Privacy 🥬

Lettuce is local-first by design. It runs on your own devices — the Mac app and the companion iPhone app — with nothing to sign up for and nowhere for your notes to go.

The short version: No account. No Lettuce servers. No telemetry or analytics in the app. Your notes are plain files in a folder you choose, and your AI keys live in your macOS Keychain. We never see either.

Your notes

Your notes are plain Markdown (.md) files in a folder you pick. Lettuce reads and writes them on disk and nowhere else. They never leave your device unless you choose to publish a static site, sync the folder with a tool of your own (for example, keeping the vault in iCloud Drive so the Mac and iPhone apps share it), or use the optional AI features described below. There is no cloud, no database, and no Lettuce backend.

Optional AI features

Lettuce includes an optional set of AI features — Ask, enhance, and semantic search (embeddings). They are off until you turn them on by supplying your own API key for a third-party provider (Anthropic, OpenAI, Google Gemini, or any OpenAI-compatible endpoint, including a local model). With no key configured, no note content is ever sent anywhere.

When you use one of these features, the relevant text is sent to the provider you configured, using your key, and handled under that provider's own privacy policy, not ours. To be specific about what "relevant text" means:

Enhance and single-note actions send the note (or selection) you act on.
Ask answers from your vault, so it retrieves and sends the most relevant notes for your question — not just the current one, but up to roughly two dozen — as grounding context.
Semantic search (embeddings) sends note text to be turned into embeddings; on first use it indexes your whole vault. You can turn cloud embeddings off in Settings to keep this local-only.
Scheduled digests / briefings, if you set one up, run automatically on your schedule and send recent note titles, short snippets, and open-task text to your configured provider — recurring egress you don't trigger by hand each time.
The directive worker and other agent automations you enable send the relevant note context when they run.

Requests go straight from your device to the provider; Lettuce runs no server of its own that stores your notes. Point Lettuce at a local model (e.g. Ollama) and nothing leaves your device at all — this applies to every feature above. These features work the same way in the iPhone app, which talks to your configured provider directly from the phone.

Your API key is stored only in your device's Keychain. Lettuce never transmits the key to us and never sees your notes in transit — the connection is between your device and the provider you chose.

The agent (MCP) server

Lettuce can run a local server so AI agents (Claude, OpenAI, Gemini clients, etc.) can read and write your vault. That server binds to 127.0.0.1 only — not reachable from outside your Mac — and every request requires a scoped API key you generate. With propose-only keys, an agent's writes are queued as reviewable diffs and never touch your files until you accept them. If you explicitly turn on Tailscale sharing, that same key-protected server also becomes reachable to your own devices on your private tailnet (and to no one else); it is off unless you enable it.

Notifications

If you set up notification rules or digests, the iPhone app can show push alerts. Delivering a push routes its contents through Apple's push service (APNs), so the alert text — which by default includes the note's title and its path within your vault — passes through Apple's servers, as it does for any app's notifications. No note body is sent. If that matters to you, you can leave notifications off.

No tracking in the app

The Lettuce apps contain no analytics, telemetry, or usage tracking, and never inspect what you write, how you use them, or who you are. The iPhone app uses Apple's on-device MetricKit to capture crash and hang diagnostics locally so a crash can be understood — these stay on your device and are never transmitted to us or anyone else. The only network requests the apps make are ones you initiate — or the once-a-day update check you can turn off (see below).

This website uses Plausible — a privacy-friendly, open-source analytics tool — to count aggregate page views. It sets no cookies, collects no personal data, and does no cross-site or cross-device tracking; nothing here can identify you. It's a count of how many people visit, nothing more.

Updates & downloads

The app is distributed as a notarized DMG you download from this site. Downloading it is a normal web request to our static host; we don't set tracking cookies. Apple's notarization check (a standard macOS security step) happens between your Mac and Apple, not us.

Automatic updates. To deliver fixes, the app checks our update feed about once a day. That request reveals to our static host only your IP address, a generic updater user-agent, and your current app version — no system profile, no identifiers, and nothing about your notes. You can turn it off in Settings → About → Automatically check for updates.

Things you trigger. Some actions you start reach the internet: AI features call the AI provider you configured (with your key); publishing a site talks to GitHub on your behalf. Lettuce makes no such request on its own, and your notes and keys never reach us.

Questions

Email hello@drbaher.com. If a future version ever changes any of the above, this page will be updated before that version ships.