Your things stay on your Mac.

What stays local

Altillo stores its settings in macOS preferences and the content you ask it to remember in its Application Support folder. This can include shelf copies, notes and their history, timers, optional clipboard history, saved Ask items, usage snapshots and agent-hook installation records. Calendar, media and camera access use macOS permissions and remain on the device. Removing an item inside Altillo removes Altillo’s copy; retention of originals remains under your control.

Drawer and menu bar icons

Drawer needs Accessibility permission to list menu bar icons and open their menus. Screen Recording is optional: with it, Altillo captures only the menu bar to show the actual icons instead of app icons. It keeps the cropped icon images on your Mac in ~/Library/Application Support/Altillo/MenuBarGlyphs; it does not save the full menu bar image or upload captures. Hidden icons use their last saved image. Cached images have no automatic expiry and remain until replaced by a new capture or you delete that folder. Without Screen Recording, Drawer still works using app icons and system symbols.

AI usage checks

In Altillo 0.14 and later, you connect one selected Claude account and one selected Codex account in Altillo Settings. Sign-in opens the provider’s website; Altillo stores the account identity and its own access and refresh tokens in this Mac’s private, non-synchronizing Keychain and renews that authorization directly with the provider. These two usage checks do not read CLI credentials or launch a CLI. Reconnect replaces the selected authorization; Disconnect removes it locally, without claiming remote revocation. Other providers still read their documented local app/CLI credential or API key without refreshing, rewriting or retaining a separate copy. Usage requests use ephemeral sessions without persistent cookies or a disk cache; the sign-in browser manages its own session. No credential passes through an Altillo server. Real sign-in and renewal QA is pending before distribution.

Those providers receive the request under their own privacy terms. Altillo receives none of it.

Ask and web lookups

Ask runs on-device by default. Web access is off until you allow it for one question or in Settings. A short search derived from the question may then go to DuckDuckGo, with Bing as a fallback; weather place names go to Open-Meteo; and Wikipedia may be used as a reference fallback. Result pages selected by the search may be fetched to prepare the answer. Requests use ephemeral sessions without an Altillo account or advertising cookies. Those services receive the request and apply their own privacy policies.

Mail (optional beta)

Mail is off by default. When you enable it and create the Altillo Mail rule in Apple Mail, that rule sends new messages to a native helper through a local pipe and Unix socket. Altillo keeps the sender, subject, account name and a short beginning of the body in memory for up to five minutes to show the message and recognize access codes or sign-in links. It does not save a mail archive, send mail content to Ask, or upload it to an Altillo server. Your sender/account filters are stored locally. Disabling Mail, locking the screen or putting the Mac to sleep clears the recent messages. The code button marks its clipboard entry as private; other clipboard apps follow their own policies. Opening a sign-in link contacts its website in your browser only after you click it. Before uninstalling, disable Mail and remove the Altillo Mail rule in Apple Mail Settings. Disconnecting in Altillo stops reception and preserves the scripts and user-created rules. After removing every rule that uses them, use Show scripts in Altillo Settings to remove only Altillo Mail.scpt and Altillo Mail Bridge.scpt manually. Altillo checks its local script files and confirms reception from a new delivery; it does not query Mail rules or require an Altillo → Mail Automation grant.

Agents and local integrations

Agent hooks communicate with Altillo through a local Unix socket. Altillo shows permission requests and relays only your explicit choice; it never auto-approves. OpenCode integration may connect to its loopback server on your Mac. Hook configuration and backups stay locally in Application Support, and “Prepare to uninstall” previews every change before removal.

Music and lyrics

Now Playing reads the media session already available on your Mac and may download artwork from the URL supplied by the active media app. Lyrics stay off until you press “Load Lyrics”. That action sends the current track’s title, artist, album and duration to LRCLIB to find matching lyrics, using an ephemeral session without cookies or an Altillo account. No audio or media library is uploaded.

Updates, links and diagnostics

Checking for updates contacts Altillo’s signed Sparkle feed on GitHub Pages; downloading one contacts GitHub Releases. Opening GitHub, Aurio, a meeting or another external link sends you to that service in your browser. Release logs stay on your Mac and redact credentials, question text, clipboard content and full file paths. “Copy Safe Diagnostics” creates local text containing only the Altillo version, macOS version, architecture and hook status; nothing is uploaded automatically.

Home (optional)

Home is off until you turn it on and connect it. To find a server, Altillo looks for Home Assistant on your local network (Bonjour and homeassistant.local); macOS asks for Local Network access first. Altillo then talks only to the Home Assistant address you connect to, directly from your Mac over your network or your own https URL. Signing in opens your Home Assistant’s own login page in your browser and creates an access token named after your Mac. The token is stored in the macOS Keychain and never leaves your Mac except to authenticate with your own server. Entity names and states are kept in memory only; your favourites (entity ids) are kept in Altillo’s preferences on your Mac. Doorbell camera snapshots are fetched only to show a doorbell peek, kept in memory and never saved. Nothing goes through any Altillo server, because there is none. Disconnecting deletes the token from your Mac; to revoke it, delete it in your Home Assistant profile.

What we collect

Because Altillo has no account, analytics or telemetry backend, we do not receive or retain personal data from normal app use. If you contact us or file a GitHub issue, the information you choose to provide is handled by that communication service and retained as needed to answer or maintain the project.

Your control

• Disable each module or its macOS permission in Altillo Settings or System Settings.
• Turn web lookups and optional clipboard history off at any time.
• Use “Prepare to uninstall” before deleting the app to remove Altillo-owned agent hooks safely.
• Delete Altillo’s Application Support data to remove its local saved state.
• Delete ~/Library/Application Support/Altillo/MenuBarGlyphs to remove cached menu bar icons.

Questions

This policy changes when the product’s data flows change. The repository is public so the implementation can be inspected.