← Subtext

How data moves

Last updated July 16, 2026. This is a technical disclosure of the current app, written to be readable rather than clever.

Short version: statistics, trends, and Wrapped cards are computed on your Mac. Message text is sent only after an AI consent screen states the scope and you continue. First-party product activity measures funnel steps and AI cost—not conversations.

Local analysis

Subtext reads a protected temporary copy of your local Messages database. It computes counts, reply timing, initiation, writing style, people, groups, and cards locally. Temporary database copies are permission-restricted and removed after each read. The original database is never modified. Attachments and images are not uploaded.

AI features

Coach and Deep Dive show a consent sheet before message text is sent. A person-scoped Coach starts with the disclosed recent messages for that person; older or broader excerpts travel only when a local tool returns them for the consented question. An optional archetype remix sends derived numbers only—no names, handles, or message bodies.

Requests pass through the Subtext Cloudflare Worker to Anthropic. The relay does not store or log prompt or response bodies. Salted rate-limit counters are cleared after 72 hours.

Account and product activity

The first-run flow asks for a name, email, age range, and the kinds of relationships where you want to communicate better. Cloudflare KV stores that account profile under a salted product-install hash. Cloudflare Analytics Engine receives those fixed-choice onboarding categories, allowlisted onboarding and sharing steps, plus per-feature AI model, app/OS version, exact provider-reported input, output, and cache token totals, request size, latency, and status.

Analytics does not receive prompts, AI answers, message text, contact names, attachments, name, email, a raw device ID, or a raw IP address. Name and email are stored only in the separate account profile; Analytics receives only the fixed-choice age range and communication-goal categories.

Stored on your Mac

Coach conversations, Coach memory, and Deep Dives are encrypted with a device-only key in your login Keychain. Recomputable statistics and resolved display names are held in a local cache. Settings can clear AI history or delete all Subtext data and its encryption key.

Other network activity

The app checks version.json for updates. The website waitlist stores only the email address you submit and its signup time. There is no third-party analytics SDK, advertising tracker, or crash reporter in the app.

Your controls

Decline an AI consent sheet and no request is made.
Revoke Coach message access in Settings.
Inspect and delete individual Coach memories.
Clear AI history or delete all stored Subtext data.

Cloudflare retains Analytics Engine metric rows for three months. Those aggregate rows cannot be selectively deleted; after the account is deleted and its product ID rotates, they no longer map to the deleted profile. The relay's independent abuse-limit ID is not reset by this control.