Desktop app privacy notice
This notice covers the Migration Register Cowork desktop app. Our website Privacy Policy covers migrationregister.com.au and the registration form.
1. In short
- The app runs on your computer. You don’t create an account with us, and GetPost Labs receives nothing from it: no case data, emails, chats, keys or usage statistics.
- Your chats, settings and activity log are stored on your computer. Keys, tokens and passwords are encrypted by your operating system’s secure storage.
- The app connects only to the services you set up (your Jira site, your mailbox and the AI provider you choose), straight from your computer, using your own accounts.
- Nothing is changed in Jira and no email is sent until a person approves it.
2. Who we are
- Organisation
- GetPost Labs Pty Ltd, ABN 82 634 520 924
- Contact
- Sumit Arora, Founder and Director
- sumit@getpostlabs.io
- Address
- 8 Clunies Ross Ct, Brisbane Technology Park, Brisbane QLD 4113
3. What we collect
Nothing through the app. It has no analytics, tracking, crash reporting or advertising, and it does not check in with GetPost Labs servers. If you email us for support, we handle that email under our website Privacy Policy. Please don’t send client information in support emails.
If you download the app from the Mac App Store or Microsoft Store, Apple or Microsoft handles the download and your store account under their own privacy policies.
4. What stays on your computer
- Chats, runs and the activity log: a local SQLite database in the app’s data folder, including the case details and email text used in each conversation, and a record of every approved action.
- Connection settings: your Jira site address, the email account and mail server, and your choice of AI provider and model.
- Keys, API tokens and app passwords: encrypted with the operating system’s secure storage (Keychain on macOS, the Data Protection API on Windows) and decrypted only when the app uses them. The app never shows them in full again.
- Exports: a chat exported as a file is saved wherever you choose.
Anyone who can sign in to your computer account may be able to open the app and see this information, so keep your device locked and encrypted (FileVault or BitLocker).
5. Services you connect
When you connect them, the app talks to these services directly from your computer, as you, under your own agreements with them:
- Jira Cloud (Atlassian), with your API token: to read cases and, after approval, to add comments, change statuses and fields, attach files and create cases.
- Your email provider (for example Gmail), by IMAP and SMTP with an app password: to read client emails and attachments and, after approval, to send emails.
These providers may store or process information outside Australia. Their own terms and privacy policies apply.
6. AI providers
Cowork uses the AI provider you choose, OpenAI or Anthropic, with your own API key. When you ask Cowork something, the parts of the case, emails and documents needed to answer are sent to that provider to produce a response. The top bar shows each request’s model, token counts and estimated cost.
- Requests go from your computer to the provider’s API under your account and your agreement with that provider. Their data-use and retention terms for API customers apply.
- OpenAI requests are made with response storage turned off (
store: false). - Both providers are based in the United States and may process information outside Australia.
- AI output can be wrong. Cowork prepares drafts; a person reviews and approves them. It does not give migration advice and never lodges applications.
7. Approval and send safety
- Every change to Jira and every email waits for a person to click Approve. The activity log records who approved what, and when.
- In the preview, send safety is on by default: email can go only to addresses on an allow list you control.
- Received documents are recorded as received, never as checked. Only a named person marks them checked.
8. Your responsibilities as a practice
Your practice remains responsible for its clients’ personal information under the Privacy Act 1988 and its professional obligations. In line with the OAIC’s guidance on AI products and OMARA’s guidance on AI in immigration assistance, before using real client information you should:
- get your clients’ informed consent before their personal information is used with AI;
- check that your AI provider’s terms, data retention and overseas processing suit your obligations, including APP 8 on disclosure outside Australia;
- review every AI output before relying on it or sending it; and
- keep sensitive information, such as protection or humanitarian claim details, out of conversations unless it is necessary.
9. Removing your data
- In Settings, Remove key deletes a saved AI key, and Disconnect removes a Jira or email connection and its secret.
- To remove everything, uninstall the app and delete its data folder: on macOS
~/Library/Application Support/Migration Register Cowork; on Windows%APPDATA%\Migration Register Cowork. - Information already sent to Jira, your mailbox or your AI provider is held by them; delete it there under their terms.
Because we receive no data from the app, there is nothing for us to access, correct or delete on our side.
10. Questions and complaints
Email sumit@getpostlabs.io. We will acknowledge your message within 5 business days and respond fully within 30 days. If you are not satisfied, you can contact the Office of the Australian Information Commissioner at www.oaic.gov.au or on 1300 363 992.
11. Changes to this notice
We will publish changes on this page with a new effective date. A change to what the app sends or stores will be described in the app’s release notes before it applies.