Privacy policy
effective 2026-10-05 ยท operator Nyedis
1. who we are
Nyedis operates Carnivore and its community service. This policy says what the community service and this website collect, why, and what you can do about it. It does not describe your own Mac: the Carnivore app runs there and your sessions stay there.
2. what we collect
- Account: your email address, your GitHub id and login or the email address of your Google account, and the handle you choose. When you sign in with GitHub we also read your primary verified email address from GitHub (the user:email scope).
- Profile: the bio and links you choose to add.
- What you post: comments, reviews, reports you file, and skills, themes or plugins you submit.
- Device sessions: one record for each device you are signed in on, with a device label so you can tell them apart and sign one out.
- Network prefix: the network a request comes from (the first three parts of an IPv4 address, or the first 48 bits of an IPv6 address), used only for abuse limits such as rate caps. It is stored only as a salted hash, never as the address itself, and the counter expires within about two hours.
- Install id: the app generates a random install id and sends it when you sign in. Only a keyed hash of it is stored, used to recognise the computers you have signed in from.
- Sign-in counts: aggregate daily counts of sign-ins by where the sign-in started and which provider was used, with no record of any person.
- Install reports: when the app installs or updates a catalog item it always sends the item, the version and your account id. There is no switch to turn this off. If you are not signed in, the app makes a guest account for that computer and uses it. An install record is also what lets an account rate an item, so the record is kept for as long as the account exists.
- Guest account: a random account id and a public key, made the first time the app reports an install while you are signed out. Making it also sends your install id, the version of the terms, a confirmation that you are 16 or older and the app name, with a small proof of work and a signature from the key. No email, no name. It holds your install reports and your ratings of items you installed. The private key stays on your computer, in its keychain. A guest account cannot comment, file reports, write to us through the app, publish, or use share links, the relay or phone sync.
This website uses locally hosted scripts for page interactions. It uses Google Analytics and Microsoft Clarity to count visits and clicks, and those services set cookies in your browser. It carries no ads.
3. what is public
Your handle, profile, comments, reviews and submissions are shown to other users. Your email address is not shown. Reports you file are seen by moderators, not published.
4. how we use it
- to run your account and sign you in;
- to show what you post and to let moderators review it and reports;
- to limit abuse and keep the service up;
- to email you sign-in codes and account notices.
When you sign in, a guest account on that computer is merged into your carnivore account: its install records and ratings move over, so they are linked to your email address or your GitHub or Google identity.
The hosted features, which are read only share links, mobile sync relay, phone pairing and catalog writes, need an account. The relay keeps the account a device belongs to.
Carnivore news emails: the sign-up box is pre-checked. You can untick it at sign-up or turn news emails off at any time on the account page, and every news email carries an unsubscribe link.
Sign-in alert emails: when your account signs in from a computer it has not used before, we send you a security notice. These have no unsubscribe link because they are security notices, and we send at most 3 a day.
We show no ads and we do not sell your data.
5. who else handles it
- Amazon Web Services hosts the community service, in its us-east-1 region in the United States, and this website.
- Amazon SES sends our email.
- GitHub or Google, only if you choose to sign in with one of them. From Google we receive only a verified email address and an account identifier.
We do not share your data with anyone else, except where the law requires it.
6. your choices
- Delete: delete your account from inside the app.
- Export: download your data as a JSON file from inside the app.
- Sessions: sign a device out at any time.
- Guest account: download or delete a guest account's data from the account page in the app. Because install reporting has no switch, the next install after a deletion makes a new guest account; sign-in is how you join the history to your own account, and deleting your account erases its install records.
Anything else, write to support@carnivore.ai.
7. how long we keep it
Account data is kept while your account exists and removed when you delete it. Two kinds of record outlast an account: the moderation audit log, which notes each moderator action and is never edited or deleted, and reports you filed, which stay with moderators. Abuse limit counters expire on their own: network counters within hours, sign-in counters for an email address after about six months. Install records and ratings are kept for as long as the account exists and are deleted with it; the per-item, per-version install totals are kept without any account attached. A guest account nobody has used for 13 months (no install report and no sign-in from its computer) is deleted, with its install records and ratings. We keep no email delivery records of our own.
8. age
The community service is for people who are 16 or older. We do not knowingly collect data from anyone younger.
9. changes
If this policy changes, the new text replaces this page and the date at the top changes.