Privacy Policy — KnotTheory.ai

1. Overview

KnotTheory.ai Inc. (“we”, “us”, “our”) builds privacy-first applications, including Tesseract-Tax, Tesseract-Prime, Tess-Hoshi, Swapétit, and the Tesseract-Tax Cloud platform. This policy explains what data our products collect, use, and share. It applies to all of our apps and services unless a product ships with its own more specific terms.

2. Our Principles

Local-first. Wherever possible, your data is processed on your own device. Many features — including on-device AI models — work entirely offline.
No selling of data. We never sell, rent, or trade personal data.
No advertising and no tracking. Our apps contain no ads and no third-party analytics or tracking SDKs.
Minimal collection. When a feature needs the network, we transmit only what is required to fulfill your request, and we don’t keep it afterward.

3. Cloud AI Processing (Optional Features)

Some apps offer optional cloud-powered AI features (for example, Swapétit’s cloud answers, photo questions, recipe invention, and spoken answers). These features are off until you explicitly enable them, and the app asks for your permission — with a description of what is sent and to whom — before any content leaves your device. When enabled:

Only the content needed to answer — for example your question text and chat history, a photo you attach, dish names and notes you enter, or an ingredient list you provide — is transmitted to our servers.
AI requests are processed by Anthropic’s Claude models running on Amazon Web Services (Amazon Bedrock), under our agreements with those providers, configured for zero data retention: your content is not stored, not logged, and not used to train models. AWS and Anthropic act as our processors and are contractually required to protect your data to at least the same standard as this policy.
Spoken answers send the generated answer text to our voice-synthesis service hosted on Modal Labs infrastructure; speech audio is produced on transient compute and neither the text nor the audio is retained after delivery.
If you request a demo on our website, the details you enter — name, work email, company, role, filer type, approximate return volume and what you would like to see — are stored by us and emailed to our team so we can prepare and schedule the session. Scheduling itself is handled by Calendly: your name and email are passed to Calendly to create the meeting invitation, under Calendly’s own privacy terms. Nothing else on our site sends data to Calendly, and you can email us instead of using it. We use demo details only to contact you about the demo.
Some apps also let you supply your own API key for a third-party AI provider (such as Anthropic or OpenAI); in that case your content is sent directly to that provider under its own privacy terms.

4. Product Specifics

Swapétit

No account or sign-in. The kitchen converter and offline substitution library never touch the network.
On-device AI answers run entirely on your device. Cloud answers follow Section 3 and require your consent, requested in the app before anything is sent.
When cloud features are enabled, the data sent is: the question text and chat history you type, photos you choose to attach, dish names and notes you enter in Enhance, and the pantry ingredient list you provide to Novelty Chef, plus your app language. It is used solely to generate your answer (via Anthropic Claude on Amazon Bedrock, Section 3) and is not retained.
Spoken answers, when you tap the speaker or enable auto-speak, send the answer text to our voice service on Modal Labs (Section 3); with cloud features off, the system voice on your device is used instead.
Microphone audio for dictation is processed by Apple’s on-device/system speech recognition; we do not receive or store your recordings.

Tesseract-Tax

Tax documents, credentials, and financial information remain on your device.
An anonymous first-launch ping (random UUID + platform only) is used for download counting. No name, email, IP address, device identifier, or financial data is included.
The Secure Vault stores credentials locally via the operating system’s Keychain; they are never transmitted to us or any third party.

Tesseract-Prime

All processing is performed locally on your device using on-device AI models. No data is sent to external servers.

Tess-Hoshi

Recordings and transcripts stay on your iPhone. If you configure an upload destination, audio is sent only to the server you specify, under your control.

Tesseract-Tax Cloud (platform.knottheory.ai)

Our professional platform requires an account and processes the documents you or your accountant upload solely to provide the service. Documents are encrypted, are never used to train models, and AI processing follows the zero-data-retention approach of Section 3. Platform customers may be covered by additional contractual terms.
What the platform holds. To prepare and file a return we keep the information on the documents you upload and the answers you give in the Interview, which for a tax return includes names, Social Security numbers, dates of birth, addresses, income and deduction amounts, and the bank account you choose for a refund or a payment, together with the signatures you give on Form 8879 and a record of when, and from which IP address, each one was given.
Tax return information is used only for your return. KnotTheory.ai Inc. is an Authorized IRS e-file Provider, and the information you give us to prepare a return is “tax return information” under Section 7216 of the Internal Revenue Code. We use it to prepare, sign and file your return, and to answer your questions about it, and we do not use it for any other purpose, or disclose it to anyone other than the tax agencies you file with, unless you first give a separate written consent in the form Treasury Regulation 301.7216 prescribes, which names what is disclosed, to whom, and for how long.
Filing. When you or your accountant e-file, the return goes from our servers directly to the IRS, and to a state tax agency when you file a state return, with no other transmitter in between, and we keep the IRS’s acknowledgment with the return.
How we protect it. Because preparing tax returns makes us a financial institution under the Gramm-Leach-Bliley Act, we keep a written information security program under the FTC Safeguards Rule (16 CFR Part 314). Under it, tax data is encrypted in transit and at rest, each firm’s data is separated from every other firm’s, staff who can reach customer information must use multi-factor sign-in, and every access to a return is recorded in an audit trail.
If something goes wrong. If we learn of a security incident affecting tax information, we report it to the IRS no later than the next business day, as the IRS requires of e-file providers, and we notify the people affected, the Federal Trade Commission and state authorities within the times the law sets.
Account creation check. When you create an account by signing in with Google, Apple, Microsoft or GitHub, we ask you to complete a short challenge provided by Cloudflare Turnstile, so that accounts are not created by automated programs. Cloudflare receives your IP address and technical signals from your browser for that check alone; it receives no tax information.
How long we keep it. We keep returns, signatures and IRS acknowledgments for at least as long as the IRS requires e-file providers to keep them, which for signed Forms 8879 is three years, and the rest of your platform data while your account is open or as the law requires.

5. Text Message (SMS) Alerts

Tesseract-Tax Cloud can send you a text message when something on the platform needs your action — for example, a return ready for your signature, a document your accountant has asked for, or an IRS rejection of an e-filed return. Text alerts are optional and off unless you turn them on.

How you opt in. You enter your own mobile number on your Profile page, tick a box agreeing to receive texts, and confirm the number by entering a one-time code we text to it. Your accountant cannot sign you up. Consent to texts is not a condition of using the platform or of any purchase.
What we send. A one-time verification code when you sign up, a confirmation that alerts are on, and alerts that a message in your platform mailbox needs your attention. Texts never contain tax, income, or other financial details — they ask you to sign in, where the message itself is kept.
How often. Message frequency varies with activity on your return, and is at most one alert per day. We do not text between 9 pm and 8 am in your time zone. Message and data rates may apply.
Opting out. Reply STOP to any message, or turn texts off on your Profile page, and we stop immediately. Reply HELP for help, or contact support@knottheory.ai.
What we keep. Your mobile number, your time zone, and the dates you opted in and out. We use your number only to send the alerts described here.
Who delivers them. Texts are sent through Amazon Web Services (AWS End User Messaging), acting as our processor.

No mobile information will be shared with third parties or affiliates for marketing or promotional purposes. Text messaging opt-in data and consent are not shared with any third party, except the messaging processor named above, solely to deliver the texts you asked for.

6. Purchases & Subscriptions

In-app purchases and subscriptions (such as Swapétit Pro and Tess-Hoshi Pro) are processed by Apple. We do not receive or store your payment details. Website purchases are processed by Stripe, which handles your payment information under its own privacy policy.

7. Data Sharing

We do not sell, share, or transfer personal data to third parties, except for the processors described above — Apple, Stripe, Amazon Web Services (Amazon Bedrock), Anthropic, Modal Labs, and Cloudflare (Turnstile) — acting on our instructions to deliver the service you requested. Each processor is bound by terms that provide the same or equal protection for your data as this policy. Tax returns you file through Tesseract-Tax Cloud go to the IRS and to the state tax agencies you file with, and tax return information is otherwise disclosed only with your written consent under Section 7216 (Section 4). Mobile numbers and text-message consent are never shared with or sold to third parties or affiliates for marketing or promotional purposes (Section 5).

8. Data Retention

Cloud AI request content is not retained (Section 3). Anonymous download-count records (random UUID, platform, timestamp) are kept for internal metrics and cannot be linked to any individual. Platform account data is retained while your account is active or as required by law. If you opt out of text alerts, we stop texting at once but keep your number with the dates of your consent and opt-out, so we can show that you agreed to the texts you received and are no longer sent any; you can ask us to delete it.

9. Your Rights

Depending on where you live (for example, under GDPR or the CCPA), you may have rights to access, correct, or delete personal data we hold. Because our apps hold your data on your own device, deletion is usually as simple as deleting the app; for anything else, contact us and we will help.

10. Children’s Privacy

Our apps are not directed at children under 13. We do not knowingly collect any personal information from children. (Swapétit’s “for kids” recipe option only tailors recipe suggestions — it collects nothing about any child.)

11. Changes to This Policy

We may update this privacy policy from time to time. Changes will be posted on this page with an updated revision date.

12. Contact

Questions about this policy:
support@knottheory.ai or tess@knottheory.ai