Who we are
Sightwell for iPhone and iPad and Sightwell for Mac ("the apps") are published by MINICLOUD-FZCO ("MINICLOUD", "we").
What this covers
This policy covers the apps. It doesn't cover your organisation's Sightwell server or its web apps, which your organisation runs or has MINICLOUD run for it, or the sightwell.ai website, which has its own website privacy notice.
In short
- No analytics, no advertising, no crash-reporting service, no tracking.
- The apps connect your device to your organisation's Sightwell server and to your organisation's sign-in service. Where MINICLOUD runs the server for your organisation, and for the demo, MINICLOUD receives what that server receives.
- The Mac app checks for updates and downloads them from GitHub.
- Nothing goes to NetBird GmbH, whose open-source software the apps are built on.
- Logs stay on your device until you choose to share them.
iPhone and iPad: what leaves your device, and where it goes
| Recipient | What | Why |
|---|---|---|
| Your organisation's Sightwell server (run by your organisation, or by MINICLOUD for your organisation) | Your account's email address and user ID; the device's public encryption key; a random device name such as iPhone-7F3A or iPad-7F3A (not the name you gave your device); IP address; iOS version; app version; connection status. | To register the device, connect it, and apply your organisation's access rules. |
| Your organisation's sign-in service (for example Microsoft Entra ID) | Whatever you enter to sign in, and what that service requires, such as multi-factor approval or device compliance. | To prove who you are. Your organisation's agreement with that provider applies. |
| Microsoft, when your organisation turns on Microsoft sign-in for the app | The Microsoft Authentication Library (MSAL) in the app, and Microsoft Authenticator if installed, send sign-in data to Microsoft Entra ID: your name, email address, user and device identifiers, and diagnostic data. | To sign you in with your organisation's Microsoft account. Your organisation's agreement with Microsoft applies. |
| The demo server, run by MINICLOUD (only if you use Try the demo) | A request for the list of demo roles, which shows the server your IP address; then the device's public encryption key, its random device name, IP address and iOS version when the device joins the demo. No account and no personal details. | To run the Alder Cove Energy demo. |
| Other devices and relay servers in your organisation's network | The network traffic you send to them, end-to-end encrypted with WireGuard. | To reach the systems your organisation makes available to you. |
| Apple | Apple handles App Store downloads and the device's VPN system under Apple's own privacy policy. | To install and run the app. |
The app doesn't route your general internet traffic. Only traffic to your organisation's network goes through the connection.
The App Store privacy label
The iPhone and iPad app's App Store page lists these data types as linked to you and used for app functionality: name, email address, other user contact info, customer support, user ID, device ID and other diagnostic data. It lists phone number as not linked to you, also for app functionality. These are the types Microsoft declares for MSAL, the sign-in library above, and they also cover what your organisation's server receives. None of them is used for tracking.
Who is signed in
When you're signed in, the iPhone and iPad app shows your name, email address and, if your organisation sets one, your role and picture.
- Name and email address come from your organisation's server or from Microsoft sign-in. The app keeps them on your device with the profile and sends them nowhere else.
- Role is set by your organisation's administrator. The app keeps it on your device with the profile and removes it when you sign out or remove the profile.
- Picture comes from your organisation's server through the connection. The app only shows it: it is never saved, logged or sent on, and it is cleared when you disconnect, switch profile or sign out.
Mac: what leaves your Mac, and where it goes
| Recipient | What | Why |
|---|---|---|
| Your organisation's Sightwell server (run by your organisation, or by MINICLOUD for your organisation) | Your account's email address and user ID; the Mac's public encryption key; the Mac's computer name, as set in macOS; its serial number, model and manufacturer; macOS and kernel version; processor type and number of processors; the addresses of its network interfaces, including their hardware (MAC) addresses; IP address; app version; connection status; and which Sightwell settings are turned on. If your organisation uses device checks: whether files or programs it names are present or running on the Mac, and proof that the Mac holds a certificate your organisation issued. | To register the Mac, connect it, and apply your organisation's access and device rules. |
| Your organisation's sign-in service (for example Microsoft Entra ID) | Sign-in opens in your web browser. What you enter there, and what that service requires, such as multi-factor approval, goes to that service. | To prove who you are. Your organisation's agreement with that provider applies. |
| GitHub, where MINICLOUD publishes the Mac app | When the app checks for updates, and when you download or install one: your IP address, the app's user agent, and which file is requested. | To tell you about updates and deliver them. GitHub's own privacy statement applies. |
| Other devices and relay servers in your organisation's network | The network traffic you send to them, end-to-end encrypted with WireGuard. | To reach the systems your organisation makes available to you. |
| Apple | macOS checks the app's signature and notarisation with Apple under Apple's own privacy policy. | To confirm the app is genuine. |
The Mac app talks only to your organisation's Sightwell server and its relays, apart from the update check above. It never contacts NetBird's cloud service, and it never sends metrics or debug bundles to NetBird.
What stays on your device
- Profiles, server addresses, the device's encryption keys and settings.
- Logs. They leave the device only when you share them yourself: on iPhone and iPad through Settings › Troubleshoot and the share sheet; on Mac by sending a bundle you create in Settings › Troubleshoot. See Share logs.
- On iPhone and iPad, deleting the app removes its data and its VPN configuration.
Your organisation's server
Your organisation decides what its Sightwell server records, such as connection events, and how long it keeps it. For questions about that data, contact your organisation.
Your choices
- Disconnect at any time.
- Sign out of a profile, or remove the app.
Contact
Questions about this policy: privacy@sightwell.ai.
Last updated: 31 October 2026