Privacy Policy

Aktar has no backend and no account system, and the apps contain no analytics or telemetry. The developer receives no data about you or your files.

The access key and secret key you enter are stored only on your device: in the macOS Keychain on a Mac, in Windows Credential Manager on a PC, and in the iOS Keychain or the Android Keystore on mobile. They are used only in signed requests to the S3-compatible endpoint you configure.

Files are uploaded directly from your device to your own storage provider, such as Cloudflare R2 or Amazon S3. They never pass through a server run by Aktar. Your provider's own privacy policy applies to the files you store there.

Your upload history (file names, links, sizes and dates) and small thumbnails stay on your device. Nothing is synced.

• Photos and camera: used only when you choose to pick or take a photo to upload.
• Clipboard: read only when you tap Paste or open an aktar://upload-clipboard link.
• Notifications: local only. No push notification service is used.
• Sharing from other apps: files you share to Aktar are uploaded to your default destination.

• Update checks: Aktar uses Sparkle to download appcast.xml from the project's GitHub releases. No information about you is sent with it. You can turn update checks off in Settings.
• Raycast integration: an optional local API on 127.0.0.1. It is off by default, every request needs a token, and it can never be reached from other computers.

• Update checks: Aktar downloads latest.json from the project's GitHub releases to see whether there is a new version. No information about you is sent with it, and every update is checked against a key built into the app before it is installed. You can turn update checks off in Settings. If you install Aktar from the Microsoft Store, Microsoft's privacy statement applies to that download.
• Clipboard: read only when you ask Aktar to upload it: with the Paste button, the upload shortcut, the notification area menu, an aktar://upload-clipboard link or the Raycast extension.
• Keyboard shortcut: the upload shortcut is registered with Windows as a hotkey. Aktar is only told when that exact combination is pressed and never sees your other keystrokes.
• Notifications: shown locally by Windows. No push notification service is used.
• Raycast integration: the same optional local API as on the Mac. It is off by default, listens only on 127.0.0.1, and every request needs a token kept in Windows Credential Manager.

The aktar command-line tool (@getaktar/cli) and its MCP server, which the Aktar plugins for Claude, Cursor and Gemini CLI run, work through the Aktar app on the same computer. Like the apps, they send nothing to the developer.

• Local connection and token: the CLI and the MCP server connect only to the Aktar app on the same computer, at 127.0.0.1. aktar login saves the app's local connection token and port in a file only you can read (~/.config/aktar/cli.json, or %APPDATA%\aktar\cli.json on Windows), and aktar logout deletes that file. You can also pass them in the AKTAR_TOKEN and AKTAR_PORT environment variables instead. Your storage access keys stay in the Aktar app and are never given to the CLI.
• Files and clipboard: depending on the command, or the tool an AI agent calls, the CLI sends a file, or the file or image on your clipboard, to the Aktar app, which uploads it to the storage destination you set up. These files can contain personal data, and an uploaded file can be opened by anyone with its link.
• What goes back to the AI tool: depending on the tool called, file names, links, upload history, destination and bucket names, bucket listings and small preview images are returned to the AI tool, such as Claude or Cursor. How that tool processes and keeps them depends on its settings and its own privacy policy.
• Optional link shortening: if you set up a link shortener for a destination and its settings or a tool call ask for a short link, the Aktar app sends the file's link to that shortening service. Its privacy policy applies.
• Keeping and deleting data: the connection file and the app's upload history stay on your device. If you start the MCP server with --log, it appends one line per tool call (the time, the tool, its arguments, whether it worked and which upload it touched) to a local file you choose, readable only by you. How long uploaded files and short links are kept depends on your storage provider and your shortening service.
• Installing: the CLI is installed from npm or Homebrew, and the plugins download a fixed version of @getaktar/cli from npm when they start. Those services' privacy policies apply to the download.

getaktar.com is a static site with no accounts or forms. It uses Google Analytics 4 to understand how people find and use it, for example which pages are viewed, where visitors come from, and clicks on the download link and the language menu. Advertising features are always turned off.

• In the EEA, the UK and Switzerland, analytics cookies are set only after you accept the cookie banner. Until then, Google Analytics receives only cookieless signals (Google Consent Mode).
• Everywhere else, analytics is on by default and you can decline it in the banner.
• You can change your choice at any time with Cookie settings at the bottom of every page. Declining removes existing Google Analytics cookies.
• Your cookie choice and your language choice are saved in your browser's local storage, not on a server.

The site is served by Cloudflare, and the Mac and Windows apps are downloaded from GitHub or, for Windows, the Microsoft Store. Their privacy policies apply to those requests, and Google's privacy policy applies to Google Analytics.

Aktar is not directed at children and collects no personal data.

Changes to this policy are published on this page, with a new date at the top. Questions? Email security@getaktar.com.