Privacy controls
Everything on this page is in Settings. The short version: two switches change what leaves your phone, and both start off.
The two that matter
| Feature | Default | What it sends |
|---|---|---|
| Web search | Off | A derived query, stripped of emails, phone numbers and long digit strings, to a provider whose key you supplied |
| Mac offload | Off | Your prompt and the prior turns the model needs, to a Mac you paired, over your own network |
Nothing else sends anything. Generating replies, reading documents, recognising scanned pages, transcribing speech and reading replies aloud all run on the device.
What is stored, and where
- Conversations are saved in the app's private container so your threads are still there next time. They are protected by the device's own encryption and, if you enable it, by the app lock. The app does not add a second layer of encryption on top.
- Documents and their index live in the same private container.
- Keys — your search API key and your Mac pairing key — are in the system keychain, marked so they do not sync to your other devices and do not travel in a backup.
- Recordings are not stored at all. Audio is deleted the moment it has been transcribed.
App lock
Settings → App lock requires Face ID or Touch ID when the app opens, and puts a privacy cover over the app switcher preview so your last conversation is not visible when you switch apps.
Deleting things
| Action | What goes |
|---|---|
| Remove a document | Its index entry. The original file is untouched. |
| Delete a conversation | That thread, from the device. |
| Delete a model | The downloaded weights, freeing the storage. |
| Delete the app | All of it. |
Settings → Storage shows what conversations and models are using, so you can see what deleting something would return.
We cannot delete any of it for you, recover it for you, or see it, because none of it reaches us.
No analytics
The app contains no third-party analytics and no crash-reporting SDK. It uses Apple's own on-device metrics framework and sends us nothing.
Separately, Apple gives every developer aggregate App Store statistics — download counts and anonymised crash reports — and may share crash diagnostics if you have agreed to that in your iOS settings. That comes from Apple, is not linked to your identity, and cannot show us your content.
The privacy policy states all of this formally.