4DA Systems Pty Ltd · Effective Date: 15 March 2026 · Last Updated: 15 March 2026
This Privacy Policy describes how 4DA Systems Pty Ltd (ACN 696 078 841, ABN 51 696 078 841; "we", "us", "our") handles information in connection with:
These three products have fundamentally different privacy characteristics, and this policy addresses each separately. The App is local-first software with no server-side data collection. The Website and Store are standard web properties with typical web privacy considerations.
Our registered business address is in Queensland, Australia. We comply with the Australian Privacy Act 1988 (Cth), the EU General Data Protection Regulation (GDPR), and the California Consumer Privacy Act (CCPA), along with other applicable privacy laws.
For GDPR purposes, 4DA Systems Pty Ltd is the data controller for any personal data processed through the Website and Store. For the App, you are the sole controller of your own data -- we never have access to it.
4DA is designed so that privacy is not a policy choice but a technical fact. The App has no server-side component that collects user data. There is no 4DA cloud service, no user database on our end, and no mechanism for us to receive your data even if we wanted to. Your data lives in a local SQLite database on your machine and nowhere else.
No cloud account is required. No sign-up. No registration. You download the App and use it.
The App processes the following data entirely on your local machine:
None.
We have made a deliberate architectural decision to build zero data collection infrastructure for the App. We cannot collect your data because we have built no mechanism to do so.
4DA operates on a Bring Your Own Key (BYOK) model. You provide your own API keys for any external services you choose to use. We do not supply, manage, or have access to your API keys.
How your API keys are stored:
Your API keys are stored in your operating system's native credential manager -- the most secure local storage available on your platform:
API keys are never stored in plaintext configuration files. If you previously used a version of 4DA that stored keys in the settings file, the App automatically migrates them to the OS keychain and removes them from the plaintext file.
If the OS keychain is unavailable (e.g., headless Linux environments or CI systems), the App falls back to in-memory storage for the duration of the session, and keys are not persisted to disk.
Your API keys are never transmitted to 4DA Systems or any party other than the specific provider you configured.
The App supports integration with large language model (LLM) providers. Here is exactly how this works:
localhost:11434 with zero external API calls. This is a fully offline option. If you point Ollama to a remote instance, data flows to that remote address -- this is your configuration choice.When you use a third-party LLM provider, you are subject to that provider's privacy policy. We encourage you to review:
The App fetches publicly available content from sources you configure:
hacker-news.firebaseio.com. No authentication required.www.reddit.com. No authentication tokens sent.api.github.com. If you configure a GitHub Personal Access Token (PAT) for higher rate limits or private repository access, your PAT is sent to GitHub's API in the request headers. Your PAT is stored in the OS keychain (see Section 2.4) and is never sent to 4DA Systems.export.arxiv.org.All of these requests go directly from your machine to the respective service. Your device's IP address is visible to each service as part of the standard HTTPS connection.
The App can optionally send you a periodic email digest of relevant content. This feature is off by default and requires you to configure your own SMTP server credentials. When enabled:
If you purchase a Signal subscription, the App validates your license key using the Keygen license management service. This is the only external call that 4DA Systems controls. This validation:
The App also supports offline license verification using Ed25519 digital signatures embedded in the license key itself. This verification requires no network access whatsoever.
Keygen may log the IP address of the request as part of standard server operations. See Keygen's Privacy Policy for details.
The free tier of 4DA does not perform any license validation and makes no calls to Keygen.
The App checks for updates using the standard Tauri updater, which queries GitHub Releases. This check:
See GitHub's Privacy Statement for how GitHub handles server logs.
4DA offers a Team Relay feature for teams to sync relevant content metadata across devices. This feature is designed with the same privacy-first principles as the rest of the App:
The 4DA source code is publicly available under the FSL-1.1-Apache-2.0 license. You can audit exactly what the App does, what network requests it makes, and verify that it behaves as described in this policy. We believe source-available code is the strongest privacy guarantee we can offer.
Unlike the App, our website is a standard web property. When you visit 4da.ai:
Our merchandise store is hosted on Shopify. When you make a purchase:
Shopify processes your purchase information including name, email, shipping address, and payment details. This data is handled by Shopify in accordance with their privacy practices. See Shopify's Privacy Policy.
We use information from store purchases solely to:
We do not use purchase data for marketing, profiling, or any purpose unrelated to fulfilling your order unless you explicitly opt in to communications.
To be unambiguous:
| Service | Used By | Data Shared | Purpose |
|---|---|---|---|
| LLM Providers (Anthropic, OpenAI, OpenAI-compatible) | App (BYOK, user-initiated) | Content being analysed + your API key (direct from your machine to provider) | AI-powered content analysis |
| Ollama | App (default) | Nothing (fully local at localhost:11434) | Local AI processing and embeddings |
| Hacker News API | App | Standard HTTP requests (your IP visible) | Content aggregation |
| GitHub API | App | Standard HTTP requests + optional PAT (your IP visible) | Content aggregation, update checks |
| App | Standard HTTP requests (your IP visible) | Content aggregation | |
| arXiv | App | Standard HTTP requests (your IP visible) | Content aggregation |
| RSS/Atom feeds | App | Standard HTTP requests (your IP visible) | Content aggregation |
| Keygen | App (Signal tier only) | License key | License validation |
| User's SMTP provider | App (optional, user-configured) | Digest email contents | Email delivery |
| Vercel | Website | Server logs, analytics | Website hosting |
| Shopify | Store | Purchase and shipping information | Merchandise sales |
All App data resides on your device. You have complete control:
No action from us is required for you to fully erase all traces of the App from your system.
Server logs retained by Vercel are subject to Vercel's data retention policies. We do not independently retain website visitor data.
Purchase records are retained as required by Australian tax law (generally 5 years). You may request deletion of non-legally-required data by contacting privacy@4da.ai.
The 4DA App, Website, and Store are not designed for, marketed to, or intended for use by children under the age of 13 (or under 16 in jurisdictions where GDPR applies). We do not knowingly collect personal information from children.
If you believe a child has provided us with personal information (e.g., via email or the Store), please contact us at privacy@4da.ai and we will promptly delete it.
Because the App collects no personal data, most privacy rights are automatically satisfied for App usage. For data held in connection with the Website or Store, the following rights apply:
Under the Australian Privacy Principles (APPs), you have the right to:
Small business exemption: Under the Australian Privacy Act 1988, businesses with annual turnover under AUD 3 million are generally exempt from the APPs. While this exemption may currently apply to 4DA Systems, we voluntarily comply with the APPs because privacy is foundational to our product. We commit to maintaining this standard regardless of whether the Act legally requires it.
To make a request, contact privacy@4da.ai. We will respond within 30 days.
If you are in the EEA, UK, or Switzerland, you have the right to:
Legal basis for processing: Where we process personal data (Website analytics, Store transactions), our legal bases are:
Note on the App: For the App, GDPR obligations are inherently satisfied because we process no personal data. All data processing occurs locally on your device under your sole control.
To exercise your rights, contact privacy@4da.ai. We will respond within 30 days (extendable by 60 days for complex requests, with prior notice).
If you are a California resident, you have the right to:
Categories of personal information collected in the past 12 months:
| Category | Collected? | Source | Purpose |
|---|---|---|---|
| Identifiers (name, email, address) | Only via Store purchases | You (directly) | Order fulfilment |
| Internet activity (browsing, search) | Aggregate analytics only (Website) | Automatic | Website improvement |
| Commercial information (purchase history) | Only via Store | You (directly) | Order fulfilment, legal compliance |
We do not collect biometric data, geolocation data, professional or employment information, education information, or inferences drawn about you from any of the above.
To make a CCPA request, contact privacy@4da.ai or write to us at the address in Section 14. We will verify your identity and respond within 45 days.
The App does not transfer your data internationally -- or at all -- because your data stays on your device. When you choose to use LLM provider APIs, data flows directly from your device to the provider's servers. The location of those servers depends on the provider you choose:
These transfers are initiated by you, using your own API keys, and are governed by the respective provider's privacy policy. 4DA Systems has no role in these transfers.
Our website is hosted on Vercel, which operates globally. Shopify also operates globally. Data processed by these services may be transferred to and stored in countries outside your jurisdiction, including the United States. These providers maintain appropriate safeguards for international transfers, including Standard Contractual Clauses where required by GDPR.
The App's security model is straightforward: your data is on your device, protected by your operating system's security controls.
API key protection: API keys are stored in your operating system's native credential manager (Windows Credential Manager, macOS Keychain, or Linux Secret Service), which provides hardware-backed or OS-level encryption depending on your platform. Keys are never written to plaintext files.
Team Relay encryption: The Team Relay feature uses XChaCha20Poly1305 authenticated encryption with X25519 key exchange and HKDF key derivation (SHA-256). Private keys are zeroized from memory when no longer needed. This ensures that data in transit and at rest on the relay server is cryptographically protected against unauthorised access, including by 4DA Systems.
Recommendations:
We rely on industry-standard security measures provided by Vercel and Shopify, including TLS encryption for all data in transit and secure payment processing (Shopify is PCI-DSS compliant).
We may update this Privacy Policy from time to time. When we make changes:
We encourage you to review this policy periodically. Your continued use of the App, Website, or Store after changes are posted constitutes acceptance of the updated policy.
This Privacy Policy is governed by and construed in accordance with the laws of Queensland, Australia, without regard to conflict of law principles. Any disputes arising under this policy shall be subject to the exclusive jurisdiction of the courts of Queensland, Australia.
If you have questions about this Privacy Policy, want to exercise your privacy rights, or have a concern:
Email (preferred):
Entity:
4DA Systems Pty Ltd
ACN 696 078 841 | ABN 51 696 078 841
Queensland, Australia
Response times:
Complaints:
If you are unsatisfied with our response, you may lodge a complaint with:
| Question | App | Website | Store |
|---|---|---|---|
| Do we collect personal data? | No | Minimal (server logs) | Yes (for orders) |
| Do we store data on our servers? | No | Vercel handles logs | Shopify handles data |
| Do we sell data? | No | No | No |
| Do we use cookies? | N/A (desktop app) | Essential only | Shopify standard |
| Do we track you? | No | No | No |
| Can you delete your data? | Yes (it is on your device) | Contact us | Contact us |
| Do we require an account? | No | No | For purchases (via Shopify) |
| Do we use advertising? | No | No | No |
| Where are API keys stored? | OS keychain (your device) | N/A | N/A |
| Can we read your content? | No | N/A | N/A |
This Privacy Policy is written in plain language because we believe privacy policies should be understood, not endured. If anything is unclear, contact us -- we are happy to explain.