Calíope

1. Overview

Calíope ("the App") is a native client for MariaDB, MySQL, Amazon Aurora, PostgreSQL and SQL Server, with editors for local SQLite and DuckDB files and a set of MongoDB tools, developed by David Villalobos Cambronero ("I", "me"). This Privacy Policy explains what information the App accesses, how it is handled, and your rights as a user. Calíope is a single app across every screen it runs on — Mac, iPad, iPhone, Apple Watch, Apple TV and Apple Vision Pro — installed from one App Store page, and this policy covers all of them.

2. No Servers, No Accounts

Calíope has no backend. There is no server of mine and no user account: nothing to sign up for, nothing to log in to. Your database passwords are stored in your device's Keychain, through the Apple Security Framework, and stay on that device. If you turn on iCloud Keychain sync, that is an explicit choice you make in Calíope's preferences, and the sync is handled by Apple's system; I never see the credentials. A single button, Delete All My Data (Preferences › General), deletes what Calíope stores in all six places, on this device and in iCloud; section 13 lists them. The app runs inside the App Store sandbox. Put plainly: Calíope has nowhere to send your credentials, because there is no infrastructure of mine to send them to.

3. Information Stored Locally on Your Device

The App stores the following data exclusively on your device:

• Database credentials and connection profiles: Server hostnames, ports, usernames, and passwords are stored in your device's secure system Keychain (via the Apple Security Framework). Passwords are never stored in plain text and are never transmitted to the developer. By default, Keychain entries remain on the device — iCloud Keychain sync is an explicit opt-in.
• SQL query history: A log of executed queries is saved locally in a private SQLite database on your device. This data never leaves your machine unless you explicitly enable iCloud sync.
• App preferences: Settings such as visual themes, editor configurations, and backup schedules are stored locally in UserDefaults.
• Scheduled backups: SQL backup files are written directly to a directory you explicitly choose on your local file system. No backup content is sent to me.
• Usage report (off by default): If you switch it on in Preferences › General › Privacy and Diagnostics, Calíope keeps a readable JSON file on your device with counters of the tools you open, the errors that occurred grouped with their count, and the app version, platform, operating system and device model. It holds no query text, no passwords and no connection details. It is never sent anywhere on its own: it reaches me only if you email it to me. While the switch is off, nothing is written to it.
• Application error log (on by default): Calíope records the failures of the app itself in a private SQLite database on your device, kept for 90 days unless you change that, so you can read them in Preferences. Copying it to your own iCloud is a separate switch that is off by default; while it is off, the log does not leave the device.

4. iCloud Synchronization (Optional)

If you enable iCloud synchronization, the App uses the Calíope container in your iCloud Drive, the iCloud Key-Value Store and the CloudKit private database to sync certain data (connection profiles, snippets, scheduled backups, optionally query log) across your devices signed into the same Apple ID.

Database passwords are never included in iCloud sync by default. If you choose to enable iCloud Keychain sync, that operation is governed by Apple's secure system and I never see those credentials. All iCloud storage and syncing operations are subject to Apple's Privacy Policy.

5. AI Assistant Feature (Optional)

Calíope includes an optional AI assistant. It can run entirely on your device (Apple Intelligence) or on a machine you control (Ollama), in which case nothing goes beyond the machine you point it at — by default, your own; or it can use a cloud provider (OpenAI, Google Gemini, Anthropic Claude) with your own API key, in which case what you send is governed by that provider's policy. When you choose to utilize this feature:

• With Apple Intelligence, nothing leaves the device; with Ollama, nothing goes beyond the machine you point it at. With OpenAI, Gemini or Claude, the schema of the active database — table names, columns and foreign keys — does travel to that provider, under your own key. Rows and credentials never do.
• The SQL text or natural-language prompt you submit is sent directly to OpenAI (Privacy Policy), Google Gemini (Privacy Policy) or Anthropic Claude (Privacy Policy), depending on which provider you have configured.
• The App does not transmit actual database rows, table contents, or connection credentials to these services — only the text you type and the schema metadata (table names, column names, foreign keys) of the active database.
• You are solely responsible for ensuring that any text or metadata sent to third-party AI services complies with your organization's data-handling policies.
• The assistant works from the first launch, on the device. Where the system offers Apple Intelligence, that is the provider out of the box, and nothing leaves the device. Nothing goes to a cloud provider until you choose one and paste your own API key. The schema can be kept back with the switch “Send schema to the model”.
• With Apple Intelligence, nothing leaves the device. With Ollama, what is sent — your question and, if you leave the schema switch on, the table, column and foreign-key names — reaches only that address and no further.
• Dictation stays on your device. The voice input of the assistant is recognised on the device only (SpeechAnalyzer): the audio is never sent to Apple's servers or to me, and no recording is stored. If the dictation model for your language is not installed, Calíope declines and tells you, rather than transcribing over the network.

6. MCP server (optional, macOS only)

Calíope can let an AI client running on your own Mac — Claude Desktop, Cursor, anything that speaks MCP — query the connections you tick. It is off by default.

• The server listens on 127.0.0.1 only, requires an access key kept in your Mac's Keychain, and runs only while Calíope is open. Nothing is exposed to your network or to the internet.
• It accepts read-only statements, one per call, over the connections you tick — nothing else is even listed — and answers are capped at 200 rows.
• Rows do travel here. The answer to a query is the data, and it goes to the client you configured, on that same machine. What that client then does with it — sending it to its own cloud model, for instance — is governed by that client and its privacy policy, not by Calíope.
• Everything executed over MCP is written to the local query log, with its connection and result. What is rejected never reaches the server.

7. Calíope on your iPhone

On the iPhone, Calíope is the whole client, laid out for the phone: it connects to your servers and runs your queries, and what you keep in Calíope on the Mac and the iPad — connection profiles, SQL snippets, query history, AI Assistant conversations and the application error log — is already there, carried over by your own iCloud.

• It connects to your servers, and only to them. Calíope on the phone opens connections to the MySQL, MariaDB, PostgreSQL, SQL Server or MongoDB servers you configure, directly or through your own SSH tunnel, exactly as on the Mac and the iPad. Your data and your query results are handled on the device and are never sent to me.
• Passwords stay in the Keychain of the device that holds them. A connection profile synced through iCloud carries only engine, host, port, username and default database — never the password. If you turn on iCloud Keychain sync, that operation is governed by Apple's secure system and I never see those credentials. The same applies to AI provider API keys.
• The transport is your own iCloud. The phone reads and writes the Calíope container in iCloud Drive and the iCloud key-value store, under your own Apple Account. Nothing passes through any server operated by me, because I do not operate one.
• No account and no analytics. There is no sign-up and no login, no analytics SDK and no third-party tracking.
• Optional Face ID. If you enable the biometric lock, it is used only to unlock the app on the device. No biometric data is accessible to me or transmitted anywhere.
• Demo Mode stores nothing. The sample data it shows is held in memory only and is never written to the device or uploaded.
• Erasure. Preferences includes an option that removes what the app keeps, both on the phone and in iCloud, and reports what was actually removed.

8. Calíope on Apple TV and Apple Watch

On Apple TV and on Apple Watch, Calíope shows on a bigger or a smaller screen what it already knows: the television shows the health of the servers Calíope watches for you, and the watch shows the messages Calíope publishes for you. Neither is a separate app — both arrive with Calíope, from the same App Store page.

• They only read. Both read from the private CloudKit database of your own Apple Account, in the container iCloud.org.caliope.caliope. Neither creates, modifies nor deletes anything in it.
• They connect to no database. Neither opens a connection to MySQL, MariaDB, PostgreSQL or any other server, and neither runs a query.
• They never see a password. Credentials stay in the Keychain of the Mac, iPad or iPhone that owns them and are not part of what is published.
• They send me nothing. Neither makes a network request outside Apple's CloudKit. I operate no server and receive no data from your Apple TV or your Apple Watch.
• No account, no analytics, no tracking. Neither has sign-up or login, an analytics or advertising SDK, or third-party tracking of any kind.
• What stays on the device. Only preferences: on the Apple TV, the interface language, whether Demo Mode is on and whether the screen is kept awake; on the Apple Watch, those plus the notification settings you choose (whether to be alerted, how often to check, from which severity, and which groups to show). Nothing that identifies you.
• Notifications on the watch are local. They are scheduled on the watch itself, from what it has already read. There is no push server, and asking to be alerted is a separate consent from asking to read.
• Demo Mode stores nothing. The sample servers and messages it shows are held in memory only.

9. Data I Do Not Collect

Calíope does not:

• Collect, track, or aggregate analytics, telemetry, or user behavior on any server of mine.
• Transmit your database contents, schemas, or query results to any server of mine.
• Use tracking frameworks, advertising identifiers, or share data with advertisers.
• Create user accounts or require you to register.

10. Children's Privacy

Calíope is a professional database tool not directed at children under 13 (or the applicable age in your jurisdiction). I do not knowingly collect or request any information from minors.

11. Data Security

All sensitive credentials are stored in the operating system Keychain, protected by your device's native authentication mechanisms (such as biometric Face ID, Touch ID, or device passcode). Network connections to your database servers use the credentials you provide; Calíope supports native SSL/TLS with strict certificate verification by default, and SSH tunneling (SwiftNIO with ed25519 and ECDSA keys) to help you secure those connections.

12. Third-Party Services Summary

13. Your Rights

Because I do not collect personal data on any server of mine, there is no centralized data to request, correct, or delete. The Delete All My Data button inside Calíope (Preferences › General) deletes what Calíope stores in all six places: on this device (connection profiles, query history, error log, AI Assistant history, telemetry, schema cache, recent SQL files, snippets and monitor entries), in the Keychain (passwords, SSH passphrases and API keys), in iCloud Drive, in the iCloud key-value store, in CloudKit records and in the widget's data. It reaches every device, saves a local restore point without passwords first, and reports what was deleted in each place. Deleting the App also removes what it keeps on that device. If you have questions about data stored in iCloud, Apple's iCloud settings allow you to manage and delete that data.

14. Changes to This Policy

I may update this Privacy Policy from time to time. The updated version will be posted at this URL with a revised "Last updated" date. Continued use of the App after changes constitutes your acceptance of the updated policy.

15. This Website

caliope.org sets no cookies and runs no analytics and no trackers. It is served through Amazon CloudFront with access logging turned off, so I keep no record of your visits. Two small preferences stay in your browser's local storage and never leave it: the language you chose, and whether you ticked I have Calíope installed in the Help. The demo video on the home page is embedded from youtube-nocookie.com and loads only when you press play; from then on YouTube's privacy policy applies.

16. Contact

If you have any questions or concerns about this Privacy Policy, please contact me at:
support@caliope.org