Privacy Policy

Last updated: 20 October 2026

Barel is built so your AI work stays on your machine. This policy explains that design, and the smaller set of information we do handle when you visit this website, ask for or redeem an invite, use a licence key, email us, or send in-app feedback.

It applies to https://barel.ai, the Barel Mac app, and the Barel browser extension. It does not cover client work delivered under our ascii.studio studio brand, or third-party AI tools you capture from (Claude, ChatGPT, and so on) — those have their own policies.

Who we are

The data controller is Asymmetrical Ltd, a private limited company registered in England and Wales (company number 12500207). Registered office: 12 Constance Street, London, England, E16 2DQ.

Barel (formerly ModelCaddy) is a product of Asymmetrical Ltd. We also operate ascii.studio, our development studio. In this policy, “we”, “us”, and “our” mean Asymmetrical Ltd.

Privacy questions: hi@barel.ai

The short version

• Captured chats, your Vault, memory, and on-device AI stay on your Mac or in the extension's local vault. We do not host that content and we cannot read it.
• Connecting the extension to the Mac app uses a local connection on your machine, not our servers.
• We do collect some personal data for the website, invites and referrals, licence keys, past purchases, email, and optional feedback. That is listed below.
• We do not sell your personal data.

What stays on your device

The Mac app stores captures, files, and memory in a folder you control. The AI that reads your work runs locally. The extension keeps its vault in browser storage on your machine. Sync between the extension and the app, when you enable it, is over localhost — it does not go through Barel cloud servers.

Local MCP connections (for tools such as Cursor or Claude Code) also run on your machine. We do not receive the contents of those sessions.

You can delete local data by removing the app's data folder or the extension.

What we collect

Invites, referrals and licence keys

When you press Download for Mac, redeem an invite code, ask the Mac app for your own code, or turn Pro on, we store:

• Your email address, in one normalised form: lower case, with any +tag removed, and for Gmail without dots. We send to that form too. This is how we treat one inbox as one person. We also store when you asked and when you verified.
• A hash of your IP address with each download request. It is a SHA-256 hash of the full address with a fixed prefix. It is not keyed with a secret, so it could be matched back to an address by trying every possible address. We treat it as personal data.
• Codes. Your own invite code, and the code you joined with. For promo codes we also store how many times they were used.
• Who joined with whose code. The code you joined with tells us whose invite you used. We use this to count joins for the referral reward.
• Email links. When we email you a link, we store a SHA-256 hash of its token (not the link itself), what it is for, when it expires, and when you opened it. The same goes for the token the Mac app uses to check your referral status.
• Your licence keys and their dates: where each key came from, when we issued it, its end date if it has one, its updates window, and whether it was revoked. We also store whether you have had a referral reward.
• Mac activations. When you turn Pro on, the app sends a device ID, which is a SHA-256 hash it makes on your Mac. We store it with the key and the times Pro was turned on and off, so a key works on one Mac at a time.
• Rate-limit records. To stop abuse we count attempts per IP address (an IPv6 address by its /64 range) and per email. Each record is a SHA-256 hash of the address or email with a fixed prefix, and the time.

If someone uses your code, you see only how many friends have joined with it. You never see their names or email addresses. Someone who joins with your code is not shown who owns it.

The emails we send you contain your links and your licence key. We use this data to run downloads, invites and referral rewards, to issue and check keys, and to stop fake or repeated sign-ups. We do not use it for advertising.

Website forms

These forms are closed during the invite-only launch. We keep what you already sent, as described below.

• Early access / waitlist: email address, so we can send a promo code and product updates you asked for.
• Founder edition: email, the role and AI-usage notes you type, and whether you agree to beta software and to being contacted.
• Roadmap votes: email, the feature you voted for, an optional comment, and whether we may contact you about it.

Past purchases

Nothing is for sale at the moment. If you bought Barel Pro before purchases were paused, checkout was handled by Paddle, who acted as merchant of record. Paddle processed payment details. We do not see or store your card number.

For those purchases we store your email, order identifiers from Paddle, product and price, amount and currency, and the licence key we issue. We email you the key and a download link. Paddle's own privacy policy applies to the payment itself. We still receive refund and order updates from Paddle for those purchases.

Accounts

We do not offer customer sign-in during the invite-only launch. If you created an account before, we keep the email and sign-in data needed for it until you ask us to delete it. To get a lost key, email us.

Email

We send transactional mail (download links, invite and verify links, licence keys, referral rewards, waitlist confirmation) and, where you have asked for them, product updates. We keep a log of each send: the address, which email it was, whether it went out, and any error, so we can fix delivery problems. You can unsubscribe from marketing using the link in those messages. We keep an unsubscribe record so we do not email you again. Support mail you send us is used only to reply and fix the issue — we do not add those addresses to marketing lists unless you already opted in.

In-app feedback

If you submit feedback from the Mac app, that report leaves your device. We may receive the message, a category (bug, feature, and so on), app and OS version, a hashed device identifier, a hash of your licence key (not the key itself), an optional contact email, and an optional screenshot. You choose to send this. We use it to diagnose and improve the product, then delete it when we no longer need it.

Update checks

The Mac app may request a public version list from our website to see whether an update is available. That is an ordinary HTTPS request. Server logs may include an IP address and user-agent, as with any website visit. We do not receive your Vault.

Automatically collected on this website

Like most sites, our host's logs may include IP address, browser type, pages viewed, and approximate time. If you consent, we also use Google Analytics and an X (Twitter) conversion tag to understand traffic and whether ads led to a visit. See Cookies below.

Why we use it (legal bases)

Under UK GDPR we rely on:

• Contract: delivering a licence, sending the key, running the downloads, invites and referral rewards you ask for, transactional email, and support you request.
• Consent: marketing email, Founder-edition contact, and optional comments or screenshots you choose to send.
• Legitimate interests: keeping the site secure, understanding how the marketing site is used, preventing abuse of forms and the feedback endpoint, rate-limiting invites by hashed email and IP address, preventing fake or duplicate sign-ups, and improving the product from feedback you submit.
• Legal obligation: keeping purchase records for tax and accounting.

Who we share it with

We do not sell personal data. We use service providers who process it on our instructions, or (for payments) as an independent merchant of record:

• Cloudflare — hosting, DNS, our database (D1), storage of feedback screenshots (R2), and download delivery.
• Resend — sending our email, including download links, invite links and licence keys, and bounce/complaint handling.
• Paddle — checkout, tax, invoicing, and refunds for past purchases.
• Google — Analytics on this website, and fonts loaded from Google Fonts.
• X (Twitter) — conversion measurement on this website.
• GitHub — hosting the Mac app and browser extension files that our download links point at.

We may also disclose information if required by law, or to establish, exercise, or defend legal claims.

Cookies and similar technologies

Under the UK PECR (and EU ePrivacy rules where they apply), non-essential cookies need your consent before they run. On first visit we show a cookie banner. You can Accept all, Reject non-essential, or Customize. Change your mind any time via the Cookies link in the footer.

• Essential: needed for the site to work — remembering your cookie choice, theme (localStorage), and, for our own staff, a sign-in session. These do not need consent.
• Analytics (optional): Google Analytics (measurement ID G-DNS583M4TY) to see which pages are used. Loaded only if you allow Analytics.
• Marketing (optional): an X (Twitter) conversion tag so we can tell if ads led people here. Loaded only if you allow Marketing.
• Checkout: nothing is for sale at the moment, so this site does not load Paddle checkout and sets no checkout cookies. If purchases reopen, we will update this policy.

Rejecting analytics and marketing does not affect the Mac app or extension. You can also block cookies in your browser.

Google Fonts is loaded from Google's servers when you visit this site, which can involve a network request (including IP address) to Google. That request is not gated by the cookie banner.

International transfers

Some of the providers above are based outside the United Kingdom. When we transfer personal data internationally we rely on an adequacy decision where one exists, or on appropriate safeguards such as the UK International Data Transfer Agreement or Standard Contractual Clauses used by those providers.

How long we keep it

• Waitlist, Founder, and roadmap records: until you unsubscribe or ask us to delete them, unless we must keep a suppression entry so we do not email you again.
• Purchase and licence records: for as long as tax and accounting rules require (typically six years in the UK), and for as long as we need to honour your licence.
• Invite and referral records (your email, request times and IP hashes, codes, who joined with whose code, email-link records, licence keys and Mac activations): we keep them while the invite programme runs, and delete them when you ask. We may need to keep a licence key and its email for as long as the key can be used.
• Rate-limit records: cleaned up once they are more than a day old. The clean-up runs as people use the site, so some records can stay a little longer.
• Email send log: we keep it while the invite programme runs, and delete your entries when you ask.
• Accounts: until you ask us to delete them, or they are clearly abandoned.
• Feedback and screenshots: until the issue is handled and for a short period afterwards, unless a dispute requires longer.
• Server and analytics logs: in line with each provider's default retention.
• Data on your Mac or in the extension: you control it.

Your rights

Under UK GDPR you can ask us to access, correct, or delete personal data we hold, to restrict or object to certain processing, and to receive a copy in a portable format where that right applies. You can withdraw consent for marketing at any time. These rights have limits — for example we may keep purchase records we are required to keep.

To use them, email hi@barel.ai. We may need to confirm who you are. You also have the right to complain to the Information Commissioner's Office. We would rather fix the problem if you contact us first.

If you are in the EEA, you have equivalent rights under the EU GDPR; you may also contact your local supervisory authority.

Children

Barel is not directed at children. We do not knowingly collect personal data from anyone under 16. If you believe we have, email us and we will delete it.

Changes

If we change this policy we will update the date at the top of this page. Material changes may also be noted on the website or by email where we have a reason to contact you.

Contact

Asymmetrical Ltd
12 Constance Street, London, England, E16 2DQ
hi@barel.ai · Support · Terms of Service