Privacy

Power-Up · Updated October 30, 2026

Power-Up is an optional subscription for trevware’s Obsidian plugins. trevware is Trevor Tarakjian, an independent developer in Canada. In Oriko, Power-Up runs Describe, which labels your clippings. In Sidebar Highlights and Tasks, it lets you sync your dated tasks with your Google or Microsoft calendar, with trevware’s server handling the sign-in.

Both plugins are free, and nothing in this policy applies until you enter a Power-Up license key.

Describe in Oriko

What We Receive

When you run Describe with Power-Up, Oriko sends, for each clipping: a resized copy of its picture (or a grid of frames from a video), its title, description and source website, up to 1,500 characters of its note text, and the names of the categories already on your wall. Your license key and a random id for your device come with every request.

What Happens to It

Power-Up runs on Cloudflare, whose network carries every request under its own privacy policy. We pass the pictures and text to Anthropic’s Claude API, which writes the labels, and send the labels back to Oriko. On our side, the pictures and text are held in memory only for the length of that request: we don’t store them, log them or look at them. Anthropic may keep what it receives for a limited time, under its Commercial Terms and privacy policies.

Calendar Sync in Sidebar Highlights and Tasks

Sidebar Highlights and Tasks puts your dated tasks in a calendar of their own in your account. It reads and writes that calendar directly with Google, Microsoft, Apple or your CalDAV server, from your device. Your calendar, its events and your tasks’ text never come to our server.

Google and Microsoft Sign-In

What does come to our server is the sign-in. When you connect, your license key and device id come with the request, and the sign-in page you see is Google’s or Microsoft’s own. They send you back to our server with a one-time code, which we exchange, using trevware’s app credentials, for the tokens that let the plugin reach your calendar. For a Microsoft account we also read the email address on it, so the plugin can show which account is connected. We hold the tokens and that address encrypted for the few minutes until the plugin collects them, at most ten, then delete them.

When the plugin renews its access, which it does about once an hour while it syncs, the token passes through our server to Google or Microsoft and the new one comes straight back. We keep neither. When you disconnect, we ask Google to revoke the token. Microsoft offers no way to do that from here, so to cut it off there too, remove Power-Up from the apps that can access your Microsoft account.

iCloud and Other CalDAV Calendars

These never touch our server. Your app-specific password stays in Obsidian’s keychain on your device, and the plugin talks to the calendar directly.

Google User Data

Power-Up’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

In practice: Power-Up asks Google only for access to calendars it creates itself, so it can’t see your other calendars. It uses that access for one thing, keeping your tasks’ events in the calendar it made for your vault, and it does that from your own device. Data from Google is never sold, never used for advertising or to build a profile of you, never transferred to anyone else, and never read by a person.

What We Keep

• A fingerprint (a one-way hash) of your license key, never the key itself.
• Polar’s ids for your license and your customer record.
• The devices you activated: a random id the plugin creates, and a label with the platform and vault name. Both also go to Polar, which keeps count of the devices on your license.
• How many clippings you described each month.
• While a calendar sign-in is under way, for at most ten minutes: which license and device started it, the provider, and once you’ve signed in, the encrypted tokens (and for Microsoft, the account’s address), deleted as soon as the plugin collects them.
• A record of each Describe request: when it ran, how many clippings it held and what they used of your allowance, whether it worked, how many tokens Claude used, and Anthropic’s id for the request. Never the pictures, the text or the labels.

We keep these while your license exists, to run the service and keep it within its limits.

Payments

Polar sells Power-Up as the merchant of record and handles your payment details, taxes and receipts under its own privacy policy. We never see your card.

What We Never Do

No tracking inside the plugins, no advertising, and nothing sold or shared beyond Anthropic for the labels, Google or Microsoft for the calendar you connect, Polar for the payment and your devices, and Cloudflare, which hosts the service. This website counts visits with Google Analytics. The plugins and the Power-Up service send it nothing.

Deleting Your Data

Email hello@trevware.com from the address on your receipt, and we’ll delete everything above within 30 days and reply when it’s done. Deleting is its own request, so cancelling alone keeps your devices in place in case you come back.

Changes

If this policy changes, the date at the top changes with it, and anything that changes what we receive or keep will be in the plugins’ release notes.