Security and IT

This page is for the people who approve software at work. It says where the text people rewrite goes, how long it exists, what Polido keeps, which permissions it asks for, and what an admin can set up before it reaches a laptop. The full detail is in the privacy policy.

In short

• Rewriting happens on a server, not on the laptop. The text being rewritten leaves the computer when someone double-taps the key, and only then.
• It goes to our service and from there to Anthropic's API (Claude). We do not store the text or the rewrite: it exists on our service only for the time it takes to answer.
• Anthropic processes it under its commercial terms, which do not allow it to train models on this data. How long Anthropic keeps API requests is set by its own policy.
• Nothing anyone writes is kept for training unless that person switches it on. It is off by default.
• On a Mac, Polido needs one permission: Accessibility. It needs no admin rights and no Full Disk Access.

What is sent, and when

Nothing is sent while someone types. When they double-tap the hotkey (right ⌘ on a Mac, right Ctrl on Windows), the app sends:

• the text in the field they are writing in;
• where it helps the rewrite, the conversation visible around that field, for example the message being replied to;
• the app's name (and for a browser, the website's name), so a Slack message is rewritten as a message and an AI prompt as a prompt;
• their own writing rules and writing profile, if they have any.

A screenshot of the window is sent only if the person has switched on reading attachments and granted Screen Recording. That is off by default and is used only for AI prompts.

Where it goes

• Our service, at api.polido.app, runs on Cloudflare. Requests are encrypted in transit (TLS). The text is held in memory while the rewrite is made, then gone.
• Anthropic writes the rewrite with its Claude models, through its commercial API.
• Nothing else sees the text. Ad and analytics scripts run only on the website, never in the app, and never see anything typed in it.

What Polido keeps

Counts and settings, never text, unless the person opts in to sharing it:

• rewrites used each month, and the plan;
• counts of rewrites per day and per app, and words in and out. Numbers only;
• the person's own writing rules, as they wrote them;
• their writing profile, if learning is on: a description of how they write (vocabulary, sentence length, spelling), never their drafts;
• for an account: the email address, a name if given, and which computers are signed in.

Each person can read and delete their writing profile in the app. Deleting an account deletes its counts, rules and profile with it: write to hello@polido.app.

Permissions on a Mac

• Accessibility (required). To notice the double-tap, and to read and replace the text in the field being written in. Without it Polido does nothing.
• Screen Recording (optional, off by default). Only for reading attachments into an AI prompt.

Polido does not need Input Monitoring, Full Disk Access, admin rights or a kernel extension. It is signed with a Developer ID and notarised by Apple, and updates itself with signed updates.

Deploying with MDM

Accessibility can be approved ahead of time with a Privacy Preferences Policy Control (PPPC) profile, so people never see the prompt. Allow the Accessibility service for:

• Identifier: io.voltgames.asktwice (type: bundle ID)
• Team ID: KNSCM8LA7X
• Code requirement: identifier "io.voltgames.asktwice" and anchor apple generic and certificate 1[field.1.2.840.113635.100.6.2.6] /* exists */ and certificate leaf[field.1.2.840.113635.100.6.1.13] /* exists */ and certificate leaf[subject.OU] = KNSCM8LA7X

Apple does not let a profile grant Screen Recording; it can only let a standard user approve it, or block it. Blocking it leaves everything except attachment reading working.

On Windows, the app is signed by Volt Games, Lda. through Microsoft’s Trusted Signing.

Rolling it out to a team

• On a Teams plan, the owner invites people by email from the Team page. Each person installs Polido and signs in with that address, by an emailed code or Google.
• The team shares one pool of rewrites. The owner can give anyone a monthly cap, and can set the team's shared writing style and rules.
• Not yet available: single sign-on (SAML or SCIM), a ready-made profile file, and licences that activate without each person signing in. If any of these decides whether you can use Polido, write to us: it tells us what to build next.

Who processes data for us

• Anthropic: writes the rewrites.
• Cloudflare: runs our service and its database.
• Stripe: payments.
• Resend: sends emails (sign-in codes, receipts).
• Google: only if someone chooses to sign in with Google.

Questions for a security review

Polido is made by Volt Games, Lda., in Portugal. Send questionnaires and anything this page does not answer to hello@polido.app.