Privacy Policy

Last updated: 9 November 2026

The short version. Maurice can live in two places. On a server you run yourself, your data stays there and we never see it. On a Maurice we host for you, your data is kept on servers we operate in Paris, to run the service and for nothing else: we do not sell it, we do not use it for advertising or to track you, and the apps carry no analytics.

Who we are

Chez Maurice, the Maurice app (iPhone, iPad, Mac, Android, Windows and Linux), the Carnet app (iPhone, iPad, Android, Windows and Linux), the “Save to Carnet” browser extension and the hosted Maurices at *.chezmaurice.eu are published and operated by Palacehotel Software SRL, avenue Rogier 351, 1030 Schaerbeek, Belgium, company number 0894.341.777 (“we”, “us”). For a hosted Maurice, we are the controller of the data described below. Contact: bonjour@chezmaurice.eu.

What the apps connect to

The apps and the browser extension talk to one place: the server of the Maurice you joined, at the address you entered or that your invitation named. That is either a server run by you or someone you know, or a Maurice we host. The apps send nothing to us otherwise. They contain no analytics, advertising, tracking or third-party telemetry SDKs, and they do not track you across other companies’ apps or websites.

The browser extension. “Save to Carnet”, the extension for Chrome, Firefox and browsers of the same family, works like the apps: it talks only to the server of the Maurice you connect it to, at the address you enter, and to nothing else. It reads a page only when you click its button, and sends that page — its text, title and picture — with your note to that server. When you dictate a note, the recording goes to that same server to be written down. The session it holds is stored in your browser, on your computer only, and is not synced. The extension contains no analytics or tracking, and we receive nothing from it.

On a server you run yourself

Everything — conversations, notes, files, books, mail you let Maurice read — is stored on that server, under the control of whoever runs it (the “operator”). We have no access to it and receive nothing from it. The operator decides which AI providers it uses and is responsible for it; this policy describes how the software behaves, not what an operator does with it.

On a Maurice we host

We store, on servers rented from Scaleway in Paris (France), what your Maurice needs to work:

Your account: at sign-up, your Maurice’s name, a first name and an email address; members’ names, avatars, roles and hashed PINs or passwords. If you subscribe or top up on our website, payment is handled by Mollie B.V. (Amsterdam, the Netherlands), an electronic money institution licensed by De Nederlandsche Bank, which acts as an independent controller of the payment data (its privacy statement). If you subscribe or top up in an app, payment is handled by Apple (App Store) or Google (Google Play), each an independent controller of the payment data under its own privacy policy. In every case we never see your card number or your bank account’s details: we receive what was bought, when, whether a subscription is running or was refunded, the price paid (from Mollie and Apple), and an identifier that ties the purchase to your Maurice — not your name or your Apple or Google account.
What you create: conversations with Maurice and with other members, your notes (your “garden”), entries and highlights, the files and images you upload, the books in your Maurice’s library and your reading positions.
Your mail, only if you connect a mailbox: the mailbox password, sealed with a key specific to your Maurice and never shown to anyone; the headers of your messages (sender, recipients, date; subjects are sealed); and, only after you say yes, what Maurice reads in the messages and the notes he writes from them in your garden. Message bodies stay in your mailbox. Address books you connect are read the same way.
What it costs: for each reply, the model used and its cost, so that your Maurice’s budget can be kept.
Technical logs: requests, timings and errors, kept on the server to keep it running.
Counters we read to run the service: every few minutes we ask each hosted Maurice for figures, never content — how many members it has and how many wrote this week, on how many days of the month someone wrote, how many conversations and how many messages they ran to, what its AI models cost per day and per model, its software version, disk space used and free, and error counts by type; and what it is made of and uses: how many admins, members, guests and children, how many mailboxes are connected and how many messages Maurice has listed and read, how many conversations were imported from Claude or ChatGPT, how many notes are public, whether its garden is cloned with git, which interface languages its members use, and which kinds of devices, models and system versions its apps run on. They keep the budget, show us when a Maurice is down, and tell us how the service is used. No name, no message, no note leaves your Maurice this way.

Backups of a hosted Maurice are encrypted and kept on Scaleway’s storage in France for up to twelve months. A paused Maurice keeps its data so that it can resume where it stopped.

We do not read your conversations, notes or mail. The people who run the service can technically reach the servers; that access is used only to keep the service running and secure, at your request, or when the law requires it.

If you ask for access

The form on account.chezmaurice.eu/invitation keeps your first name, your email address, what you choose to tell us about who would live in your Maurice, the link that brought you there and your connection’s address (to limit abuse). We use them only to answer you and send you an invitation code; we are mailed each request, sent through Scaleway’s transactional email service, in France. They are deleted a year after your last request, or sooner if you ask.

AI models and other services

Your consent comes first. Before anything you write reaches an AI provider, the Maurice app names the providers your Maurice uses, where they process your data and what is sent to them, and asks you to accept or decline. If you decline, nothing of yours is sent to them: Maurice does not answer you and no background work is done on your data. A model that runs on your Maurice’s own machine needs no consent, since nothing leaves it. A provider added later is asked about again. You can change your answer at any time in the app, under Settings → My data → AI providers. Maurice is an AI, and his answers can be inaccurate.

Models. To answer, the server sends the conversation’s content, and what you chose to load into it, to an AI model. On a hosted Maurice that is Scaleway’s Generative APIs, in Paris, which process it to answer and do not keep it to train models. On a server you run, it is the provider its operator configured (for example Anthropic, OpenAI, Mistral or Scaleway), or a local model.
Background work — summaries of books and articles, what Maurice keeps on the parts of your life he follows, reading your mail when you asked — goes to the same kind of model, in your Maurice’s name.
Imported conversations (from ChatGPT or Claude) are stored on your Maurice’s server and go to the same model to be indexed and read at night; the app asks you before each import.
Web search is not available on a Maurice we host. On a server whose operator enables it, the search query is sent to Tavily (United States), which returns results and a short answer of its own; it is offered only to members who accepted that provider. Maurice does not generate images: no image description is sent to any image service. Catalogue lookups (a book’s cover, a film’s year) send the title looked up, not your notes.
Push notifications: on Apple devices, Apple gives your device a token, which the app registers with your Maurice’s server so that Apple’s Push Notification service can deliver notifications. On Android, notifications go through UnifiedPush and the distributor app you choose (for example ntfy, or one that relays through Google’s service): the app registers that address with your Maurice’s server, and each notification is encrypted for your device alone, so the distributor carries it without being able to read it. The apps on Windows and Linux receive no push notifications.

On your device

The apps keep your session credentials in the system Keychain, and your preferences and offline copies (books, articles, lists) in their own storage. Dictation is turned into text on the device. When the device cannot do it for your language, the Maurice app asks before using Apple’s speech service, or sends the recording to your Maurice’s server only if that server transcribes it on its own machine. You can also choose, in the app’s settings, to have your Maurice’s server transcribe every dictation: on a Maurice we host, the recording then goes to Scaleway’s speech-recognition model (Whisper, Generative APIs, Paris), and only once you have accepted that provider. The recording is not kept after it is transcribed. Carnet does not use your location.

On Android, the apps keep your session credentials sealed with a key held by the Android Keystore, and do not let the system back up their data; on a device whose Keystore fails, the credentials stay in the app’s private storage, out of other apps’ reach. On Windows and Linux, they are kept in a file in your user configuration folder that only you can read. On Android, Windows and Linux the apps do not recognise speech on the device: a dictation is always sent to your Maurice’s server to be transcribed, on the same terms as above, and is not kept afterwards.

Where you get the apps. If you install them from the App Store or Google Play, Apple or Google handles the download under its own privacy policy. On Android you can also install them without Google, from our release pages on GitHub (directly or through an app such as Obtainium); those builds contain no Google code at all.

Who else sees your content

Your private conversations and your garden are yours. What you post in a shared room is seen by the members of that room; a note or an entry you share is seen by the members you shared it with; a note you publish is public. Messages reported in a shared room go to your Maurice’s operator for moderation. When you report one of Maurice’s replies, in any conversation, a copy of that reply and of your message just before it goes to the person who runs your Maurice; the rest of the conversation stays private, and the app tells you so before you send.

Children

A Maurice is set up by an adult, who may add children as members. A child has no public pages and Maurice proposes nothing to them on his own. Their data belongs to that Maurice, under the adult who runs or holds it.

Your rights

In the Maurice app, Settings → My data lets you export everything your Maurice holds about you, erase it, or delete your account; Carnet offers Delete my account in its member sheet. Erasure reaches everything on the server; encrypted backups age out within twelve months. You can also write to us to access, correct, export or delete your data, or to close a hosted Maurice. You may complain to the Belgian Data Protection Authority (dataprotectionauthority.be).

Changes

If this policy changes, the updated version will be posted here with a new date.

Contact

Privacy questions: bonjour@chezmaurice.eu. Safety reports: safety@chezmaurice.eu.

Chez Maurice is open-source software. The source code is licensed separately (see the project repository); this policy concerns how the apps and the hosted service handle your data, not the terms of the source code license.