Skip to main content
Your activity is stored on this device and nowhere else. Apart from the calls listed below, the code makes no network requests.

​
What is recorded

  • The name of the app in front, its window type, and whether you are idle.
  • With browser capture on, which host and path shape the active tab used. Titles and query strings are dropped. Private and incognito windows are never reported.
It never records window titles, page text, typed text, the clipboard, screenshots or keystrokes. The only text you type that the app keeps is a name you give inside companyOS itself: a task in the end-of-day review, or an automation you rename. It stays in the encrypted store and is never captured from another app. An export shows a placeholder in its place.

​
Where it is kept

  • One encrypted database (SQLCipher). Its 32-byte key is sealed by the operating system’s keychain.
  • If the keychain cannot protect the key, the app does not start, rather than storing data unprotected.
  • Raw events are kept for 90 days, then removed. Routines and automations are kept until you remove them.
  • Handoff records saved by an earlier version of the app are no longer read or shown. They are kept for 90 days from when they were sent, then removed. Delete everything removes them at once.

​
What leaves the device

  • Model downloads. Only when you install a model. The download comes from Hugging Face hosts, and its SHA-256 digest is checked before the model is used.
  • Decision model download. Only if you choose it in setup or in Settings. It is five files, about 1.7 GB, from the receptron/laya-onnx repository on huggingface.co, taken from one fixed commit. Hugging Face serves them from its own *.hf.co hosts. Each file’s SHA-256 is checked against a digest stored in the app, and a file that does not match is deleted. No account or token is sent. An interrupted download keeps what it fetched and continues from there. Nothing in the app uses this model yet.
  • Update checks. Only in a packaged build with an HTTPS update feed set. No feed is configured yet. A feed may redirect, as a GitHub Release does, and the ledger lists only the first address. See Releasing.
Update files downloaded automatically after a check are not listed in the network ledger. The model and update hosts see the connection, including your IP address, but they receive no activity data.

​
The network ledger

The ledger lists every model download and update check the device made, as it was sent. It is on the Network ledger page. The decision model adds one entry per file, with the host that served it, the file name and the bytes received.

​
Export and delete

  • Export writes a plain JSON file, after a warning that it is unencrypted. It includes any handoff records saved by an earlier version, with their replies.
  • Delete everything removes the database, the data key and the installed model files, including the decision model and any partial download of it, and cancels any download in progress. An export you saved elsewhere is yours, and it is not touched.

​
Excluded apps

An excluded app is not recorded from then on, and its recent events are removed. Handoff records saved by an earlier version may still name the app until they are removed after 90 days, or until you delete everything.