Privacy Policy

Overview

Covers the website you are visiting -- account creation, downloads, billing, and analytics. None of this applies to the desktop application.

Data We Collect

• Account data -- email address, collected when you create an account.
• Download events -- platform, version, and country. The IP address is read in memory only, used to resolve the country, and discarded immediately. It is never written to disk.
• Page view analytics -- path, referrer, and country. No cookies. No tracking scripts. No fingerprinting.
• Payment data -- handled entirely by Stripe. We never see or store your card details.

Data We Do NOT Collect

• Stored IP addresses
• Advertising or tracking cookies
• Device fingerprinting
• Cross-site behavioural profiles

Third-Party Services

• Supabase -- account database and authentication
• Stripe -- payments and checkout
• Vercel -- site hosting and traffic analytics. The desktop application does not connect to Vercel.

Overview

The desktop application is local-first. Your conversations, files, prompts, and model responses stay on your device. The app only contacts the network for features you explicitly enable.

Data We Collect

• ModelIndex reports -- anonymous, cryptographically signed performance reports (model and hardware metrics only). Contributed automatically outside the EU/EEA/UK, and only with your opt-in consent inside the EU/EEA/UK, where you can withdraw at any time. Hardware is identified by a one-way hash. No personally identifiable information.

Data We Do NOT Collect

• AI conversations
• File contents or document data
• Model prompts or responses
• Personal files or system information

Security Architecture

Privacy here is enforced by architecture, not configuration -- the controls below ship on by default.

• Encrypted at rest -- your data lives in a single database encrypted with AES-256.
• On-device inference -- chat, vision, voice, and image generation run locally. No provider API keys, no cloud model calls.
• No third-party code in the trust boundary -- no plugins and no external tool servers, so supply-chain and tool-poisoning attacks do not apply.
• Action gates the model cannot disable -- every external or irreversible action passes a final safety check the model cannot alter or bypass.
• Untrusted content stays data -- web pages and emails the AI reads are treated as data, never as instructions, and outgoing messages are screened so secrets cannot slip out.
• Encrypted backup and export -- backups are encrypted on your disk, and a password-protected export moves your data to a new machine without any cloud account.
• No passive telemetry -- no analytics or crash SDK in the app; the only outbound path is an opt-in bug report you preview before sending.
• Compliant by architecture -- no cloud accounts, no telemetry, and no third-party data sharing, so GDPR, LGPD, and CCPA obligations are met by design rather than by paperwork.

Network Access

Once models are downloaded, the app runs offline. The only times it touches the network are features you explicitly enable, and those connections go directly to the third party you chose. They do not pass through our servers.

• Web research -- the search provider you configure
• MyMail -- sending and receiving email through your own email provider
• Channel Gateway -- Telegram, iMessage, WhatsApp, Signal, Slack, Discord, WebChat

One consequence worth being explicit about: web research runs from your machine, not from a provider's data center. Sites the AI visits see your connection the same way they see your own browsing -- including your IP address. There is no intermediary server, which also means there is no intermediary logging what you research.