Your data
What it can do, what it cannot, and who holds the keys.
This page is deliberately precise. If you handle anything confidential, the details are the point.
Where is my data stored?
On your computer, in a normal folder you can open, copy and back up. Config, data, memory and media all live there. The notes folder is one you own outright.
Does anything I write ever leave my machine?
Your files and your memory do not. Reading and indexing happen in-process, offline, on your machine. There is no upload step and no copy on our side.
We lead with this one rather than a broader claim because it is true without conditions. The next section is the part that does have conditions, and we would rather you read it here than discover it later.
Do my requests ever go through your servers?
Your own key is used first, always. If it has been refusing for about 90 seconds and you are signed in, engine work can be carried on our connection instead, so a long run finishes rather than dying halfway.
- Conversations and background housekeeping never do. Only engine work, and only after your own key has actually failed.
- You can switch it off. It is opt-in and tied to being signed in.
- Your files and your memory are not part of this either way. The fallback carries the request, not your documents.
- Steps that drive a real browser cannot be carried this way and stop honestly instead of guessing.
Why we put this on the page rather than in a footnote
Plenty of software would describe itself as fully local and quietly keep this bit out of sight. Burying it is what would make it a problem. Told plainly, it is just a feature that stops your work dying at the worst moment.
What needs my permission?
Three things: sending, publishing and spending. Outbound actions across your connected apps are held for your approval. Everything else runs freely.
Sending
Email, WhatsApp, Slack, Teams, Discord, calendar invites.
Publishing
LinkedIn, the Meta platforms, YouTube, Reddit, blog hosts.
Spending
Stripe, PayPal, Razorpay.
Could a new feature forget to ask?
No. Everything funnels through the same single gate, whoever asked for it: the assistant, a worker, an engine, or a direct call. There is no second path.
- 18 of the 20 built-in engines hold their outbound work for approval. The two that do not send nothing outside the company at all.
- Every step that sends externally ships requiring approval. You can turn that off per step; it is never off by default.
That is what makes this durable rather than a promise about today's code. A feature built next year cannot forget to ask, because asking is not something each feature does for itself.
What if I'm not there to approve it?
It stops. No answer within 90 seconds counts as a no, not as a quiet yes. Every decision is written to a log you can read.
The reason, from a comment in the code:
“unattended runs should not silently send messages to real people.”
Where do my keys live?
On your machine. They never reach the web page, they are not in the download, and they are not in our code. Google sign-in tokens live outside the app and are never bundled with it.
Can it spend more than I have?
No. It checks your balance before starting a chargeable job rather than after, and stops at zero instead of running a negative balance you have to settle.
Voice cloning
A voice with no recorded consent cannot be used. The consent gate sits at the one route that accepts a voice sample, so there is no way in around it.
Does it work without internet?
Reading and indexing your own files does. Anything that needs an AI needs a connection. It does not work fully offline and we do not claim it does.
Is this safe for client work?
We will not claim a certification we do not hold. Here is what is actually true, so you can decide against your own obligations.
- Client files stay on your machine and are indexed there, not uploaded.
- You choose which mailboxes and folders it can see. Anything you do not point it at, it never reads.
- Nothing sends without you, and it fails closed when you are away.
- What a client told you cannot cross into an answer about your business, or into a reply to somebody else.
- The one case where a request leaves your machine is described above, and can be switched off.