Privacy Policy

Overview

Covers the website you are visiting -- account creation, downloads, billing, and analytics. None of this applies to the desktop application.

Data We Collect

• Account data -- email address, collected when you create an account.
• Download events -- platform, version, and country. The IP address is read in memory only, used to resolve the country, and discarded immediately. It is never written to disk.
• Page view analytics -- path, referrer, and country. No cookies. No tracking scripts. No fingerprinting.
• Payment data -- handled entirely by Stripe. We never see or store your card details.

Data We Do NOT Collect

• Stored IP addresses
• Advertising or tracking cookies
• Device fingerprinting
• Cross-site behavioural profiles

Third-Party Services

• Supabase -- account database and authentication
• Stripe -- payments and checkout
• Vercel -- site hosting and traffic analytics. The desktop application does not connect to Vercel.

Overview

The desktop application is local-first. Your conversations, files, prompts, and model responses stay on your device. The app only contacts the network for features you explicitly enable.

Data We Collect

• ModelIndex reports -- anonymous, cryptographically signed performance reports, sent only when you opt in to contribute. Hardware is identified by a one-way hash. No personally identifiable information.

Data We Do NOT Collect

• AI conversations
• File contents or document data
• Model prompts or responses
• Personal files or system information

Security Architecture

Privacy here is enforced by architecture, not configuration -- the controls below ship on by default.

• Encrypted at rest -- your data lives in a single database encrypted with AES-256.
• On-device inference -- chat, vision, voice, and image generation run locally. No provider API keys, no cloud model calls.
• No third-party code in the trust boundary -- no plugins and no external tool servers, so supply-chain and tool-poisoning attacks do not apply.
• Deterministic action gates -- every external or irreversible action passes a check outside the AI model, which the model cannot disable.
• No passive telemetry -- no analytics or crash SDK in the app; the only outbound path is an opt-in bug report you preview before sending.

Network Access

Once models are downloaded, the app runs offline. The only times it touches the network are features you explicitly enable, and those connections go directly to the third party you chose. They do not pass through our servers.

• Web research -- the search provider you configure
• MyMail -- sending and receiving email through your own email provider
• Channel Gateway -- Telegram, iMessage, WhatsApp, Signal, Slack, Discord