Your data stays home.

On your computer, everything lives in one folder in your home directory (~/.actovia): your chats and their sources, the memories Actovia has formed about you, your settings and provider keys, the files it writes while working, its logs, and the backups it makes of its own database. That database runs inside the app. Nothing is copied to a cloud, and we cannot see any of it.

On your iPhone, the app keeps the record of the computer it is paired with (the computer’s name, its addresses, the fingerprint of its certificate and a token for it), a cache of what Apple Health gave it, and what its widgets show. Your conversations are not stored on the phone; they are fetched from your computer when you open them.

There is no account to create and no sign-in, so there is nothing that identifies you to us.

Actovia sends data only to services you chose and configured, and only when you use them. Each of them has its own privacy policy.

The model provider you picked — OpenAI, Anthropic, Google, xAI or Azure OpenAI, with your own API key, or a model running locally with Ollama, which sends nothing anywhere. A request carries the conversation you are in (what is needed of it to answer), the files and images you attached, the memories Actovia picked as relevant, and the results of the tools it called. Dictation is sent to the same OpenAI account as audio and comes back as text. Your key is stored on your computer, encrypted, and goes only to that provider’s address.

Tools, when a run calls them: web search and the Discover feed send the search terms to Brave Search with your Brave key; the weather tool sends a place name to Open-Meteo (no key); the map itinerary sends place names to Google Places and loads Google Maps, with your Google key; reading a web page fetches that page. A knowledge base, MCP servers and an S3 bucket are services you run or own, and receive what you point them at.

Two things of ours: the Skills Market browses the skills.sh registry through a relay we host (skills-md.yancey.app), which receives the search terms and the id of a skill you open or install and nothing about you; and the desktop app asks update.electronjs.org whether a newer version exists, sending the platform, the architecture and the version it is running. This website is served by Cloudflare and runs no analytics of its own.

Actovia for iPhone talks to exactly one place: the computer you paired it with, over HTTPS, on your own network or across a Tailscale network you set up. It pins that computer’s certificate and sends every request with its pairing token; the computer keeps only a hash of that token. Nothing listens on your computer’s network until you pair a phone, and you can revoke a phone at any time in Settings → Devices.

What the phone sends to your computer is what you do in it: the messages and photos you send, the audio you dictate, the day’s Health numbers when you ask a question from the Health screen, and the phone’s own error reports, which are written into the computer’s local log and go no further.

The app asks for permissions only when a feature needs them, each for one purpose: the camera to scan the pairing code and to take a photo for a chat; the microphone while you dictate; location to show where you are on an itinerary map; your photo library to save an image you chose; Face ID to unlock the connection to your computer; local network to find your computer; and Apple Health, below.

With your permission, the app reads your sleep, activity, heart and recovery, body and mood data from Apple Health to draw the Health screen — the day, the calendar, the weekly and monthly reports. That reading stays on the phone.

Health data goes to the AI provider set up on your computer in two cases only, both yours to start: when you ask a question from the Health screen, the numbers you are looking at travel with it, shown to you in the message; and, if you turn on Ody’s daily note, a short summary of the day is sent to write that note. You can turn the note off and take back Health access at any time, in the app or in Settings → Privacy & Security → Health. Clearing the archive in the app removes what it cached.

The app writes one thing to Apple Health: the water you log there. Health data is never used for anything else, never sold, and never shared with anyone but the provider you chose, in the way above.

Actovia keeps a memory of you — lasting facts, interests, the people you mention — so it can answer better next time. It is a list you can read, edit, switch off entry by entry or delete in Settings → Memory, on your computer and from the phone; a deleted entry can be restored for a while. Each answer that used memories says which, and lets you correct them in the chat. The memories chosen for a question are sent to the provider with it, as above, and nowhere else.

Provider keys and other secrets are encrypted at rest with the operating system’s keychain. The app can be locked with a PIN or Touch ID; while it is locked it answers nothing, not even another program on the same computer. On the network it listens only to the computer it runs on until a phone is paired, and then only over HTTPS to paired phones. The code is open source under the MIT license, so all of this can be checked.

Actovia is not directed at children under 13 and we do not knowingly keep anything about them — we keep nothing about anyone.

If this policy changes, the new version is published here with a new effective date, and a change that matters is noted in the release notes of the version that brings it.

Questions go to the project’s issue tracker or to developer@yanceyleo.com. Back to Actovia.