Legal
Trama is a macOS application that lets you create automations using plain language. It is operated by JOAO ERNANDEZ CAVALHEIRO DE OLIVEIRA DESENVOLVIMENTO DE SOFTWARE LTDA, registered in Brazil under CNPJ 62.392.327/0001-03, with its address at Rua Doutor Arlindo Luz, 540, Sala 01, Centro, Ourinhos – SP, CEP 19900-011, Brazil ("we", "us", "our"), which is the controller of the personal data described in this policy. You can reach us at support@usetrama.com.
Account information. When you sign in via GitHub or Google, we receive your email address, display name, and avatar URL from your OAuth provider. We store this to identify your account and personalise your experience. An account is required to use Trama. We also store your plan, subscription status and billing dates, and when you last opened Trama while signed in and which version of the app it was.
Waitlist. If you join the waitlist on this website, we collect your email address, the job and the task you tell us about, and a short tag for where you found us (for example a referral link). We use this to invite you to Trama, to send the related emails, and to understand what people want to automate. Product news we send to the waitlist includes a one-click unsubscribe link, and you can ask us to delete your waitlist entry at any time.
Automations and execution logs. Your automations and their full run history live only on your Mac, in the Application Support folder. We never store what your workflows do — no prompts, scripts, URLs or input values — nor the content they process. Moving to a new Mac is handled by macOS Migration Assistant, Time Machine or the export in Settings, not by our servers.
Automation suggestions. To suggest automations that fit how you work, Trama notices a few patterns on your Mac. What it records stays on your Mac, in the Application Support folder, is kept for at most 14 days, and is never sent to us. By default it notes only the kind of thing you copy — a link, a table, code, the language of a text — never the copied text itself, and it ignores anything a password manager marks as private. Under Settings → Suggestions & Privacy you can turn that off, and you can turn on, each separately: which apps you bring to the front and when; which recognised work sites (such as Gmail or Google Sheets) are open in your browser, keeping only the site's name, never the address; and how many meetings your calendar has each week, never their titles or attendees. If you also turn on AI ideas (off by default), a short summary of these patterns — app and site names, on how many days you used them and at what time of day, never any content — is sent to the AI provider you configured so it can propose automations; Settings shows the exact lines. Choosing See how it'd look on a suggestion sends the text you just copied to your AI provider, as running an automation would.
Usage data. We keep a daily counter of integration steps per account, reset at midnight UTC, to enforce plan limits. Run records (described under Diagnostics below) are what the admin side of Trama uses to see that the product works. The app contains no analytics or advertising trackers. This website uses Vercel Web Analytics, which counts page views in aggregate without cookies and without tracking you across sites.
Where you came from. On your first visit, this website sets one first-party cookie, trama_src, for 90 days. It holds the website that linked you here (its domain only), any campaign tags in the link (such as utm_source), the page you landed on and the date — nothing that identifies you, and it is never read by other websites. We read it when you click Download, to count downloads per source together with your country as reported by our hosting provider, and when you create an account, to record which source the account came from. We do not store your IP address for either. If the account is created in a browser without this cookie, the app may ask, once and optionally, how you heard about Trama. You can delete the cookie in your browser at any time; the site works the same without it.
Billing data. If you subscribe, payment is processed by Stripe. We store your Stripe customer ID. We never see or store your full card number.
Diagnostics and error reports. Trama shares diagnostic data with us so failures get found and fixed. This is on by default; you can turn it off at any time under Settings → Diagnostics, and with it off nothing described in this paragraph leaves your Mac. While it is on:
Problem reports. When you use Report a problem in the app, we receive what you wrote, your app and macOS version, and, if you choose to attach it, the failed run. Unlike a run record, an attached run can include the input the run received and the output it produced, so we can see what went wrong; values recognised as secrets are removed and long text is truncated before it is sent. Because you are asking us for help, a problem report is sent even when diagnostics sharing is off.
We send email through Resend. Service emails — such as your waitlist confirmation, your early access invitation, and messages about your account, security or billing — are sent because they are part of the service you asked for. Product and lifecycle emails — tips, check-ins after you start using Trama, requests for feedback, and product news — are sent to account holders and waitlist members. Every product or lifecycle email includes a one-click unsubscribe link; once you unsubscribe we stop sending them to that address, and service emails are not affected. Stripe may also email you payment receipts directly.
Trama's core feature is using AI to build and run your automations. This means the content you describe — and, when an automation runs, the clipboard text or other inputs it processes — may be sent to an AI provider.
Trama works with your own AI provider API key. Calls go directly from your Mac to the provider you configured — Anthropic, OpenAI, Google Gemini, Groq, or any OpenAI-compatible endpoint you point it at — and never pass through our servers. Content you process is subject to that provider's privacy policy.
Steps that use an integration — for example reading Gmail, creating a calendar event, or posting to Slack or Notion — are executed by our servers, which pass the content the step needs to that service. This content is processed in memory for the duration of the step and is not stored.
We do not use your content to train AI models, and we do not store the text your automations process. The only text from a run that reaches us is the secret-redacted error message of a failed run while diagnostics sharing is on, or a failed run you choose to attach to a problem report.
If you connect a Google account, Trama requests only the scopes needed by the automation steps you use:
Google user data is used only to execute the automations you configured. It is never used for advertising, never sold, and never used to train AI models. Message text and other Google content are processed in memory for the duration of the run and are not stored on our servers — the only exception is the secret-redacted error message of a failed run, as described above, and only while diagnostics sharing is on.
When an automation processes Google content with AI, that content is sent to the AI provider you configured with your own key, as described above — solely to complete the request you configured. Those providers do not use API content to train their models.
Trama's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
You can revoke Trama's access at any time by disconnecting the integration inside the app, or from your Google Account permissions page.
We do not sell your personal data to any third party.
Kept on your Mac. Your own AI provider API keys (BYOK) and your Trama session token are stored in the macOS Keychain, which is encrypted and protected by your Mac's security architecture. BYOK keys are never transmitted to our servers.
Kept on our servers. When you connect an integration such as Google, Slack, or Notion, the OAuth access and refresh tokens that provider issues are stored server-side in Cloudflare Workers KV, isolated per user account. They need to live there so scheduled automations and triggers can run while the app is closed. Disconnecting an integration in Trama deletes those tokens immediately, and deleting your account removes all of them.
Your account data, run records and error reports are retained while your account is active. Waitlist entries are kept until you ask us to delete them. If you unsubscribe, we keep your email address on a suppression list so we can keep honouring that choice. If you delete your account, all server-side data associated with your account is permanently deleted within 30 days. On-device data (automations, local logs, cached files) is removed when you uninstall the app.
Depending on where you live — including under the LGPD (Brazil), the GDPR (EEA/UK), and comparable laws — you may have the right to access, correct, or delete your personal data; restrict or object to processing; and data portability. To exercise any of these rights, email us at support@usetrama.com and we will respond within 30 days.
Trama is not directed at children under 13. We do not knowingly collect personal data from anyone under 13. If you believe a child has provided us with personal data, please contact us and we will delete it.
We may update this policy from time to time. We will update the "Last updated" date above and, for material changes, notify you via email or an in-app notice. Continued use of Trama after changes take effect constitutes acceptance.
Questions or concerns about this policy? Email us at support@usetrama.com.