Privacy promise

Your code, your prompts and the model itself run on your device and stay there. This page is the complete list of what does and does not reach OIOXO’s servers; the legal version is the privacy policy.

Stays on your device — always

• Your code and files. Browser storage or your folder on disk, edited in place.
• Your prompts and the model’s output. Processed by the model on your device, or sent to a provider you configured.
• Your API keys and Git tokens. Encrypted in a secure store under a key that cannot leave this browser or app.
• Settings, chats, checkpoints, downloaded models. Local. Clearing site data removes them; we have no copy.

Goes to a third party — only when you use that feature

• Your key: your browser calls the provider directly.
• Git hosts: push, pull and clone reach GitHub, GitLab, Bitbucket or Codeberg through our proxy (next section) with your token.
• Model downloads: from Hugging Face and our release CDN. They see the request, not your code.

Touches OIOXO’s servers

• Token counters for the free allowance — numbers, never content — tied to a device id when you are signed out and to your account when you are signed in.
• Usage beacons: a handful of stage events (boot, model ready, first agent run, a crash) with the stage name, time since boot, CPU core count, whether the tab is cross-origin isolated, whether the layout is mobile, and the version. Never a prompt, a file name or a path. Turn them off under Settings → Privacy → Usage beacons and nothing about your session leaves the device.
• A problem report, only if you send one from Help → Report a problem: your one-line summary, your details, and a diagnostic line with version, tier, plan, model label, core count, browser and the last error message — no code, no prompts.
• The Git proxy at oioxo.com/api/git: browsers cannot speak Git’s protocol, so push, pull and clone transit our server. Your token is forwarded to the host with the request and is not stored; the bytes are not kept.
• Web search at oioxo.com/api/search, only when you turn it on under Settings → Agent: the query the agent wrote, nothing else.
• Account and billing if you sign in or buy Pro: email and login, Stripe’s records (we never see card numbers).