Legal

What we collect, and what we cannot

Ubimate collects nothing while you use it on your own machine. This page says what changes when you turn on sync, what this website counts while you read it, and what neither of those can reach.

Effective 10 September 2026 · Last updated 10 September 2026

Introduction

Ubimate is a local-first knowledge workspace. The desktop app keeps everything you write on your own disk. Sync is optional, and when it is on, what reaches our servers is ciphertext we cannot open.

This policy describes what we collect, why, and what you can do about it. The principle it follows is that the least we can collect is the least we can lose, be compelled to hand over, or be tempted to use.

Jurisdiction and legal basis

Ubimate is operated by a company incorporated in Estonia, in the European Union. We are subject to the General Data Protection Regulation and to Estonian law, and the supervisory authority is the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon).

Our legal bases for processing are:

  • Contract — your account credentials and billing details, to provide the sync service you signed up for. Art. 6(1)(b).
  • Legitimate interest — the website measurement described in section 6, to know which pages are read and whether the download works. Art. 6(1)(f).
  • Legal obligation — transaction records, for as long as EU tax law requires them. Art. 6(1)(c).

Local use

Used on your own machine without an account, Ubimate collects nothing and sends nothing. There is no telemetry, no crash reporting and no usage counter, and none of it is switched off by a setting — there is nothing to switch.

Your content lives in a SQLite database on your disk, with your media beside it and, unless you turn it off, a mirror of every page as plain HTML. You can work this way indefinitely with the network off.

On a Mac that has one, the desktop app can use the system’s own on-device AI model to rewrite and summarize text you select, or to draft text from a prompt. It runs on your machine, only when you ask, and Ubimate sends nothing off it for that. It is on by default where the system supports it, and one switch in Settings turns it off completely: no AI action is offered and no text goes to any model. Where the system has no such model it is simply not there.

Whether Local AI is on or off, the desktop app keeps the Mac’s own AI tools (Writing Tools and the Siri editing pop-up) away from your text on macOS 26 and later, so turning Local AI off does not hand your text to the system’s AI instead. On earlier macOS versions, which have no Local AI, Writing Tools stay as the system provides them.

Account and sync

If you create an account for sync, we store:

  • Display name — what collaborators will see beside your cursor and your comments, once sharing arrives. It is a label rather than an identifier, and you can change it whenever you like. A pseudonym works, and we would rather you used one.
  • Email address — required, and permanent. It identifies the account and is an input to the key derivation, so changing it would change your keys and is not possible. It does not have to be an address that identifies you, and there is a good argument for it not being one: a relay address works, including the ones Apple hands out through Hide My Email, and so does any forwarder you control.
  • Contact address — where account and billing mail is sent. It starts out as the address you signed up with. Unlike that one it can be changed — from the app in a later version, and by writing to us until then.
  • Public key — your Ed25519 public key, derived on your device from your passphrase. Your passphrase and private key never reach us.
  • Encrypted document blobs — the updates sync moves between your devices, encrypted on your device before they leave it.
  • Billing details — handled by our Merchant of Record. Full card numbers are never on our servers.

Zero-knowledge encryption

Your passphrase goes through Argon2id on your own device to derive an Ed25519 signing pair and an X25519 exchange pair. Logging in signs a nonce the server issues, so the passphrase is never transmitted. Content is sealed before upload, and each Space has its own content key.

We cannot read your documents, and could not produce them if we were compelled to. What we hold is ciphertext and wrapped keys. How the encryption works sets out the design, and what the server does see.

Website analytics

This website counts visits using Umami, a privacy-respecting analytics tool that we run ourselves, on our own server at analytics.ubimate.com. It is not a third-party service, it sets no cookies, it stores nothing on your device, and it does not fingerprint you.

What it records is the page, where you arrived from, and a little of what you did there — which links you followed, and how far down the page you read — which is enough to know which pages are worth keeping and whether the download works.

It runs on ubimate.com and www.ubimate.com only. Preview and staging addresses load nothing at all, and the desktop application contains no analytics of any kind.

Cookies and storage

This website sets no cookies. It also writes nothing to local storage, session storage or IndexedDB — not for analytics, not to remember a preference, not for anything. You can confirm it in a devtools tab in less time than this sentence takes to read.

The web application is a different matter: signing in there sets a session cookie to keep you signed in. It is scoped to that subdomain and is not used to track you across pages or sites.

Who else is involved

Analytics is not on this list, because we host it. The companies that do process something on our behalf are:

  • Creem — Merchant of Record for subscriptions. Payment processing and tax compliance happen there, under Creem's own privacy policy.
  • Contabo — European hosting for our servers. What is stored there is encrypted before it arrives.
  • OVH — transactional email, so account and billing messages reach you. Your address is processed to deliver them and for nothing else.

We use no advertising network, no Google Analytics, no Facebook pixel, and no service whose business is building profiles.

Data retention

Account data is kept while the account is active. When a subscription ends, the encrypted blobs the relay was holding stay for 30 days and are then deleted — long enough to change your mind, short enough that we are not storing things for people who have left.

Delete the account outright and everything on the server — encrypted blobs, addresses, public key — is deleted within 30 days. What is on your own disk is untouched by either, because it was never ours to remove.

Your rights

Under the GDPR you can ask us to:

  • Access — give you a copy of what we hold about you.
  • Delete — remove your account and its server-side data.
  • Correct — change your contact address.
  • Port — though you may not need us: the app exports HTML and CSV, copies any page as Markdown, and the HTML mirror is already on your disk.

Write to privacy@ubimate.com. You can also complain to your national data protection authority, and if you are in Estonia, to the Andmekaitse Inspektsioon.

Children

Ubimate is not directed at children under 13, or the equivalent age where you live, and we do not knowingly collect their personal data. If you believe a child has given us some, tell us and we will remove it.

Changes to this policy

We may change this policy. A material change is announced at least 30 days before it takes effect — by email if we have one for you, and in the app if we do not. The date at the top of this page is always the version you are reading.

Contact

Privacy questions and requests: privacy@ubimate.com. Anything else: hello@ubimate.com.