's own key, or, on UniOne access once approved, through the UniOne account server to Anthropic, which keeps only token counts and cost, never content.
- The account server holds email, name, a password hash, sign-in times and per-Mac identifiers with first and last seen dates, and for UniOne access the request, the allowance and per-request token counts and cost. Never coursework.
- The account server emails a 6-digit code, through Resend (Resend, Inc., United States) as its email sub-processor, to confirm an address at sign-up and to reset a password. It also emails a student whose AI access request was approved, and a one-line note to an address that already has an account. Help messages and AI access requests are emailed to the UniOne team, with the student's address as the reply address, and are not kept by the server. The app never contacts Resend.