Privacy Policy

Last updated 26 September 2026

1. Who we are

Stuart is a Mac app and the online service that supports it. It is built and run by one person, Mutaqin Aryawijaya, an independent developer based in Indonesia, as an individual, with no company behind it yet. In this policy, "Stuart", "we" and "us" mean Mutaqin Aryawijaya, who is the controller of the personal data described here.

Postal address: Central Jakarta 10210, Indonesia.

For any privacy question or request, write to hello@stuartdesk.com.

2. What stays on your Mac

Stuart builds an index of the sources you give it, and keeps it on your Mac:

• code repositories and their git history;
• Claude Code and Codex session files;
• notes and documents, such as Markdown folders, Obsidian and Logseq vaults, PDFs and Notion export folders, and Apple Notes if you grant access;
• call transcripts, summaries, tasks and promises, optional video recordings of calls, and, if you use it, a log of when you confirmed that the people on a call were told.

We can't see this data. Deleting a call in Stuart deletes its transcript, summary, tasks and recording from your Mac. Removing Stuart and its data folder removes the index.

3. What is sent to Stuart's service

Writing answers and transcribing some calls needs an AI model, which runs through Stuart's service. Depending on what you use, the service receives:

• Questions. Your question and the excerpts from your index that are needed to answer it.
• Web lookups. When your own sources don't have the answer, a web search for public facts. Stuart writes these searches without private names from your work.
• Voice. If you turn voice on, your spoken audio while the mic is on.
• Calls. On macOS 26, English calls are transcribed on your Mac and only transcript lines are sent. Other calls send their audio for transcription. If you turn on Watch during a call, still images of the window you chose are sent so the model can read them. Stuart sends no screenshots otherwise.
• After a call. If you keep a recording, its audio is sent once, in pieces, to produce the cleaned-up transcript and summary. The video stays on your Mac.
• Crash reports. On by default, and you can turn them off in Settings. File paths, emails, links, keys and quoted text are removed before a report is sent.

The service passes this content to Google's Gemini API to produce a result, returns the result to your Mac, and does not store the content.

4. What Stuart's service stores

5. Calls and the people on them

When you use Stuart on a call, the voices and words of other people on that call are processed as described in section 3, and their transcripts are stored on your Mac. Stuart never joins a meeting, never speaks into it, and doesn't hide from screen share.

You are responsible for telling the people on your calls that you use Stuart, and for getting their consent where the law requires it. Stuart gives you a line to say at the start of a call. Some US states and many countries require the consent of everyone on a call. If someone on a call asks us to delete their data, we will direct them to you, because the call data is stored on your Mac, not by us.

6. Google sign-in

If you sign in with Google, we ask Google only for your email address and a sign-in identifier (the openid and email scopes), and use them to create and identify your account. We don't request access to your Gmail, Calendar, Drive or contacts.

Stuart's use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

7. Payments

Pro and Max are sold by Dodo Payments, our merchant of record. Dodo Payments collects your payment details, handles tax, and processes refunds under its own privacy policy. We never see your full card number. We receive your customer and subscription IDs and your subscription status.

8. AI models and training

We do not use your data to train AI models. Stuart uses Google's paid Gemini API. Under Google's Gemini API terms, Google does not use prompts or responses from paid services to improve its products. Google logs them for a limited period only to detect abuse and meet legal requirements. When Stuart searches the web for you, Google stores the search prompt and result for 30 days to produce results and to debug and test its search service.

Answers and transcripts are generated by AI. They can be wrong, which is why every sentence of an answer points to a source you can check.

9. Service providers

We use these companies to run Stuart. Each one processes data only to provide its service to us.

10. Legal bases

Where the GDPR or UK GDPR applies, we rely on these legal bases:

• Contract, to provide your account, answers, call features and your plan.
• Legitimate interests, to keep the service secure, prevent abuse, apply fair-use limits and fix bugs through crash reports, which you can turn off.
• Consent, for optional features you turn on, such as Apple Notes access, voice and Watch. You can turn these off at any time in Stuart's settings.
• Legal obligation, for billing records that must be kept by law.

11. Where data is processed

Stuart's service and database run in Singapore. Google, Resend, Dodo Payments and Cloudflare may process data in other countries, including the United States. Where the law requires it, these transfers rely on safeguards such as the European Commission's Standard Contractual Clauses, and, for transfers from Indonesia, on the safeguards required by Indonesia's Personal Data Protection Law. Singapore, where Stuart's service runs, has its own data protection law (the PDPA).

12. How long we keep data

We keep your account data while your account is open. When you ask us to delete your account, we delete your email, devices, usage records and billing IDs. If you are on Pro or Max, cancel it first. Dodo Payments keeps its own billing records as long as tax and accounting law requires. Crash reports and technical logs are kept for a short time and then deleted. Content sent to Stuart's service for an answer or transcription is not stored by us.

13. Your rights

You can ask us to access, correct, delete or export your personal data, to restrict or object to how we use it, or to withdraw consent. Write to hello@stuartdesk.com from the email on your account. We reply within one month.

If you are in Indonesia, you have these rights under Law No. 27 of 2022 on Personal Data Protection (UU PDP), including the right to be told if your data is involved in a breach.

If you are in the EU, the UK or another country with a data protection authority, you can complain to that authority.

California residents. We do not sell or share personal information, as those terms are defined by the CCPA, and we do not use it for targeted advertising. You have the right to know, delete and correct the personal information we hold, and we will not treat you differently for using these rights.

14. This website

stuartdesk.com sets no cookies, stores nothing in your browser, and runs no analytics, ads or third-party scripts. Fonts and media are served from this site. Our host keeps standard request logs, such as IP address and browser type, for a short time to keep the site running and secure.

15. Children

Stuart is not meant for anyone under 16. We don't knowingly collect data from children. If you believe a child has created an account, write to us and we will delete it.

16. Security

Traffic between Stuart and its service is encrypted with TLS. Sign-in tokens are stored only as hashes. Access to the service's systems is limited to what running Stuart requires. No system is perfectly secure, and we will tell you without undue delay if a breach affects your data.

17. Changes and contact

If we change this policy in a way that matters, we will update the date above and tell you in the app or by email before the change takes effect. Questions go to hello@stuartdesk.com.