Privacy
Canape keeps your documents on your devices and in your own iCloud. Line of Flight, which makes it, can’t see what you put in it.
No account, no tracking
There’s no account to create. Canape has no analytics, no ads and no tracking, and it contacts a server of ours only when you send feedback.
Where your data lives
Your spaces, items and attachments live on each device where you use Canape, and in your private iCloud database, through Apple’s CloudKit, which keeps your devices in sync. Canape sends them nowhere else. Without iCloud, they stay on the one device.
Some things stay on each device and never sync: the History of earlier versions, which items you use most (for Recent), and Canape’s settings, including the switches below.
How it’s protected
- On each device, Canape’s database is encrypted with SQLCipher under a 256-bit key made on that device. The key never moves to another device.
- Attachments (photos, scans and PDFs) are encrypted with AES-GCM under a 256-bit key for each space, both on the device and before they go to iCloud.
- These keys are kept in the keychain, where only Canape’s own apps and command-line tool can read them.
- Opening Canape takes Face ID or Touch ID, or your device’s passcode or password. On the Mac it locks again when the Mac sleeps or locks.
- Fields such as PINs and card numbers are hidden on screen until you tap or hover. They’re stored like every other field, inside the encrypted database: Canape is a reference library, not a password manager.
In iCloud
Canape stores your spaces and items in CloudKit’s encrypted fields, in your private iCloud database. Attachments are encrypted with their space’s key before upload, and that key travels in the space’s own encrypted record so your other devices can open them.
How far Apple’s encryption goes depends on your iCloud settings. With Advanced Data Protection on, this data is end-to-end encrypted: only your trusted devices have the keys. Without it, Apple encrypts it in transit and on its servers and keeps the keys, as it does for most iCloud data.
Siri and Spotlight
One switch, Siri & Spotlight, is off until you turn it on, on each device: in Canape’s Settings on the iPhone, and in Settings › Security on the Mac. Turning it on asks for Face ID or Touch ID.
- Spotlight learns each item’s title, template and space, and labels Canape shows, such as a card’s network and an item’s country. Never a field’s value, notes or attachments. On the iPhone, Spotlight can’t show your items while the iPhone is locked.
- Siri can find an item by any detail except hidden fields, open it, and read one field at a time, never a hidden one. On the iPhone that works only while the iPhone is unlocked; on the Mac each read asks for Touch ID or your password. Siri shows the value on screen and doesn’t say it aloud. Canape logs each read.
- When Siri reads a value, it may process the request on Apple’s Private Cloud Compute.
The command-line tool and MCP server
On the Mac, Canape has a command-line tool, canape, and an MCP server, so an assistant like Claude can use it.
- Both are off until you turn them on in Settings › Developer, which asks for Touch ID or your password.
- They run on your Mac and send nothing of yours anywhere. The MCP server talks only to the app that started it.
- Installed from cana.pe, the tool keeps itself up to date: about once a day, when Canape’s database moves to a new version, and when you run
canape update, it downloads the list of releases from cana.pe and, when there’s a new one, that release. The request carries nothing about you or your items: no account, no identifier. Like any download, the server sees your IP address and the request’s user agent, which names the tool and macOS. cana.pe is hosted on GitHub Pages. Installed with Homebrew, the tool never checks by itself; Homebrew does when you run it. - The first time a new app uses them, Canape asks for Touch ID or your password. Settings lists the apps you’ve authorized, each with a Revoke button.
- Canape logs each read of an item: the time, the command, the item and the app. Listing and searching aren’t logged. The log stays on your Mac, keeps the latest 2,000 reads, and Settings › Developer shows the recent ones.
- An app you authorize can read everything in Canape, hidden fields included, and what it does next is up to it. An assistant like Claude sends what it reads to its provider, as it does with anything else you show it.
Sharing and scanning
- When you share an item, Canape makes a file or text holding only what you tick. The file itself isn’t encrypted. AirDrop and Messages encrypt it on the way; other routes, like email, may not.
- When you scan a document, Canape reads it on the iPhone with Apple’s on-device text recognition and, if Apple Intelligence is on, Apple’s on-device model. Nothing leaves the iPhone.
What reaches us
Only what you send us. Send Feedback, in Canape’s Settings, sends your message, the email address you add if you’d like a reply, any screenshots you pick, and Canape’s version, your device model and your system’s version. A small service of ours on Cloudflare emails it to us and keeps no copy. Screenshots go without their metadata, and nothing from your spaces is attached; a screenshot shows whatever was on screen, so check it before sending. If you’ve chosen to share analytics with app developers in your iPhone’s or Mac’s settings, Apple may also send us crash reports.
This website
cana.pe has no cookies, scripts or analytics. It’s hosted on GitHub Pages, and GitHub may log visits as web hosts do.
Changes
If this policy changes, this page will show the new version and its date.
Contact
Line of Flight B.V. (Amsterdam, Netherlands; KvK 90477014) makes Canape and is responsible for this policy. Questions about privacy: hello@cana.pe.