Privacy and data boundaries

When the configured default model endpoint is local, prompts, chat history, project data, skills, agent metadata, usage records, and credentials stay inside your own deployment. The operator controls access, retention, and which services are connected.

Credentials are encrypted at rest with AES-256-GCM, authentication runs on your own database or an OAuth provider you configure, and privileged actions are written to the audit log.

External models, web search, OAuth providers, and MCP servers receive data only when you enable the connection and use it. A default chat route configured to a local endpoint stays inside your deployment, and an outbound feature does nothing until you have configured it.

ChatGPT subscription OAuth is optional, unofficial, and dependent on the provider's policy. NotebookLM grounding uses a Google session cookie that you supply.

Alerts are the one routine path that leaves your deployment even on a local model route, so they are worth naming. Every channel is off until someone turns it on.

A browser push notification is signed with your own VAPID keys and delivered through the push service your browser vendor operates. An iOS notification goes to Apple's APNs. Operator alerts can additionally go out by email through an SMTP server you configure, or to a webhook URL you supply. What travels is the notification itself — a title, a line of text, and a link back into your workspace — not the conversation behind it.

The public marketing site may use Google Analytics 4 to understand page visits and aggregate interactions with the GitHub and Live Demo links. It does not send prompts, account identifiers, or conversation content.

Analytics is enabled only when the site deployment provides a GA4 measurement ID.

A connected folder is handled on the device through scoped bridge controls. The full local path is not sent to the server merely so a menu can display it — the server sees the folder name — and file access is confined to the folder you chose.

The same bridge core backs the desktop companion and the openmake-code CLI, so the path scoping, the execution denylist, the confirmation you cannot bypass, and the OS sandbox profile are one implementation rather than three.