Privacy

1. Who is responsible

Open Horyzn is made and run by one person: Zdravko Jovanovic, Wehlistraße 32–38, Stiege 1, Tür 9, 1200 Vienna, Austria. He is the controller for the personal data that reaches us, as described on this page, under the EU General Data Protection Regulation (GDPR) — that is, the person who decides how it is used and answers for it. In this policy, “we” and “us” mean him.

Open Horyzn is the name of the product. There is no separate company behind it.

For anything about your data — a question, a copy of what we hold, a correction or a deletion — write to office@open-horyzn.com.

We have not appointed a data protection officer, because the conditions under which the GDPR requires one (Art. 37) are not met.

2. What stays on your Mac — and what reaches us

Open Horyzn runs on your Mac. Almost everything it produces stays there, in one folder you can open yourself: Documents › Open Horyzn. The files in that folder are not uploaded to us. What does leave your Mac in our direction is listed under “What reaches us” below. The requests you send to the AI model go to Anthropic, not to us — that is section 3.

What stays on your Mac

• Your chats: every message you write and every answer, plus short summaries the app keeps so that a chat remembers what it was about.
• Screenshots: whenever Open Horyzn looks, it captures only the window it needs. That image is kept together with the text it read from it — the words on screen and the names of buttons and fields.
• Logs: what each step did, which app and which web address it looked at, how long it took, how many tokens (the units Anthropic bills in) each request used, and a copy of every report you sent.
• Your Claude API key: encrypted in the app’s own storage, and as a plain text file in the folder (claude-api-key.txt), so you can see where it is and remove it.
• Your sign-in session (encrypted in the app’s own storage) and your settings.

None of this is deleted automatically. It stays until you delete it. Deleting a chat in the app removes its messages and its summary; the screenshots and log entries of tasks you ran in that chat stay in the folder until you delete them in Finder, where you can remove any file or the whole folder. If you delete your account, the app deletes your API key and moves the folder to the Bin, so you can still restore your chats and screenshots until you empty it.

What the app reads on your Mac, and why

• Screen Recording — to capture the window you are asking about.
• Accessibility — to read the names and positions of buttons and fields, so the marker lands exactly on the right element. If you allow it for a task, also to click or type for you.
• Automation — to bring the right app to the front. To read the address and title of the tabs open in Safari and Chrome, so it can find the page you mean. To open and reload tabs there, and to close tabs it opened itself. And, after typing for you, to check which field has the focus and what it contains.
• Input Monitoring — while Open Horyzn is running, it notices where you click, when and in which direction you scroll, the back and forward buttons of your mouse, and control keys and shortcuts (such as Escape, Return or ⌘Z), to tell whether you clicked the marked element or went somewhere else. It never records the letters you type.
• Clipboard — some steps read or fill your clipboard. Its content is not stored.
• Hardware ID — to work out the device code described below. The hardware ID itself never leaves your Mac.

All of this is read on your Mac. Text on screen is recognised by macOS itself, with Apple’s on-device text recognition — not by an online service. What of it goes to Anthropic with a request is in section 3.

Open Horyzn stores information on your Mac and reads information from it to provide the service you asked for. To work out the device code, it also reads the hardware ID of your Mac. It does this only after you have accepted our terms and confirmed “Register this Mac” — that confirmation is your consent to it (§ 165(3) of the Austrian Telecommunications Act 2021). We need the device code to tie your account and plan to your Mac and to keep the free plan from being abused; the app can’t be offered without it. Only the fingerprint leaves your Mac, and it can’t be turned back into the hardware ID. You can withdraw your consent at any time by writing to office@open-horyzn.com or by deleting your account; the app can’t be used on a Mac that isn’t registered.

What reaches us — and when

• When you create an account: your email address and a password, which our database provider Supabase stores only in hashed form — scrambled so that nobody, including us, can read it. If you sign in with Google instead, we receive from Google your name, your email address, whether Google has verified it, your Google account ID and the link to your profile picture. We also record when you accepted our terms, and which version.
• When you create an account — or the first time you sign in on a Mac — the app tells you that this Mac will be registered with your account under a device code, and asks you to confirm. Until you have confirmed and accepted the terms, the app counts nothing and sends neither the device code nor usage counts. The device code is a fingerprint calculated from your Mac’s hardware ID (a SHA-256 hash) — not its serial number, and we never receive the hardware ID itself. It is a permanent identifier of this Mac: the same Mac always produces the same code. That makes it personal data under a pseudonym, not anonymous data, and we treat it as such. On every plan we keep it with your profile, together with the time we first and last saw it.
• On the Go plan, for every message you send and every pill the app starts to show (a pill is the pink “click here” marker the app draws on your screen): one entry against your monthly allowance of 50 each. It records the type, the month and the time, linked to your account and to the device code. On Founder nothing is counted, but the app still sends the same request, with your account and the device code, to ask whether you may continue.
• While you are signed in, the app tells us its version number: after you sign in, when it starts, with every message you send, and when you ask it to check again for an update. We keep that number with your profile, together with the time it was last recorded, so that we can recognise outdated versions and require an update when one is needed. The app sends it only after you have accepted the terms and confirmed “Register this Mac”.
• While you are signed in, the app also sends us usage counts: the number of your chats, messages, screenshots and tasks, the number of days you were active, how many tokens your requests used, and the time of the upload. It sends them a few seconds after every message that is saved and after you delete a chat; each time the new numbers replace the old ones, so we hold no history of them. They are counted on your Mac from the files in your folder, from the day your account was created. “Tasks” means each time the app looked at your screen for you. Numbers only — never the content of a chat, a screenshot or a file.
• When you send a report — a bug or an idea: the text you write, its category, and the versions of the app and of macOS. If you send the report from an error card, the technical error message of the failed request is sent instead of a text of your own. If you attach a task, also its date and time, which app and which website (the host name only) it ran on, whether the element was found, the app’s technical error message, timings, and how long your question and the model’s note were — never their text. Never a screenshot, never text from your screen, never your chat.
• If you have bought Founder: your plan and its status, the amount and currency, and the card brand with its last four digits — so the app can show it to you. The payment itself is handled by Stripe (section 6).
• Whenever the app talks to our database provider — to sign you in, keep you signed in, check your plan, count your allowance, check whether an update is required or send a report — Supabase receives your IP address and the basic technical data of the connection, as with any internet request. Supabase keeps them in technical logs to run the service and keep it secure (Art. 6(1)(f) GDPR). On the Supabase plan we currently use, these logs are kept for one day, and Supabase makes no backups of our database — what you delete is not kept in a backup.

That is everything that reaches us from the app. We do not receive your screenshots, your chats, your files, your API key or the text on your screen — only how many there are.

We use reports to fix bugs and improve the app. That is our legitimate interest in a product that works (Art. 6(1)(f) GDPR); you decide whether to send one.

We use the usage counts to understand how much the app is used and to improve it. That, too, is our legitimate interest (Art. 6(1)(f) GDPR). There is no switch to turn them off; you can object as described in section 8.

3. What goes to Anthropic (Claude)

Open Horyzn uses Claude, an AI model made by Anthropic, to understand your question and your screen. You connect your own Claude API key. The app builds every request on your Mac and sends it from there directly to Anthropic, signed with your key — not through a server of ours. We never receive these requests or the answers, and Anthropic bills them to your account.

For these requests you are Anthropic’s customer yourself, under the terms you accepted when you created your API key. Our part is the software: it puts each request together on your Mac and sends it. We do not receive, store or have access to the requests or the answers, and Anthropic does not handle them on our behalf. The one exception is an error message you choose to send us with a report (section 2). That is why this section lists exactly what the app sends — so that you can decide what to ask about.

What a request contains

• Your message and the conversation it belongs to: the recent messages of this chat — including results the app showed you there, such as the contents of a file it read for you — or a summary of older ones, plus short notes from earlier tasks in this chat.
• If you ask about something you did earlier, matching lines from your other saved chats and from the local log of earlier tasks are sent with that one question.
• When the answer depends on your screen: a screenshot of the one window it is about — in a browser usually just the page area — never your whole screen, and never other windows on top of it. With it goes the text the app read from it: the words on screen and the names of buttons and fields.
• To find the right app or page: the names of the open apps and the size of their windows, which one is in front, and the addresses of the tabs open in Safari and Chrome.
• To check what state a page is in — for example whether you are signed in, mainly on Google account pages: the page’s address without its parameters, its title, the text on it including what is written in its text fields (never password fields), and your goal. No screenshot.
• During a task: the goal, the steps already done and still planned, what the app saw on screen along the way, and what you did in between, for example going back or closing a tab. Text the app types for you and your clipboard are not sent.
• When you set up your API key: a short test message (“ping”), and once a request for a one-sentence greeting from Claude, so you can see that the key works. Neither contains anything from your screen or your chats.
• Technical details that Anthropic’s software kit adds to its requests: the name of your operating system, the processor type and software versions — no device identifiers.

When requests are sent

Almost every time you send a message. During a task, requests are also sent without a new message: before every step it shows you or types for you, and once more at the end, Open Horyzn takes a fresh screenshot and asks Claude about it.

It does the same when it needs to re-plan (for example after a wrong click or after opening a page), to check whether a step is still needed, and to read something off the screen. Only the check whether a page asks you to sign in is sent without a screenshot.

When a chat gets long, older messages are sent again to be condensed into a summary — in a long chat this can happen more than once. When you start a new task, the conversation of the previous one is sent once more to note what was achieved.

What you should know

• A screenshot shows whatever is in that window — including names, email addresses or other personal details that happen to be visible. Close or hide anything you don’t want to send before you ask.
• Email addresses are replaced by a placeholder in summaries, in the list of open tabs and in the text sent for a page check — there, key-like strings and the parameters of web addresses are removed too. Everything else is sent as it is: the screenshot, the words read from it, the address of the page you are working on, and your messages.
• Anthropic is a US company, and your requests may be processed in the United States. You send them yourself, with your own key and under your own agreement with Anthropic; we do not transfer this data, because we never hold it. How Anthropic handles your requests — including how long it keeps them — is set out in the terms you accepted when you created your API key.

Read Anthropic’s privacy policy↗

4. Your account and how you sign in

You need an account to use Open Horyzn. You can create it in two ways. Both run through Supabase, the service that hosts our sign-in system and our account database.

With email and password

• You give us your email address and choose a password. Supabase stores the password only in hashed form — we can’t read it.
• To confirm your address, reset your password or change your email, we send you an email with a code. These emails go out through Resend (Plus Five Five, Inc., San Francisco, USA), which receives your email address and the email itself in order to deliver it. The email with the code for the Windows waitlist (section 7) goes out the same way. Resend works for us as a service provider and processes this data in the United States, where it is certified under the EU–US Data Privacy Framework. Resend keeps a record of each email it delivers — recipient, subject line and content — for 30 days.
• If your mail app loads images, it fetches our logo from www.open-horyzn.com, which shows the host of that site your IP address (section 7).

With Google

• You sign in on Google’s own page. Google then tells us your name, your email address, whether Google has verified it, your Google account ID and the link to your profile picture. We get no access to your Gmail, contacts or files. We don’t display the picture; the app shows the first letter of your email instead.
• Google learns that you used your Google account to sign in to Open Horyzn. Google is responsible for that part itself, under its own privacy policy, and may process it in the United States. For users in Europe the service is provided by Google Ireland Limited; transfers to Google LLC in the United States are covered by the EU–US Data Privacy Framework, under which Google is certified.

In both cases

• Supabase stores your account: your email address, your name and the link to your profile picture if Google provided them, when the account was created and last changed, when you accepted our terms and which version, and the device code of your Mac with the time we first and last saw it (section 2).
• While you are signed in, the app tells us its version number — after you sign in, when it starts, with every message you send, and when you ask it to check again for an update (section 2). We store that number with your profile, together with the time it was last recorded, so that we can recognise outdated versions and require an update when one is needed (Art. 6(1)(b) GDPR).
• On your Mac, the app keeps you signed in with a session that is stored encrypted in the app’s own storage and renewed in the background.
• We use this data to give you access to the app and to your plan. We need it to provide the service you signed up for (Art. 6(1)(b) GDPR). The emails with a code for your account are part of that.
• We record when you accepted our terms, and which version, so that we can show what you agreed to (Art. 6(1)(b) and (f) GDPR).
• The logo in our emails is there only to display the email. The IP address it reveals is used to deliver the image and for nothing else (Art. 6(1)(f) GDPR).
• Every request from the app to Supabase also carries your IP address and technical connection data (section 2). They are used to run the service and keep it secure (Art. 6(1)(f) GDPR). Supabase’s sign-in service also records when you last signed in and, for each session, the IP address and the technical identifier of the app it was started from. A session entry is removed when you sign out or delete your account.
• Supabase processes this data for us as our service provider. Our project is hosted in the EU — in Ireland (region eu-west-1). Supabase, Inc. is a US company, so access from outside the EU can’t be ruled out. For that case Supabase’s data processing agreement applies, which is part of its terms and includes the EU Standard Contractual Clauses.
• Deleting your account in the app deletes your sign-in and your profile at Supabase straight away. What we keep after that, and for how long, is in section 8.

Read Supabase’s privacy policy↗

Read Resend’s privacy policy↗

Read Google’s privacy policy↗

5. Your plan and the monthly allowance

Open Horyzn is currently in beta and has two plans. Go is free and includes 50 messages and 50 pills each month. Founder is one payment and has no limits. To make the free allowance work, we count — on the Go plan only.

• On the Go plan, every message you send and every pill the app starts to show creates one entry: whether it was a message or a pill, the month and the time, linked to your account and to the device code of your Mac (see section 2). If no pill appears in the end — for example because the element wasn’t found — the app asks for the entry to be credited back; if that request fails, the entry stays.
• From these entries we keep a running monthly total per account and per Mac. The stricter of the two applies, so the free allowance can’t be reset by opening a new account on the same Mac. The total per Mac itself is stored under the device code only; each single entry also carries your account, until the account is deleted.
• On Founder nothing is counted. Before each message and pill the app still asks our server, with your account and the device code, whether you may continue.
• If our counting service can’t be reached, the app lets you continue instead of blocking you.
• Separately from this allowance, and on every plan, the usage counts from section 2 are stored with your profile: chats, messages, screenshots, tasks, active days and tokens.
• On every plan, the device code is kept with your profile, with the time we first and last saw it. You confirm this registration in the app when you create your account or first sign in on a Mac (section 2). An account can register up to ten Macs. It ties your account and your plan to your Mac.

Counting what the Go plan includes, and checking which plan you have, is part of our contract with you (Art. 6(1)(b) GDPR). Registering the device code and counting per Mac tie your account and plan to your Mac and protect the free plan against abuse; that is our legitimate interest (Art. 6(1)(f) GDPR). The usage counts help us understand how the app is used and improve it, which is also a legitimate interest. To work out the device code the app has to read the hardware ID on your Mac; it tells you this and asks you to confirm before it does so (section 2).

6. Payment

Open Horyzn is in beta. During the beta, Founder is offered at a beta price; plans and prices can change when the beta ends, and what you have bought stays yours. Payment runs through Stripe — for customers in Europe that is Stripe Payments Europe, Ltd. in Ireland. This is how it works:

• You enter your payment details on Stripe’s own page. We never receive your full card number.
• If you start the purchase in the app, the app sends the email address of your account to our website, and our website passes it to Stripe as the address for the checkout. That way the purchase reaches the right account; the address is already filled in and can’t be changed there. Nothing else from the app is sent for this.
• Stripe tells us what we need to run your plan: which plan you have, its status, the amount and currency, the card brand with its last four digits, the email address you entered at checkout, and Stripe’s reference numbers for the payment. We use the email address to connect the purchase to your account: the account with that confirmed address becomes Founder, whether you sign in with Google or with email and password. Founder is one payment and has no renewal date. The app shows you your plan under Payment status.
• Stripe also processes your payment details on its own responsibility — for example to prevent fraud and to meet financial regulations — under its own privacy policy.
• We need this to provide the plan you pay for (Art. 6(1)(b) GDPR).
• Where Stripe passes data to Stripe, Inc. in the United States, this is covered by the EU–US Data Privacy Framework, under which Stripe is certified, and by the EU Standard Contractual Clauses.
• If you delete your account, the plan entry we hold for you is deleted with it. Stripe keeps its own payment records as the law requires of it.
• We keep billing records for seven years from the end of the calendar year they belong to — longer only while a pending tax procedure needs them — because Austrian tax law requires it (§ 132 BAO; Art. 6(1)(c) GDPR).

Read Stripe’s privacy policy↗

7. This website

• No cookies, no tracking, no analytics. This site stores nothing in your browser and loads no fonts, videos or images from other companies.
• Like every website, our web host receives the technical data of each visit — your IP address, your browser, the page you open and the page you came from — to deliver the site and keep it secure (Art. 6(1)(f) GDPR). Our web host is Vercel Inc., a US company. Pages are delivered from the location of Vercel’s network nearest to you; the waitlist form is processed on a server in Frankfurt, Germany. Vercel works for us as a service provider under its data processing agreement, which is part of its terms and includes the EU Standard Contractual Clauses for data that leaves the EU. The request logs available to us are kept for at most one day.
• Downloading the app: the installer file is not stored on our website. When you press a download button, your browser fetches the file from GitHub (GitHub, Inc., 88 Colin P. Kelly Jr. St., San Francisco, CA 94107, USA; in Europe: GitHub B.V., Amsterdam). GitHub receives your IP address and the usual technical data of the request, such as date, time and browser. We don’t receive this data. GitHub is certified under the EU–US Data Privacy Framework.
• Windows waitlist: when you enter your email address and tick the box, we send you an email with a six-digit code. It is delivered by Resend (section 4), which receives your address and the email itself. The code is valid for 15 minutes. When the code is sent, the open page also receives a signature for your address that is valid for 15 minutes (an expiry time and a keyed SHA-256 hash — not the address itself). The page keeps it only in its own memory while it is open — not in a cookie and not in your browser’s storage — and sends it back with the code. You are on the list only once you have entered the right code.
• While you sign up, Supabase (section 4) holds a pending entry: your email address, a fingerprint of the code (a keyed SHA-256 hash — not the code itself), when the entry was made, when the code expires and when codes were sent, how many wrong codes were entered and how many codes were requested for your address, whether and when the code was used, the wording and version of what you ticked, and that you signed up on our homepage. A daily clean-up deletes the pending entry once it is more than 24 hours old — whether you confirmed or not.
• We ask for the code to make sure the address is yours — without it, anyone could sign up someone else. The signature is there so that a code is checked only for someone who requested one for that address. The counts limit how often a code can be tried and how many emails the form can send, so it can’t be used to guess codes or to flood someone’s inbox. For the same reason we keep two numbers per day: how many code emails went out in total and how many could not be sent. They contain no address and are deleted after 30 days. This is our legitimate interest in a waitlist that can’t be misused (Art. 6(1)(f) GDPR); you can object as described in section 8.
• Once you have confirmed, we store your email address, that you agreed, when you agreed and when you confirmed, the exact wording and version of what you agreed to (today: “One email about Windows. I agree to the Terms and the Privacy Policy.”), and that you signed up on our homepage. Your address, the code you enter and that signature pass through our web host; the entries are stored with Supabase (section 4). Apart from the email with the code, your address is used for that one email about Windows.
• If you have, or later create, an Open Horyzn account with the same confirmed address, we link the two entries, so that we can see who on the waitlist also has an account (Art. 6(1)(f) GDPR). Deleting your account removes the link, not the waitlist entry.
• You join the waitlist only with your consent (Art. 6(1)(a) GDPR), and you can withdraw it at any time by writing to office@open-horyzn.com. We then delete your entry. All other entries are deleted once the Windows email has been sent.

Read Vercel’s privacy policy↗

Read GitHub’s privacy statement↗

8. Your rights, how long we keep data, and complaints

Under the GDPR you have the right to:

• get a copy of the personal data we hold about you (Art. 15),
• have it corrected (Art. 16) or deleted (Art. 17),
• have its use restricted (Art. 18),
• receive it in a machine-readable format (Art. 20),
• withdraw any consent you gave, at any time and with effect for the future (Art. 7(3)).

Your right to object

Some of what we do rests on our legitimate interests: registering the device code and counting per Mac, the usage counts, the reports you send, the record of the terms you accepted, the confirmation code for the Windows waitlist with its signature and its counts, the link between a waitlist entry and an account, the logo in our emails, and the technical logs of Supabase and of our web host. You have the right to object to any of these at any time, on grounds relating to your particular situation (Art. 21 GDPR). We then stop, unless we can demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or the processing is needed for legal claims.

To use any of these rights, write to office@open-horyzn.com. You can also delete your account yourself in the app, and your local data in Finder.

We reply without undue delay, and at the latest within one month. If a request is complex, or we receive many, we may extend this by up to two further months; we will tell you so within the first month and explain why (Art. 12(3) GDPR). Using your rights is free of charge. If we are unsure who is asking, we may ask you to confirm your identity — for example by writing from the email address of your account.

How long we keep data

• On your Mac (chats, screenshots, logs, API key): until you delete it.
• Your account, your profile with the device code, the app’s version number and the usage counts, and your reports: until you delete your account — they are deleted with it.
• Message and pill entries (Go plan) and the monthly totals: 12 months after the end of the month they belong to. The single entries are deleted with your account at the latest.
• The monthly totals per Mac are kept under the device code even after you delete your account, for the same period, so the free plan can’t be reset by deleting and recreating an account.
• Billing records: seven years from the end of the calendar year (§ 132 BAO).
• Technical logs at Supabase: see section 2.
• Windows waitlist: the pending entry made while you sign up is deleted by a daily clean-up once it is more than 24 hours old, whether you confirmed or not. The two daily numbers about code emails are deleted after 30 days. Your confirmed entry is kept until you withdraw your consent — otherwise until the Windows email has been sent.
• Web host logs: see section 7. A waitlist entry is not deleted with your account.

Automated decisions

We don’t make decisions about you based solely on automated processing that have legal or similarly significant effects (Art. 22 GDPR). The monthly allowance of the free plan is a fixed rule, the same for everyone.

Do you have to give us data?

No law requires you to give us data. To use the app you need an account with an email address, and this Mac is registered with that account under its device code. If you buy Founder, Stripe also needs your payment details. These are requirements of our contract with you: without them we can’t provide the app or the plan. While you are signed in, the app also sends the usage counts from section 2; you can’t switch them off, but you can object to them. Reports and the Windows waitlist are optional.

Children

Open Horyzn is not meant for children. In Austria you can agree to the use of your data yourself from the age of 14 (§ 4(4) of the Austrian Data Protection Act). If you are younger, please don’t create an account and don’t join the waitlist; if we learn that a child under 14 has given us data, we delete it. Anthropic sets its own minimum age for an API key in its terms.

Complaints

If you think we handle your data unlawfully, you can complain to the Austrian Data Protection Authority (Österreichische Datenschutzbehörde), Barichgasse 40–42, 1030 Vienna, Austria, dsb@dsb.gv.at — or to the data protection authority in the EU country where you live or work.

Austrian Data Protection Authority↗

Changes to this policy

When the way we handle data changes, we update this page and the date below.

Last updated: 6 October 2026