GroundSlate Privacy Supplement

Last updated: 18 September 2026

This supplement describes what the GroundSlate application does with your information. It sits under the COEY Privacy Policy, which covers COEY as a company: the coey.com website, your account, your licence, payment, and your rights. Read that policy first. Where this supplement is silent, the policy applies.

Published by Royler, LLC, d/b/a COEY, Florida, USA.

The short version

GroundSlate runs on your Mac, and COEY does not receive your content. Your videos, photos, audio, transcripts, scene descriptions, notes, the people catalog and the face data behind it are stored on your own computer and on storage you control. There is no cloud library and no sync.

The app collects no analytics. It contains no analytics, telemetry, crash-reporting or usage-tracking software of any kind. COEY cannot see how you use it or what you index. The only things that tell us a Mac is running GroundSlate are the licence check in section 2 and a benchmark you choose to send, and neither carries anything about your library.

It sends your licence, and a benchmark if you send one. GroundSlate needs a key to run, free keys included. Section 1 of the COEY Privacy Policy lists every field that request carries, and section 2 of this supplement lists every field a benchmark carries. Nothing about your library is in either, and once activated the app does not need a network connection to work.

Generation is on-device by default. Images, video, music, sound effects and synthetic speech are produced by models running on your Mac. Your description and the result are not sent to COEY. If you turn on Provider keys and register a third-party API, your assistant can ask GroundSlate to call the hosts you registered. GroundSlate stores the key and attaches it to the request here on your Mac: the key is not passed to the assistant, and GroundSlate scans what the provider sends back, headers included, and refuses to hand over a reply that carries it. That provider receives the request body, and on this path a request body may be a photo, video or audio file from your library: your assistant names one by its id and GroundSlate opens it and sends it, so your own footage can be what goes out. It is the hosts you registered that receive it, and a size limit you set in Settings bounds how large a file may be. That path stays off until you enable it.

The app does make other network connections, all of them either part of one-time setup or something you explicitly ask for. Sending a benchmark is the second of those, and only the second: it happens when you press Send to COEY in the Benchmark window, which is showing you the record it would send, and never on a timer, at launch, or as a side effect of anything else. They are listed below, with who is on the other end.

1. What stays on your Mac

All of the following is written to your own disk and never transmitted to COEY:

• your media files, and any clips, reels or renders GroundSlate produces from them;
• the catalog it builds, transcripts, scene and shot descriptions, captions, titles, GPS coordinates and timestamps read from your files;
• the people catalog, including face detections, face crops and the numeric face signatures used to group them (see §4);
• events, projects, relationships, notes, watch-folder paths and your settings;
• a local token ledger (token_ledger.jsonl in the profile Data folder) recording how many tokens the on-Mac vision and reasoning models used, per call, attributed to a clip, event or project when one is in scope. Monitor reads it, and the token_usage tool can report figures from it to a connected assistant when you ask. GroundSlate does not transmit the ledger anywhere itself, and nothing in it reaches COEY.

Deleting the app's data folder deletes this. Deleting a profile inside the app archives it instead, as section 6 explains. We hold no copy and cannot recover it for you.

2. What the app sends to COEY

What your Mac sends when it activates, which is this and only this:

Getting a key in the app. A Mac without a key asks for your email address instead of sending you to the website. The app sends that address to COEY (with the machine identifier, machine name and app version, which the code request does not use), and COEY emails you a six digit code. When you type the code in, the app sends the address and the code with the activation fields above in place of a key, and COEY finds the licence for that address, or creates a free one, activates this Mac and returns the key to it.

What COEY keeps for this, and for how long:

• the code record: your email address, the code as a keyed hash (never the code itself), when it was sent, when it was used and how many wrong tries it has had. A daily scheduled clean-up deletes it within two days of the code expiring.
• rate limit records: a digest of your IP address (not the address itself), and hashed counters per email address of how many codes were sent and how many wrong codes were tried, which is what stops one address being flooded with codes or guessed at. The same daily clean-up deletes each within two days of the last moment it counts toward a limit.
• the licence record for the address, which is what every key is, kept like any other licence.

A copy of the key is emailed to you only when a new free key is created for your address; a code works once. If you paste a key instead, no email address is sent.

The same request repeats occasionally to check the licence is still current, at most weekly, and only while the Licence screen is open. The app does not need a network connection to run. The answer is stored on your Mac along with the date it should next be checked, so an activated Mac works indefinitely offline and a failure to reach us never takes anything away. The app also writes that answer, whether renders carry the COEY mark, and the library, watch-folder and profile ceilings, to one small local file (~/.groundslate/entitlement.json) so its own on-Mac server can obey the same licence. That file holds no key and no identifier, and it never leaves your Mac. It is plain text, and the server obeys whatever it says: we do not sign it or hide it, because a licence enforced on your own Mac cannot be stronger than your own account, and the stored answer in the app is in the same position. Editing it to widen what your copy does is the circumvention the licence agreement (§5.2) forbids; a missing or damaged file only ever narrows the app to the free tier, never the other way.

What a benchmark carries, if you send one. GroundSlate can measure how fast it runs on this Mac by timing itself at the kinds of work it does: transcoding, rendering a page, speaking a line, applying a voice effect, captioning a still, and generating video on a Mac that meets the floor for it. The Benchmark window names every one it will run, for the tier you picked, before you start it, so that list is the window's to tell you and not this document's to go stale about. Every input it reads ships inside the app and is the same on every Mac, which is what makes a figure from your Mac comparable with a figure from another one. Your library is not read, not written, not counted and not named for it. The run happens when you choose it from the app menu, and it is sent when you press Send to COEY in the Benchmark window, which shows you the whole record first.

A benchmark is anonymous unless you attach it, and anonymous is the default. An anonymous record carries no licence key and no machine identifier, so nothing in it can link two runs from this Mac, and nothing adds either field afterwards. The sentence above the send button names your licence and this Mac's identifier when the account link is on, and does not when it is off. A run you sent anonymously keeps a secret in its local record file, which is what withdrawing it on coey.com takes; an attached run is withdrawn from your account page.

No path, no name, no count. A record holds no file name, no folder, no machine name, no user account name, and nothing from your library: no clip identifiers, no counts of media, people, events or projects, no profile ids, no watch folders and no folder grants. Section 1 of the COEY Privacy Policy lists the same fields from COEY's side, and section 6 of that policy says how long a record is kept.

Update checks carry no identifiers. Once a day, GroundSlate asks coey.com for a list of released versions, the same file for everybody, with nothing about you in the request. This is on by default so fixes reach you, and the Licence window has the switch that turns it off.

3. Network connections the app makes

None of these sends your media files or your catalog to COEY. The one row that carries catalog data at all is the Apple Maps row, which sends the coordinates of the clips on the screen you have open. Each destination is a third party with its own privacy policy, and each necessarily sees your IP address and the fact that a request was made.

Place names: partly offline, and partly Apple. Location history is among the most sensitive things a video library contains, so this is worth stating precisely rather than simply.

The catalog resolves a coordinate to a place name offline, against a GeoNames dataset bundled inside the app. That is what indexing uses, and what your assistant gets when it asks for a place. Nothing leaves your Mac for it.

The map and place screens in the app are different. When you open Events, a project map, a person's map, or the Adjust Location sheet, GroundSlate asks Apple to turn coordinates into place names and to draw the map, using macOS's own Maps services. Apple receives the coordinate, under Apple's privacy policy, exactly as it would from any Mac app that draws a map. Answers are cached on your Mac, so the same place is not asked twice.

The browser tools answer to you, not to the assistant. Web capture ships switched off. When you switch it on, in the app under Data then Browser, it still follows your site policy: block every site, allow every site, or a list you keep. Only you can change any of that; the assistant can read the policy and ask you to allow a site, and nothing it says moves the switch. If a page redirects somewhere your policy does not permit, the capture is discarded rather than handed over. A capture uses a throwaway session by default and leaves nothing behind. A window you sign into keeps that session on your Mac, so a later capture can use it if you ask; cookie banners are refused, never accepted, in your name. Each of these doors refuses addresses inside your own network, and checks again after a redirect rather than only on the address you supplied.

4. Faces and biometric data

GroundSlate can detect faces in your media and group them into people. Detection and recognition run entirely on your Mac, using models that ship with the app. Face crops and the numeric signatures used for matching are stored in your profile folder.

COEY never receives this data. We are not a processor of it, because it never reaches us.

Under laws including the EU/UK GDPR, the Illinois Biometric Information Privacy Act and the Texas CUBI, this information may be biometric data, and you are its controller. If you index footage containing other people, the obligations are yours: notice, consent where required, honouring their requests, and retention limits. Section S2 of the GroundSlate Schedule to the COEY Master Terms sets this out in full.

Media downloaded from the web is not face-recognized unless it is asked for, and asking is a deliberate act. When your assistant pulls a file off a web page (fetch_asset), recognition is off by default: no face in it is matched against your catalog, and no person is created from it automatically. That is deliberate, researching a company should not add the strangers on its news page to your library as people. Turning it on, per file, is available to your assistant and to you in the app, and both doors warn first that recognition can create people from faces it does not know and that those people remain in your catalog after the clip is gone. The choice is recorded with the file, so a later re-index cannot quietly change it.

You can still name one person in such a file by hand, draw a box round a face, type a name, and that is the point of the default rather than a hole in it: what is switched off is the automatic pass that would match and mint everyone. A person you name that way is created, like any person you name anywhere, and the file's receipt records that it happened.

Media your assistant generates is never face-recognized at all, by any door, manual or automatic. A synthetic face folded into a real person's group would be impossible to unpick afterwards, so this one is not a default that can be turned off.

GroundSlate gives you the tools to act on such a request: a person can be renamed, merged, quarantined, forgotten or permanently deleted, and their media removed. Export of the people catalog is protected by an encrypted, code-gated bundle that only you can initiate. It is not available to an AI assistant at all, and the tools an assistant calls strip face vectors and crop paths out of their answers. Those files still sit in your profile folder as ordinary files, so an assistant with file access of its own, or a tool that takes a path, can still reach them.

5. Your AI assistant is a separate service

GroundSlate's main purpose is to let an AI assistant (Claude, ChatGPT, Cursor or another MCP-capable app) search your library and produce videos. That assistant runs outside GroundSlate, under its own provider's terms and privacy policy.

Whatever you ask your assistant, and whatever it retrieves from GroundSlate in order to answer, goes to that provider. That can include clip titles, transcript text, place names and people's names. GroundSlate does not control, see, or log what the assistant sends onward.

If that matters for particular footage, keep it in a separate profile, or don't ask an assistant about it. Deciding what to expose to a third-party assistant is yours to make, and it is the most consequential privacy decision in using this product.

6. Retention of your library

Your data stays until it is removed. Library media you delete, or that you ask your assistant to delete, moves to Deleted Media, where it stays and can be restored, and only you can destroy it permanently. Nothing destroys it on a timer. Your assistant can move media there and nothing more: permanently destroying a clip is deliberately not available to it, and happens only when you do it in the app, where you can see what you are destroying. Other files an assistant can reach, including Scratch Outputs and stored assets, it can delete outright when you ask it to. Deleting a profile archives rather than destroys it, so you choose when it is gone for good.

What COEY holds about you, and for how long, is in section 6 of the COEY Privacy Policy. None of it is your library.

7. Security

GroundSlate is signed with a Developer ID certificate and notarized by Apple, so macOS can verify it has not been tampered with. Downloads it performs during setup are checked against a pinned cryptographic hash before use.

Stated plainly: the people catalog and face thumbnails are stored as ordinary files on your disk. GroundSlate does not add encryption of its own. It restricts those files to your user account, and their protection at rest is your Mac's full-disk encryption, FileVault, the same protection other professional media applications on this platform rely on for their libraries.

We check whether that protection is actually there, and tell you when it is not. MCP Connect, under Security, reports one of three things: your library is protected by FileVault; FileVault is off, and anyone who takes this Mac can read the faces and names in it; or your library sits on another drive, which FileVault does not cover and which needs its own encryption. That last case is the one worth watching, because moving a library to an external disk is something GroundSlate actively helps you do.

No at-rest protection, ours or the operating system's, covers your Mac while you are signed in.

8. Changes

If this supplement changes materially COEY will update the date above and the version marker at the top of this file, and note the change in the release that carries it. The supplement that applies to you is the one in effect for the version of GroundSlate you are running.

9. Contact

COEY, Royler, LLC · privacy@coey.com · legal@coey.com