Privacy Policy

This Privacy Policy explains how Choop Labs LLC, a Delaware limited liability company ("Choop Labs," "we," "us"), the maker of the Slash Command application and website (together, the "Service"), handles information. It forms part of our Terms of Service. Accepting those Terms is separate from your optional analytics choice and any consent required by law. For the limited personal data described here, Choop Labs is the data controller.

1. Encrypted local storage

Slash stores commands, notes, attachments, clipboard history, chat and dictation history encrypted on your Mac. Encryption keys and provider API keys are held in macOS Keychain. App locking denies access to protected content and closes content interfaces. This does not promise protection from a compromised Mac or guarantee that every temporary memory copy is erased.

Password-manager apps and clipboard entries marked as concealed or transient are excluded from new clipboard history. You can add app exclusions, including whole browsers. Clipboard origin cannot reliably identify every password or browser extension; review your exclusions and clear old history when needed. Ordinary text history uses seven-day retention, with separate limits for images and pinned entries.

Encrypted backups use a passphrase you choose. Keep a verified backup and its passphrase separately: we cannot recover a lost local encryption key or forgotten backup passphrase. Deleting the app bundle does not automatically remove your library or Keychain items.

2. Optional processing outside your Mac

Your AI provider

AI commands, chat, capture summaries and transcript cleanup use your configured provider or local model. A request can include selected text, prompt instructions and relevant passages from your captures. Requests made with your own API key go directly to that provider, which processes them under its terms. Slash-hosted AI and Cloud dictation start unavailable to public beta accounts; if enabled for your account and selected, they send the required text or audio through Slash's hosted service to its provider. Local transcription engines keep audio on this Mac; AI cleanup can separately send transcript text to your configured provider. Automatic capture summaries require separate local opt-in.

Links and GIFs

Link previews contact linked websites to retrieve page metadata. GIF search sends your query to Giphy and downloads selected images. These services receive ordinary request metadata, such as an IP address. Temporary files created for Open, drag, Copy or Quick Look are an intentional handoff to other apps and are not encrypted while those apps use them.

Agents and connected devices

Local and remote agents, Chrome capture, and sync with Android start unavailable to public beta accounts. If agent access becomes available, connecting still requires your approval and any applicable folder or selected-context grants. The agent or its AI service may transmit content under its own settings and terms. Review and revoke agents in Settings.

If sync becomes available and you use it, supported records and deletions replicate through Slash's hosted service. Sync uses a server-managed encryption key and is not end-to-end encryption or a point-in-time backup. Turning a feature off pauses new work and preserves retained content, keys and pending changes. Keep a passphrase-encrypted local archive for independent recovery.

3. Usage analytics, diagnostics and feedback

Optional app usage counts

When enabled, Slash sends a closed set of feature events to PostHog in the United States to measure feature use, successful workflows, failures, coarse latency and returning installations. Events use a random installation identifier, app version/build and major macOS version. They exclude notes, clipboard contents, selections, command names, triggers and bodies, prompts, AI output, dictation audio and transcripts, filenames, paths, app names, email addresses, account identity and API keys. We do not use these events for advertising or join them to your account.

On new US installations, the signup notice offers usage sharing on by default and lets you turn it off before collection begins. Outside the US it starts off and requires your choice to enable it. Existing installations keep their choice; an update does not silently enable sharing for an installation that never enabled it. You can change sharing in Settings at any time. Importing a Slash workspace backup or syncing Slash settings cannot enable it.

Collection requires a build with verified provider configuration. Turning sharing off stops future events, cancels pending sends and deletes the local analytics identifier. Enabling it again creates a fresh identifier. It does not automatically delete events already received. Services necessarily receive network information during transport; our PostHog project is configured to discard IP addresses from stored events and not create person profiles. Local expansion counts and recent dictation timings stay on your Mac unless you choose to include diagnostics in feedback.

Crash reports and diagnostics

Automatic crash reporting is disabled in the public beta. You can copy a redacted diagnostics report locally or choose to attach diagnostics to feedback.

Support and feedback

Email support@slashcommand.app, or use the in-app feedback form. Nothing is sent until you press Send. The form shows your message and optional email, screenshot and diagnostics attachment for you to review or remove. Diagnostics may list command triggers and titles, but exclude command bodies, notes and clipboard history. Feedback is delivered through Resend to our support inbox. Only send content you want support to receive.

4. Website, downloads and updates

This staged website does not initialize PostHog tracking. Hosting and download providers may receive normal request information, including IP address and user agent, to serve the site and files. GitHub serves release downloads and updates. If you join the beta waitlist, we store your email and signup time in private Vercel Blob storage to manage invitations and related release communications. New records exclude IP addresses, browser information and referring pages. An optional Telegram notification says someone joined without including their email. Hosting providers may separately process ordinary request and security metadata. To leave the list or request deletion, email support@slashcommand.app. Waitlist signup is separate from app analytics.

5. Accounts and payments

The public beta is free during beta and requires email verification through Supabase Auth. Supabase processes your email, authentication/session data and ordinary network metadata. Slash stores account identifiers, feature audience and access rules, and any applicable entitlement records to operate and secure the service. Session credentials are kept in macOS Keychain. Account activation alone does not upload your library or enroll you in a subscription.

We count verified Public beta registrations separately from Internal and test accounts. This registration count does not measure active use or grant analytics consent. Feature availability can vary by account and changes as testing progresses. Paid services, if offered to your account, require a separate purchase; existing billing management remains available. Contact support about account access or deletion; signing out does not delete your account or local library.

Operational records are separate from optional product analytics. Hosted services keep account-linked request counts, action types, model names, token counts and applicable entitlement records to provide service, enforce limits, maintain security and reconcile billing. These usage records exclude prompts, responses and transcripts. Aggregate billing and feedback outcome counters do not include account identifiers. Turning off product analytics does not disable operational records.

6. System permissions

To detect your trigger and insert text in other apps, macOS requires you to grant Accessibility (and possibly Input Monitoring) permission. The app uses these permissions locally on your Mac to watch for your configured trigger and perform the expansion. This activity does not leave your device and is not transmitted to us.

7. Service providers

We rely on a small set of third parties to operate the Service. Each processes only what's described above:

• Vercel — website hosting and private waitlist storage
• Telegram — optional waitlist notifications without signup email addresses
• GitHub — distribution of app downloads and updates
• Supabase — verified accounts, session authentication, feature access and eligible hosted services
• Stripe — checkout and billing management when separately used
• PostHog — optional, content-free app usage analytics in the US and aggregate service outcome counters
• Resend — delivery of the feedback you send from inside the app
• AI providers, linked websites and Giphy — requests described in Section 2

8. Data retention

Your library remains on your Mac until you delete it through the app or remove its stored data. Encrypted backups remain wherever you save them. Support correspondence is kept for up to 24 months unless law requires longer. Account, waitlist, operational and security records are retained while reasonably needed for the stated purposes, subject to legal obligations and unresolved disputes or abuse investigations. Waitlist records can be removed on request. PostHog currently provides a one-year event query window on its free plan; a query window is not a guarantee of permanent deletion. We review retained analytics and deletion requests separately from that window. Turning analytics off is not a request to erase events already received by the provider; contact support about stored analytics data. These events are linked to an installation rather than an account; you may need to provide its analytics identifier to locate them. Copy that identifier in Settings before turning sharing off. We may be unable to identify earlier events without it.

9. Security

We use technical and organizational measures to protect information. The public beta stores library data encrypted locally; permitted external processing and plaintext handoffs are described above. No method of storage or transmission is completely secure. Report a suspected security problem to support@slashcommand.app. If a breach affects personal information, we will notify you and regulators as required by law.

10. Cookies & tracking

We do not use advertising or cross-site tracking cookies, and this staged website does not initialize product analytics. We do not track you across other websites or services. Where required, we honor browser privacy signals such as Global Privacy Control (GPC).

11. International data transfers

We are based in the United States, and our service providers (including Vercel, GitHub, Supabase, Stripe, PostHog, Resend, and AI providers) may process data in the United States and other countries. If you access the Service from outside the U.S., your information may be transferred to and processed in the U.S. Where required for transfers of personal data from the EEA, UK, or Switzerland, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses.

12. Your privacy rights

You control your local library directly — you can view, edit, export, or delete it in the app at any time. For information we do hold (such as support correspondence), you can contact us at support@slashcommand.app to exercise your rights.

We do not sell or share your personal information (including for cross-context behavioral advertising), and we have not done so.

Depending on where you live, you may have rights to access, correct, delete, restrict, or object to processing of your personal data, to data portability, and to withdraw consent. Our legal bases for processing (for users in the EEA/UK) are our legitimate interests in operating and securing the Service, performance of a contract for support, and your consent where you enable optional analytics or features. You also have the right to lodge a complaint with your local data-protection authority. We will not discriminate against you for exercising these rights.

13. Children

Slash is intended for people who are at least 18 and have legal capacity to accept the Terms where they live. We do not knowingly collect personal information from anyone under 18. If you believe someone under 18 has provided personal information to us, contact support so we can investigate and take appropriate action.

14. Changes to this policy

We may update this policy as the Service evolves, including changes to available hosted or paid services. We'll revise the "Last updated" date above and, for material changes, provide a more prominent notice.

15. Contact

Questions about privacy, or want to exercise a right? Email support@slashcommand.app. Choop Labs LLC is a Delaware limited liability company, United States.