Your things stay on your Mac.

Altillo has no analytics, advertising or telemetry service. It does not send us your files, calendar, clipboard, camera image, agent sessions, Ask conversations or credentials.

Version 1.0 · effective 26 September 2026

What stays local

Altillo stores its settings in macOS preferences and the content you ask it to remember in its Application Support folder. This can include shelf copies, notes and their history, timers, optional clipboard history, saved Ask items, usage snapshots and agent-hook installation records. Calendar, media and camera access use macOS permissions and remain on the device. Removing an item inside Altillo removes Altillo’s copy; retention of originals remains under your control.

AI usage checks

When you enable usage checks, Altillo reads the sign-in or API credential already stored by the provider’s own app or CLI and presents it only to that same provider to request quota information. Altillo does not refresh, rewrite or retain a separate copy of those credentials. It uses ephemeral sessions without a persistent cookie or disk cache.

Tool	Network destination	What is sent
Claude Code	`api.anthropic.com`	Claude access token and a read-only usage request.
Codex	Local app-server first; otherwise `chatgpt.com`	No internet credential when the local server answers. The fallback sends the Codex token and, when present, the ChatGPT account ID.
Cursor	`api2.cursor.sh`, `cursor.com`	Cursor access token or session cookies and read-only usage requests.
GitHub Copilot	`api.github.com`	GitHub/Copilot token and a read-only usage request.
Gemini / Antigravity	Local language server first; otherwise `daily-cloudcode-pa.googleapis.com` or `cloudcode-pa.googleapis.com`	Loopback requests stay on this Mac. The fallback sends the Google access token and an empty usage request.
Grok	`cli-chat-proxy.grok.com`	Grok CLI token and read-only billing and settings requests.
OpenRouter	`openrouter.ai`	OpenRouter API key and read-only credit and key requests.
Z.ai	`api.z.ai`	Z.ai API key and read-only quota and subscription requests.
Devin / Windsurf	The HTTPS server saved by Windsurf, or `server.codeium.com`	Windsurf API key and client metadata required for the usage request.
OpenCode Go	`opencode.ai`	OpenCode Go key and a read-only usage request.

Those providers receive the request under their own privacy terms. Altillo receives none of it.

Ask and web lookups

Ask runs on-device by default. Web access is off until you allow it for one question or in Settings. A short search derived from the question may then go to DuckDuckGo, with Bing as a fallback; weather place names go to Open-Meteo; and Wikipedia may be used as a reference fallback. Result pages selected by the search may be fetched to prepare the answer. Requests use ephemeral sessions without an Altillo account or advertising cookies. Those services receive the request and apply their own privacy policies.

Agents and local integrations

Agent hooks communicate with Altillo through a local Unix socket. Altillo shows permission requests and relays only your explicit choice; it never auto-approves. OpenCode integration may connect to its loopback server on your Mac. Hook configuration and backups stay locally in Application Support, and “Prepare to uninstall” previews every change before removal.

Updates, links and diagnostics

Checking for updates contacts Altillo’s signed Sparkle feed on GitHub Pages; downloading one contacts GitHub Releases. Now Playing may download artwork from the URL supplied by the active media app. Opening GitHub, Aurio, a meeting or another external link sends you to that service in your browser. Release logs stay on your Mac and redact credentials, question text, clipboard content and full file paths. “Copy Safe Diagnostics” creates local text containing only the Altillo version, macOS version, architecture and hook status; nothing is uploaded automatically.

What we collect

Because Altillo has no account, analytics or telemetry backend, we do not receive or retain personal data from normal app use. If you contact us or file a GitHub issue, the information you choose to provide is handled by that communication service and retained as needed to answer or maintain the project.

Your control

Disable each module or its macOS permission in Altillo Settings or System Settings.
Turn web lookups and optional clipboard history off at any time.
Use “Prepare to uninstall” before deleting the app to remove Altillo-owned agent hooks safely.
Delete Altillo’s Application Support data to remove its local saved state.

Questions

This policy changes when the product’s data flows change. The repository is public so the implementation can be inspected.