Privacy policy
Last updated 16 September 2026.
CySec has no account and no sign-in, and we never ask for your email address. There are no analytics and no trackers, in the app or on this website. What you run, what you wrote about it and what you decided stay on your phone. If you turn on notifications, our server holds a random device identifier, a push token, your source and notification preferences, and — only if you leave environment sync on — the names of the products you run, so it knows which alerts to send you. Never versions, never your components, never your notes. We do not sell, rent or share any of it.
No account, no sign-in
There is nothing to create and nothing to log into. We do not collect your name, your email address, or any other way of identifying you as a person.
What the phone sends to our server, and when
The app talks to exactly one server: ours, hosted on Cloudflare in the United States. It sends the following, and only the following.
| What | Why |
|---|---|
| A random device identifier the app makes up | So the server can tell one device from another. It is not your Apple ID, your phone number, or any identifier Apple assigns. |
| A push-notification token | So alerts can be delivered to your phone and watch. |
| Which sources you have turned on | So you are not sent alerts from sources you switched off. |
| Your notification preferences | So you get what you asked for and not more. |
| The names of the products in your environment — only if environment sync is on | So the server can work out which alerts apply to you and push them. |
Environment sync is something you control and can turn off. What it sends is product names and nothing more. It never sends version numbers, never your list of software components, never your notes, and never anything you typed about your systems.
With environment sync off, your phone does all the matching itself, and the server knows nothing at all about what you run.
What stays on your phone
Your environment, your notes, your triage decisions and your conversation history with the assistant live only on your phone — and, for the parts the Watch shows, on your paired Apple Watch. They are not copied to us.
The optional Claude assistant
Ask CySec runs on your phone using Apple Intelligence. Nothing leaves the device for it to work.
You may optionally connect your own Claude account by entering your own Anthropic API key, for longer answers. If you do, then — and only then — the text you approve is sent to Anthropic, under your own Anthropic account and its terms. The app shows you exactly what it would send before it sends anything. This feature is off by default, and turning it off stops it.
Who else can see any of this
Three companies are involved, and no others. We only work with providers that are required to protect this information to the same standard we do, and none of them may use it for their own purposes.
| Who | What they handle | When |
|---|---|---|
| Apple | Delivers push notifications, takes payment for the subscription, and provides App Attest so our server can tell it is talking to a genuine copy of CySec. We never see your payment details, and App Attest sends Apple nothing personal about you. | Always, while notifications are on |
| Cloudflare | Hosts our server and this website, in the United States. That means the device record described above sits on Cloudflare's infrastructure. Cloudflare acts on our instructions as our hosting provider and does not use it for anything of its own. | Always, while notifications are on |
| Anthropic | Answers Ask CySec questions only if you turn on the Claude option and enter your own API key — under your own Anthropic account and its terms, and only the text you approve in the preview. | Only if you turn it on. Off by default |
No advertising, no sale of data
We do not sell, rent or share any of this with anyone. None of it is used for advertising or profiling, and none of it is passed to a data broker. We would disclose it only if the law required us to.
There are no analytics, no advertising identifiers and no trackers in the app. This website sets no cookies and has none of those either: it loads no external fonts, no external scripts and no third-party resources of any kind, so there is nothing here to consent to.
How long we keep it, and how it is deleted
- The device record is kept until the app is deleted or you turn notifications off.
- The server keeps logs of its own runs for a short period, for reliability.
- The server keeps a record of which alerts were sent to which device, so the same alert is not sent to you twice.
Deleting the app deletes everything held on the phone. Unregistering from our server happens automatically when you turn notifications off or remove the app. If you would rather ask us directly, email support@grcsac.com and we will delete the device record.
Children
CySec is not directed at children under 13, and we do not knowingly collect information from them.
Changes to this policy
If this policy changes we will update this page and change the date at the top. Material changes will also be noted in the app.
Contact
Questions about this policy, or about anything we hold: support@grcsac.com. We reply within two business days.