● Ship
Privacy.
What leaves the phone, exactly.
The promise is simple: messages, documents, photos and voice never leave the phone. The code is built so it stays true.
01What leaves the phone
| Connection | When | What is sent |
|---|---|---|
| Model download (huggingface.co and its download CDN) | When the user downloads a model | A file request. Nothing about the user or the chats. |
Your console (/v1/config) | At start, only if you set API_BASE_URL | A plain GET request. |
| Google AdMob | Only if ads are on, only for users without Pro, after the consent form where the law requires it | Device and ad data under Google's policy. |
| Google Play / App Store | Only if the paywall is on | Purchase requests, handled by the store. |
The in-app Privacy screen builds this list from the live config, so it always matches your build.
02How the code keeps it
- One HTTP client,
lib/net/guarded_client.dart, talks only to the console host and the catalog's model hosts; any other host is refused.bash tool/check_network.shfails if other code opens a connection. - No analytics, crash reporting or font CDN.
- Replies are shown without loading images: a Markdown image a model or a document puts in a reply shows its description, never a network request.
- Chats, documents, photos and models are excluded from iCloud and computer backups (iOS) and from Google backup and device-to-device transfer (Android:
allowBackup="false"andres/xml/data_extraction_rules.xml). If you want backups, change both and say so on the Privacy screen. - Chats, document passages and photos are in the app's private storage (SQLite) and are deleted by Settings > Delete all chats and files.
- Dictation is recorded in memory, transcribed by whisper.cpp on the phone and discarded.
- Optional Face ID / fingerprint lock.
If you add code
Any SDK you add (analytics, crash reporting, another ad network) changes this promise. Update the Privacy screen texts, your store privacy labels and your privacy policy.
03Store privacy forms
With ads and Pro off: no data collected. With ads on: the data AdMob collects (see Google's AdMob data disclosure). With Pro on: purchase history, handled by the store.