Your words stay with you

Suggestions are created locally

Klaavi learns the way you write on your computer. Suggestions, personalization history and your personal dictionary all work locally. We do not send sentences to the cloud to analyse them or generate suggestions there.

Figures shown in the application, such as clicks saved, are calculated locally. Klaavi does not continuously report what you click, how long you type or which words you use.

What you type in other applications helps Klaavi work locally — it is not used to build a language profile on our server.

Every connection has a specific purpose

Klaavi does not need the internet for typing itself. It connects in a few clearly defined situations.

Klaavi PRO works offline between periodic licence checks. It currently keeps PRO access for seven days after the last successful verification. After that, core FREE functions continue to work, and PRO returns after the next connection.

Your dictionary lives on your disk. Encrypted.

Klaavi protects local data with authenticated AES-256-GCM encryption. The key is protected by Windows mechanisms and tied to your system account.

Phrases, panels, settings and personalization remain local. We do not automatically synchronize them through our cloud.

When you want to move your data to another computer, you export it to one file protected with a password you choose. Klaavi does not store that password and cannot recover it.

Private Mode stops learning with one switch

The mode stays active after restarting the application until you turn it off. It does not delete earlier history — it keeps it encrypted and makes it available again when Private Mode is disabled.

Klaavi also knows what it should not learn

Password fields. Klaavi uses information exposed by Windows. When it recognizes a protected field, it does not show suggestions and does not add the entered content to personalization history.

Sensitive-data filter. Before adding new content to the local dictionary, Klaavi rejects many common patterns, including email addresses, web addresses, card numbers, IBANs, Polish PESEL numbers, access keys, one-time codes and random strings that resemble tokens.

The filter is an additional layer of protection, not a promise to recognize every possible secret. Use Private Mode whenever you need complete discretion.

Signed and checked before installation

Installer and updates. Klaavi uses signed release information, verifies the installer's digital signature and compares the downloaded file's SHA-256 with the expected value. If something does not match, the update is not launched.

Language packs. Every pack has a signature and hash. Installation is transactional: a new version becomes active only after download and verification complete successfully.

Additional components. The application runs only components that comply with a closed set of rules and recognized signatures.

Built defensively

The keyboard interface runs in a sandbox, without direct access to Node.js, the operating system or arbitrary files. It can only use a narrow, explicitly defined set of operations exposed by the main process.

Klaavi does not open arbitrary links. Every external address must match an allowed operation, host, path and expected parameters.

Before a release, automated tests cover areas including the sandbox, inter-process communication, updates, signatures and the external URL policy. We also inspect the dependencies used by the application.

An account without a traditional password

You sign in to Klaavi using a one-time code sent by email. The code is stored on our side as an irreversible hash, has a limited lifetime and is protected by attempt limits.

The token that lets the application remain connected to your account is also stored by the Platform only as a hash.

Klaavi assigns a random identifier to the installation. Separately, to prevent repeated free trials on the same computer, it creates a one-way hash locally from a Windows identifier. The raw Windows identifier is never sent to the Platform.

Servers and infrastructure providers may process an IP address in standard security logs. We do not use it to analyse typing content or build a user language profile. The Privacy Policy describes this processing in more detail.

Full card details do not reach Klaavi

Checkout, payments, invoices and the subscription portal are handled by Paddle. You enter card details on Paddle pages. Klaavi receives only the information needed to assign and manage the subscription, not the full card number.

Feedback is sent only after your click

Klaavi may occasionally ask for feedback. Until you select the send button, answers stay in the open form and are not passed to the Platform.

If delivery cannot complete immediately, the answer you approved may be placed in an encrypted local queue and sent later. Do not include passwords, health information or other particularly sensitive data in a comment.

What happens on klaavi.app

This page primarily describes the desktop application. The klaavi.app website uses Plausible to measure page views and selected events without creating a profile of your typing content. Crisp chat is loaded only after you select the chat button.

The exact scope, legal bases, recipients and retention periods are described in our Privacy Policy and Cookie Policy.

Found a security issue? Tell us.

Email [email protected]. We take good-faith reports seriously and respond as quickly as we can.

Common questions