Krystalize is a local-first AI platform. Your data — contacts, calendar events, emails, messages, crystals, files, credentials — lives on your own device, in a local SQLite database. We do not operate a server that stores your content, and we do not see it.
Krystalize is operated by Krystalize LLC ("we," "us," or "Krystalize").
Contact: privacy@krystalize.ai
This includes projects, tasks, contacts, crystals, notes, settings, and anything else you type or import. It is stored locally in ~/Library/Application Support/Krystalize/ (or your OS equivalent) and is not transmitted to Krystalize.
API keys, OAuth refresh tokens, passwords, and similar secrets that you add to Krystalize's Credential Locker or Agent Vault are encrypted at rest using authenticated encryption. They are never transmitted to Krystalize and never written to logs.
When you connect a service like Google Calendar, Microsoft 365, Apple iCloud, a Matrix homeserver, or an IMAP/CalDAV server, Krystalize authenticates on your device and exchanges data directly between your device and that service. Depending on what you connect, this may include:
This data is cached locally so the app can work offline and render quickly. It is not sent to Krystalize servers at any point. If you remove an account in the app, the local cache for that account is purged.
When you use Krystalize features that invoke a language model (chat with "Krys," agent runs, classification, summarization, etc.), the prompt and any relevant context are sent to the model provider you configured — for example, Anthropic for cloud Claude, or the local oMLX / Qwen model that runs entirely on your machine.
Krystalize does not store transcripts of these exchanges on any server we operate.
If you enable update notifications, Krystalize checks our release endpoint for new versions. This request may include your app version and OS version so we can serve the correct build. It does not include your name, email, or any content.
Crash reports are not collected automatically. If you choose to send a bug report via the in-app form, only the content you include is transmitted — we do not sweep logs or capture your screen.
When you connect Google Calendar (or any other Google service) to Krystalize, you authorize Krystalize to read and modify data in the scopes you grant. Krystalize's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
Specifically:
You can revoke Krystalize's access to your Google account at any time at myaccount.google.com/permissions. Revoking access on Google's side will cause syncing to stop; the local cache remains on your device until you remove the account in Krystalize. Equivalent revocation paths exist for Microsoft (account.microsoft.com) and Apple (appleid.apple.com).
Krystalize is not directed to children under 13, and we do not knowingly collect information from children under 13.
Krystalize's security practices include:
No system is perfectly secure. If you suspect a security issue with Krystalize, please email security@krystalize.ai.
~/Library/Application Support/Krystalize/. This removes all local data.Depending on where you live, you may have rights under local law — for example, access, correction, deletion, or portability of personal information. Because Krystalize does not hold your content on our servers, most of these rights are exercised by you directly on your device (delete the app, remove an account, etc.). For any right that requires action on our end — such as confirming what we hold about your account registration — email privacy@krystalize.ai.
We do not sell personal information as "sale" is defined under the California Consumer Privacy Act or any analogous law.
We will update this page when the policy changes and revise the "Last updated" date. For material changes, we will notify active users in-app before the change takes effect.