Calíope

1. Overview

Calíope ("the App", "we", "our") is a native MariaDB, MySQL and PostgreSQL client developed by David Villalobos Cambronero. This Privacy Policy explains what information the App accesses, how it is handled, and your rights as a user. Calíope is a single app across every screen it runs on — Mac, iPad, iPhone, Apple Watch, Apple TV and Apple Vision Pro — installed from one App Store page, and this policy covers all of them.

2. No Servers, No Accounts

Calíope has no backend. There is no server of ours and no user account: nothing to sign up for, nothing to log in to. Your database passwords are stored in your device's Keychain, through the Apple Security Framework, and stay on that device. If you turn on iCloud Keychain sync, that is an explicit choice you make in Calíope's preferences, and the sync is handled by Apple's system; we never see the credentials. A single button, Delete All My Data (Preferences › General), deletes connection profiles, Keychain passwords, query history, AI Assistant history, the error log and the schema cache, on this device and in iCloud. The app runs inside the App Store sandbox. Put plainly: Calíope has nowhere to send your credentials, because there is no infrastructure of ours to send them to.

3. Information Stored Locally on Your Device

The App stores the following data exclusively on your device:

• Database credentials and connection profiles: Server hostnames, ports, usernames, and passwords are stored in your device's secure system Keychain (via the Apple Security Framework). Passwords are never stored in plain text and are never transmitted to the developer. By default, Keychain entries remain on the device — iCloud Keychain sync is an explicit opt-in.
• SQL query history: A log of executed queries is saved locally in a private SQLite database on your device. This data never leaves your machine unless you explicitly enable iCloud sync.
• App preferences: Settings such as visual themes, editor configurations, and backup schedules are stored locally in UserDefaults.
• Scheduled backups: SQL backup files are written directly to a directory you explicitly choose on your local file system. No backup content is sent to our servers.
• Usage report (off by default): If you switch it on in Preferences › General › Privacy and Diagnostics, Calíope keeps a readable JSON file on your device with counters of the tools you open, the errors that occurred grouped with their count, and the app version, platform, operating system and device model. It holds no query text, no passwords and no connection details. It is never sent anywhere on its own: it reaches us only if you email it to us. While the switch is off, nothing is written to it.
• Application error log (on by default): Calíope records the failures of the app itself in a private SQLite database on your device, kept for 90 days unless you change that, so you can read them in Preferences. Copying it to your own iCloud is a separate switch that is off by default; while it is off, the log does not leave the device.

4. iCloud Synchronization (Optional)

If you enable iCloud synchronization, the App uses iCloud Key-Value Store and CloudKit private database to sync certain data (connection profiles, snippets, scheduled backups, optionally query log) across your devices signed into the same Apple ID.

Database passwords are never included in iCloud sync by default. If you choose to enable iCloud Keychain sync, that operation is governed by Apple's secure system and we never see those credentials. All iCloud storage and syncing operations are subject to Apple's Privacy Policy.

5. AI Assistant Feature (Optional)

Calíope includes an optional AI assistant powered by third-party APIs. When you choose to utilize this feature:

• With Apple Intelligence and Ollama, nothing leaves your machine. With OpenAI, Gemini or Claude, the schema of the active database — table names, columns and foreign keys — does travel to that provider, under your own key. Rows and credentials never do.
• The SQL text or natural-language prompt you submit is sent directly to OpenAI (Privacy Policy), Google Gemini (Privacy Policy) or Anthropic Claude (Privacy Policy), depending on which provider you have configured.
• We do not transmit actual database rows, table contents, or connection credentials to these services — only the text you type and the schema metadata (table names, column names, foreign keys) of the active database.
• You are solely responsible for ensuring that any text or metadata sent to third-party AI services complies with your organization's data-handling policies.
• The AI feature is off by default. Apple Intelligence and Ollama need no key: the first runs the system model on your device, and the second talks only to the address you write — your own machine, or one on your network. The cloud providers require your own key.
• With Apple Intelligence, nothing leaves the device. With Ollama, what is sent — your question and, if you leave the schema switch on, the table, column and foreign-key names — reaches only that address and no further.
• Dictation stays on your device. The voice input of the assistant is recognised on the device only (SpeechAnalyzer): the audio is never sent to Apple's servers or to ours, and no recording is stored. If the dictation model for your language is not installed, Calíope declines and tells you, rather than transcribing over the network.

6. MCP server (optional, macOS only)

Calíope can let an AI client running on your own Mac — Claude Desktop, Cursor, anything that speaks MCP — query the connections you tick. It is off by default.

• The server listens on 127.0.0.1 only, requires an access key kept in your Mac's Keychain, and runs only while Calíope is open. Nothing is exposed to your network or to the internet.
• It accepts read-only statements, one per call, over the connections you tick — nothing else is even listed — and answers are capped at 200 rows.
• Rows do travel here. The answer to a query is the data, and it goes to the client you configured, on that same machine. What that client then does with it — sending it to its own cloud model, for instance — is governed by that client and its privacy policy, not by Calíope.
• Everything executed over MCP is written to the local query log, with its connection and result. What is rejected never reaches the server.

7. Calíope on your iPhone

On the iPhone, Calíope is the whole client, laid out for the phone: it connects to your servers and runs your queries, and what you keep in Calíope on the Mac and the iPad — connection profiles, SQL snippets, query history, AI Assistant conversations and the application error log — is already there, carried over by your own iCloud.

• It connects to your servers, and only to them. Calíope on the phone opens connections to the MySQL, MariaDB, PostgreSQL or MongoDB servers you configure, directly or through your own SSH tunnel, exactly as on the Mac and the iPad. Your data and your query results are handled on the device and are never sent to us.
• Passwords stay in the Keychain of the device that holds them. A connection profile synced through iCloud carries only engine, host, port, username and default database — never the password. If you turn on iCloud Keychain sync, that operation is governed by Apple's secure system and we never see those credentials. The same applies to AI provider API keys.
• The transport is your own iCloud. The phone reads and writes the Calíope container in iCloud Drive and the iCloud key-value store, under your own Apple Account. Nothing passes through any server operated by us, because we do not operate one.
• No account and no analytics. There is no sign-up and no login, no analytics SDK and no third-party tracking.
• Optional Face ID. If you enable the biometric lock, it is used only to unlock the app on the device. No biometric data is accessible to us or transmitted anywhere.
• Demo Mode stores nothing. The sample data it shows is held in memory only and is never written to the device or uploaded.
• Erasure. Preferences includes an option that removes what the app keeps, both on the phone and in iCloud, and reports what was actually removed.

8. Calíope on Apple TV and Apple Watch

On Apple TV and on Apple Watch, Calíope shows on a bigger or a smaller screen what it already knows: the television shows the health of the servers Calíope watches for you, and the watch shows the messages Calíope publishes for you. Neither is a separate app — both arrive with Calíope, from the same App Store page.

• They only read. Both read from the private CloudKit database of your own Apple Account, in the container iCloud.org.caliope.caliope. Neither creates, modifies nor deletes anything in it.
• They connect to no database. Neither opens a connection to MySQL, MariaDB, PostgreSQL or any other server, and neither runs a query.
• They never see a password. Credentials stay in the Keychain of the Mac, iPad or iPhone that owns them and are not part of what is published.
• They send us nothing. Neither makes a network request outside Apple's CloudKit. We operate no server and receive no data from your Apple TV or your Apple Watch.
• No account, no analytics, no tracking. Neither has sign-up or login, an analytics or advertising SDK, or third-party tracking of any kind.
• What stays on the device. Only preferences: on the Apple TV, the interface language, whether Demo Mode is on and whether the screen is kept awake; on the Apple Watch, those plus the notification settings you choose (whether to be alerted, how often to check, from which severity, and which groups to show). Nothing that identifies you.
• Notifications on the watch are local. They are scheduled on the watch itself, from what it has already read. There is no push server, and asking to be alerted is a separate consent from asking to read.
• Demo Mode stores nothing. The sample servers and messages it shows are held in memory only.

9. Data We Do Not Collect

Calíope does not:

• Collect, track, or aggregate analytics, telemetry, or user behavior on our servers.
• Transmit your database contents, schemas, or query results to our servers.
• Use tracking frameworks, advertising identifiers, or share data with advertisers.
• Create user accounts or require you to register.

10. Children's Privacy

Calíope is a professional database tool not directed at children under 13 (or the applicable age in your jurisdiction). We do not knowingly collect or request any information from minors.

11. Data Security

All sensitive credentials are stored in the operating system Keychain, protected by your device's native authentication mechanisms (such as biometric Face ID, Touch ID, or device passcode). Network connections to your database servers use the credentials you provide; Calíope supports native SSL/TLS with strict certificate verification by default, and SSH tunneling (SwiftNIO with ed25519 and ECDSA keys) to help you secure those connections.

12. Third-Party Services Summary

13. Your Rights

Because we do not collect personal data on our servers, there is no centralized data to request, correct, or delete. All locally stored data (query history, preferences, Keychain entries) can be removed by using the Delete All My Data button inside Calíope (Preferences › General) or by deleting the App from your device. If you have questions about data stored in iCloud, Apple's iCloud settings allow you to manage and delete that data.

14. Changes to This Policy

We may update this Privacy Policy from time to time. The updated version will be posted at this URL with a revised "Last updated" date. Continued use of the App after changes constitutes your acceptance of the updated policy.

15. Contact

If you have any questions or concerns about this Privacy Policy, please contact us at:
info@caliope.org