Effective July 9, 2026 · Updated October 5, 2026
Cloister Ink is built on a simple rule: your writing is yours. This policy is short because there is very little to disclose.
Seven Swords Productions LLC collects nothing. Cloister Ink has no accounts, no sign-in, no analytics, no telemetry, and no servers we operate. We never see your documents, your usage, or your identity.
There is one exception, and it is entirely your choice: the optional "Ask" feature, which is off by default. If you turn it on and set up one of the choices below, the text you highlight is sent to the AI you selected, under your own account with that company, or to the endpoint address you entered yourself, where a key is optional. You choose which: Claude, from Anthropic; Grok, from xAI; ChatGPT, from OpenAI; or a Custom endpoint, an OpenAI-compatible server whose address you enter yourself. Ask text goes only to the one you have selected when you send. A fifth choice, On-device (Apple Intelligence), uses the model Apple provides on your device, and Cloister Ink makes no network request for it. Read Aloud's AI voices are the only exception to where Ask text goes, described below: Read Aloud, which is part of Ask, sends a highlighted passage, or from version 1.1 the page from your cursor to its end, only if you pick an AI voice for it and press Read Aloud, and then only to that voice's service, which can be a different one from the AI Ask is set to. Cloister Ink sends that text at your instruction, to the destination you chose, and never to us. Because that text can leave your device to a company or to a server we have no part in, our App Store privacy label declares it as user content used for app functionality and linked to your identity: with Claude, Grok or ChatGPT, your API key identifies your account with that company. We declare it the same way for every Ask destination, including a custom endpoint and any key you choose to save for one. Full detail is in the Ask section below. Leave Ask off and Cloister Ink sends none of your writing to any AI service. Files you keep in iCloud are synced by Apple through your own iCloud account. One optional feature of your own device can also send text, and only if you switch it on in Settings. It is Apple's rather than ours: see Apple's Writing Tools below. On-device dictation, described below, uses your microphone only for dictation that you start, and Cloister Ink sends neither the audio nor the words anywhere; the words become part of your document, stored where you chose to keep it.
Your documents are markdown files you can read in any text editor. Two other kinds of file are written for you, both of them yours, both of them plain files on your own disk or in your own iCloud Drive:
Converted copies are also tidied on arrival, which normalises spacing, list marks and table alignment in the markdown Cloister Ink itself wrote. Markdown and text files you already wrote are never tidied on import. The switch is under Settings, Imports.
Your documents are plain markdown files stored in your own iCloud Drive (offered whenever iCloud is available) or locally on your device. You choose where each new document goes when you first save it, and you can move any file between the two at any time from the sidebar. Cloister Ink has no setting that moves your vault or decides which of the two your documents live in. Settings does carry one location control, Inbox location, and it decides only where imported files land and, from version 1.0.19, which place the Save to row for a shared item starts on. iCloud storage and sync are provided by Apple under Apple's privacy policy; Cloister Ink simply reads and writes files in your own container. Draft-history snapshots are stored locally on your device and never leave it.
On iPhone and iPad, Cloister Ink appears in the system share sheet so you can send a page, a link, or a file into your Inbox from another app. What you share is written into your own Inbox, directly or through the private folder described below. From version 1.0.19, the sheet has a Save to row where you pick iCloud Inbox or Local Inbox for that one item. The row starts from the Inbox location you chose, in Settings or when Cloister Ink asked at your first import, and offers the places that are available at that moment. If you have never chosen one, the row starts on iCloud Inbox when iCloud is available. The item goes where the row shows when you tap Save; if that place can no longer be reached, Cloister Ink asks before saving it to the other one. An item saved to Local Inbox is written first into a private folder that Cloister Ink and its share extension both hold on your device, and the app moves it into your Local Inbox the next time you open it.
Versions before 1.0.19 have no Save to row. There a shared item goes to the iCloud Inbox when iCloud Drive is available, whatever Inbox location is set to, and otherwise into the same private folder on your device.
Nothing shared this way is sent to us. The share extension contains no networking code of its own, so the only thing that leaves your device is your own file syncing through your own iCloud account when the item is saved to iCloud, under Apple's policy linked above.
If you press the microphone beside Ask, Cloister Ink uses your device's microphone and Apple's Speech framework to place the words you speak into the document at your cursor. When more than one microphone is available, a menu beside the button lets you pick one. On iOS 26, iPadOS 26 and macOS 26 and later, dictation listens through the microphone the system is currently using for sound input, and the menu choice does not change it. If that way of listening cannot start, and the older one supports your dictation language on the device, Cloister Ink falls back to the older one. The older way asks the system to use the microphone you picked, if that microphone is still available. Earlier system versions use only the older way. Cloister Ink requires on-device recognition for every dictation request. If the current language or device does not support it, the app stops and tells you instead of using Apple's server-based recognition. If the speech model for your dictation language is not already on your device, Cloister Ink may ask Apple's Speech framework to download it from Apple when you start dictating, so that recognition can stay on the device; on systems where that download is not offered, the app simply stops as described above. The download, when it happens, brings a generic language model to your device and carries none of your audio or writing to Apple.
Cloister Ink uses microphone audio as input for on-device dictation. It does not record it to a file, retain it, send it to Seven Swords Productions LLC, or send it to any server. The resulting words become part of the markdown document you are editing and are stored wherever you chose to keep that document. You can stop dictation at any time by pressing the microphone again. On some system versions, when you do this during dictation, Cloister Ink asks the system to finish transcribing the words you have already spoken, and the microphone can remain active while that request is pending. Microphone and Speech Recognition access can also be withdrawn in your device settings.
Ask is off by default. If you enable it, you choose which AI it talks to. For Claude, Grok or ChatGPT you provide your own API key for that company. The first four choices below arrive with version 1.0.7; earlier versions use Anthropic only, and a key saved there keeps working unchanged. The fifth, On-device, needs no key and can answer only on devices where Apple Intelligence is available.
The three links above are those companies' public privacy policies. A custom endpoint has none for us to give, because we do not know whose it is. API traffic is also governed by the terms of the API account you open with them, which may differ from the consumer product. We do not control, and we never see, what they keep.
Each key is stored separately in your device's Keychain, under its own entry, never written to disk in plain text, never logged, and never transmitted anywhere except to the destination it belongs to, which is the company for Claude, Grok and ChatGPT and the address you entered for a custom endpoint, as the credential on the requests described below. A key for one AI is never sent to another. Keys you have saved are kept when you switch, so changing your mind costs you nothing.
When you send an Ask request, the app transmits only the text you explicitly highlighted and the instruction you typed (only the instruction, if nothing is highlighted; follow-up questions resend that conversation), directly to the API of the AI you selected, using your key for that company. With On-device selected, Cloister Ink does not send that text over the network; it hands it to Apple's on-device model framework on your device.
While Ask is enabled, Cloister Ink can make three other kinds of request. None is made with Ask off.
An orange indicator in the Ask panel shows whenever a request the panel started is in flight, including a speech request. Settings has no request indicator, so a model-list request that follows a change you make there can run without one on screen. Cloister Ink itself sends none of your writing to any AI service without Ask being enabled. Files in your own iCloud Drive are synced by Apple, as described above. If you chose Claude, Grok or ChatGPT, your use of Ask is governed by that company's privacy policy, linked above, under your own API account with them. If you chose a custom endpoint, the terms are whatever the operator of that server sets, and there is no policy of theirs for us to link. Disable Ask and Cloister Ink stops making network connections of its own, apart from the speech-model download described under dictation above and, from version 1.1, the App Store purchase checks described under Purchases below. Apple's Writing Tools, described in the next section, is a feature of your device rather than a connection Cloister Ink makes.
Starting with version 1.0.4, Apple's Writing Tools reaches the editor only if you turn on the Apple Writing Tools switch in Settings, and that switch is off by default. With it off, Cloister Ink asks the system to keep Writing Tools out of the editor on every platform that offers it; older systems have no Apple Intelligence and no Writing Tools to keep out in the first place. With it on, Writing Tools appears in the text selection menu on devices that offer Apple Intelligence, the same way it does in any standard text field on your device. Cloister Ink still provides no button, menu item, or command of its own that opens it. This is Apple's feature, not ours. It does not use any API key you have saved and it works whether Ask is on or off.
One narrower detail on iPhone and iPad: with the switch on, Writing Tools is offered in its limited inline form, and only while spell check is on, which is also switched on by the Revise pass. On Mac, with the switch on, the full Writing Tools menu is available. These are requests to the system; a small number of iPhone and iPad configurations decline the limited request and follow their own default instead.
When you use Writing Tools, your device may send the text you selected to Apple for processing, and Apple's rewrite is returned into your document just as typed text would be. That handling is governed by Apple's privacy policy and by Apple Intelligence's own terms. Seven Swords Productions LLC never receives the text, the result, or any record that you used it. If you turn Apple Intelligence off in your device settings, this path does not exist.
This path runs only when you invoke it from your device's own menus, and you can stop it at any time by turning the Apple Writing Tools switch off in Cloister Ink's settings, or by turning Apple Intelligence off in your device settings. Apple is the recipient. We do not control where Apple processes the text or on what terms, and that part is between you and Apple. There is nothing here for us to keep, delete, or hand over on request, because no copy of the text, the result, or the fact that you used it ever reaches Seven Swords Productions LLC.
Cloister Ink is sold through the App Store. With version 1.1 it becomes a free download there, with a free 7-day trial and one optional purchase that unlocks the app. There is no subscription. From version 1.1, nothing is charged unless you choose Buy and confirm it with Apple, and the trial, the purchase, and Restore Purchase all run through Apple's App Store on your device. To know whether you are in a trial or own the app, and to show the price, Cloister Ink (version 1.1 and later) asks Apple's StoreKit framework on your device when the app opens, each time it comes back to the foreground, when Apple reports a change to your purchases (for example one made on another device), and when you tap Start, Buy or Restore. Apple may contact its own servers to answer. Those requests go to Apple, under your Apple Account and Apple's privacy policy, and they carry nothing you have written. The answer stays on your device as a saved note of whether you are in a trial, own the app, or the trial has ended, with when the trial began and ends. Through your purchase we receive no personal or payment information about you, and payment is handled entirely by Apple.
Cloister Ink is available in many countries, and privacy laws such as the EU/UK GDPR, Brazil's LGPD, Canada's PIPEDA, and the California Consumer Privacy Act give you rights over personal data an app maker holds about you: access, correction, deletion, and portability among them. Because we hold nothing, those rights are already in your hands: your documents are plain files you can read, export, or delete at any time, and anything in iCloud is controlled through your own Apple account. Deleting the app is not a complete erase. On iPhone and iPad, deleting the app removes the documents and settings it kept in its own storage on that device. On a Mac, those may remain in the app's container folder until you delete them yourself. On any device, deleting the app does not remove files in iCloud or files you exported or saved somewhere else, and an API key you saved for Ask may remain in the device's Keychain, which the system manages. You can remove a key yourself before you delete the app. In Settings, under Ask (AI), turn on Enable Ask if it is off. For Claude, Grok or ChatGPT, select that AI and press the Remove button beside the words Stored in Keychain. For a custom endpoint, select each saved address in turn and press the Remove button beside the words Stored in Keychain. If the app is already deleted, or you want to be certain a key can no longer be used, revoke it with the company or server operator that issued it. We do not sell or share personal information. We have none to sell. If you believe we hold any personal data about you (for example, from a support email you sent us), contact us and we will confirm, provide, or delete it. If you email us, we use your message and address only to respond, keep them no longer than needed, and delete them on request. You may also raise a concern with your local data-protection authority (for example, the UK ICO, Brazil's ANPD, or the Office of the Privacy Commissioner of Canada).
Apart from anything you choose to email us, which is received in the United States, we transfer no data across borders, because no other data reaches us. The only network activity Cloister Ink itself performs is the optional Ask feature described above; from version 1.1, the App Store purchase checks described under Purchases; and a possible download of an Apple speech model when you dictate in a language whose model is not yet on your device, which brings a generic file from Apple to your device and carries nothing of yours away. Ask requests, and Read Aloud passages if you pick an AI voice, are ones you start. They are sent with your own key, where there is one, to the AI company you selected for Ask or for the voice, or to a custom endpoint address you entered, which may sit in your own country, in another, or on a machine of your own. The voice can belong to a different company from the AI Ask is set to. Which of those it is follows from what you chose, and we do not learn it. The On-device choice makes no network request. Apple's Writing Tools may also send text to Apple when you use it, under Apple's own policies.
Cloister Ink is a general-audience writing app, not directed at children. Seven Swords Productions LLC collects no data from anyone, including children. The optional Ask feature is off by default, and Cloister Ink sends no text to any AI service until someone turns it on and either enters an API key obtained from one of the AI companies named above or enters the HTTPS address of an OpenAI-compatible server. That is set-up work we expect an adult to do. The On-device choice needs neither, and Cloister Ink makes no network request for it. Cloister Ink creates no account for you, issues no key, and asks for no personal details at any point.
If a future version ever changes what leaves your device, this policy and the App Store privacy label will be updated first, and the change will be called out in the release notes.
October 5, 2026, later the same day. Two changes to the Ask section for version 1.1, which had not been released on the date of this entry, so this page changed before the version, as the promise at the top of this section says. First, Read Aloud: from version 1.1, an AI voice with nothing highlighted reads the page from your cursor to its end, and that text is sent to the voice's service in pieces of up to 4,000 characters while the reading runs, the next piece going out while the current one plays. Until this entry, the Read Aloud item and the sentence near the top of this page said that only a highlighted passage can be sent. That is true of versions before 1.1 and is kept for them; both passages now say what version 1.1 sends. Second, the voice list: version 1.1 can ask a custom endpoint which voices it offers when you tap Fetch voices or pick a speech model in its form, described in a new item in the Ask section. No released version makes either kind of request.
October 5, 2026. This is the earlier of two entries dated October 5, 2026. The Save to row described under Sharing into Cloister Ink arrives with version 1.0.19. From October 4, 2026 until this entry, this page said it arrives with version 1.1, in Where your writing lives and in Sharing into Cloister Ink. The October 4 entry below says so too and is left as it was published. On the date of this entry neither version had been released. Sharing into Cloister Ink now also says that the Inbox location the row starts from is the one you chose in Settings or when Cloister Ink asked at your first import, and where the row starts if you have never chosen one: on iCloud Inbox when iCloud is available.
Two statements on this page were also corrected with this entry. Both corrections describe how the released app already works, and version 1.0.19 changes neither behavior. The On-device dictation section said that dictation uses your chosen microphone. It said so from October 4, 2026, when that section was added, until this entry. On iOS 26, iPadOS 26 and macOS 26 and later, dictation listens through the microphone the system is currently using for sound input, whichever one you picked in the menu beside the button, unless it falls back to the older way of listening, and the section now says so. The Your rights, worldwide section said that deleting the app deletes everything it stored on your device. It said so from at least August 1, 2026, and possibly since this page was first published in July 2026, until this entry. An API key you saved for Ask may remain in the device's Keychain after the app is deleted, files in iCloud and files you saved elsewhere are not removed, and on a Mac the app's documents and settings may remain in its container folder. The section now says so and says how to remove a key first or revoke it. The Updated date at the top changed with this entry. Nothing else changed with this entry.
October 4, 2026. With version 1.1, Cloister Ink becomes a free download with a 7-day trial and a one-time purchase. Added the App Store purchase checks to the network activity this policy lists and described them under Purchases. Nothing you write is part of them. The App Store privacy label is unchanged, because the purchase checks are requests to Apple and nothing is collected by Seven Swords Productions LLC.
This page was also corrected to describe the released app, and version 1.1 where noted. Sharing into Cloister Ink now describes the Save to row that arrives with version 1.1, where you pick iCloud Inbox or Local Inbox for each item; the earlier wording, that a shared item goes to iCloud whenever it can, describes versions before 1.1 and is kept for them. The Ask section now lists the On-device (Apple Intelligence) choice, in the app since version 1.0.12, for which Cloister Ink makes no network request. It now also describes Read Aloud's AI voices, in the app since version 1.0.18: if you pick one, pressing Read Aloud sends the highlighted passage to that voice's speech service. From September 1, 2026, when version 1.0.12 was released, this page did not describe the On-device choice. From September 11, 2026, when version 1.0.18 was released for iPhone and iPad (September 13 for Mac), it did not describe Read Aloud's AI voices, and it said Ask text goes only to the AI you selected, which left out that voice. Both gaps lasted until this page was updated on the date of this entry. For Read Aloud's AI voices, this page was not updated before version 1.0.18 was released, which the promise at the top of this section says it would be. Until this update the page also described the model-list request less completely and said the on-screen indicator is visible whenever an Ask or model-list request is in flight, when Settings has no indicator and a model-list request that follows a change made there can run without one on screen. None of this reaches Seven Swords Productions LLC. The App Store privacy label already declares the text you send to an AI you choose as user content used for app functionality and linked to your identity, and that covers a Read Aloud passage sent to a voice's service; Cloister Ink makes no network request for the On-device choice, so it adds nothing to the label.
The On-device dictation section above is also new on this page. Dictation has been in the app since version 1.0.12. From September 1, 2026, when that version was released, this page did not describe dictation, or the Apple speech model that dictation may download to your device when your language's model is not already installed. It also said the only network activity Cloister Ink performs is Ask, and that with Ask off Cloister Ink makes no network connections of its own. That gap also lasted until this page was updated on the date of this entry. Cloister Ink uses live microphone audio only for dictation that you start, requires Apple's on-device recognition path, and keeps no audio recording. The download is a generic language file from Apple; it carries none of your audio or writing. The App Store privacy label is unchanged because neither the audio nor the resulting text is collected by Seven Swords Productions LLC.
Later on the same date, one sentence in the On-device dictation section was reworded. It had said the audio exists only as a live input while you dictate. On some system versions, when you press stop during dictation, Cloister Ink asks the system to finish transcribing the words you have already spoken, and the microphone can remain active while that request is pending. The sentence now says that Cloister Ink uses microphone audio as input for on-device dictation. Later still on the same date, a sentence saying the same thing about the microphone was added to that section, after the sentence about stopping dictation; until then the section itself had not said it. No other statement about dictation changed.
August 24, 2026. Ask gained a fourth choice, a custom OpenAI-compatible endpoint at an HTTPS address you enter yourself, described in the Ask section above. A key is optional for that choice, and when you have not saved one, requests to that address carry no key. Nothing new reaches Seven Swords Productions LLC, and the App Store privacy label is unchanged, because it already declares the text you send from Ask as user content used for app functionality and linked to your identity.
August 23, 2026. Cloister Ink added a share extension on iPhone and iPad, described in the Sharing into Cloister Ink section above. What you share is written into your own vault. Nothing about it reaches Seven Swords Productions LLC, and the App Store privacy label is unchanged because no new data reaches us. An earlier version of this page named a Settings control for choosing where documents are stored. There was no such control, and the sentence has been removed.
July 27, 2026. Clarified how this policy describes Apple's Writing Tools, which is a feature of your device rather than something Cloister Ink sends anywhere. The Apple's Writing Tools section above is new and describes that path in full. An earlier version of this page, live from July 9 to July 26, 2026, did not describe it. In the same update, Cloister Ink removed its own Format ▸ Proofread menu item on Mac, so the app no longer offers any command that opens Apple's Writing Tools. Seven Swords Productions LLC has never received the text, the result, or any record that you used it.
With version 1.0.4. Cloister Ink added an Apple Writing Tools switch in Settings, off by default. Until you turn it on, the app asks the system to keep Apple's Writing Tools out of the editor on every platform that offers it. The Apple's Writing Tools section above now describes the switch.
Seven Swords Productions LLC · contact@sevenswordsproductions.com · sevenswordsproductions.com