What stays local, and what can leave.

Local-first

Profiles, conversations, memories, preferences, safety records, linked-app shortcuts, Adult Mode state, the 18+ confirmation, encrypted credentials, and backups stay in the Windows application-data directory (or a CLI data directory you choose). There are no owner-operated accounts, telemetry, advertising identifiers, analytics SDKs, or cloud memory. Operating-system credential encryption protects data at rest when available; it does not protect against malware running as your user.

What can leave this device

• Explicit internet/web/online research: search terms to Wikipedia/Wikimedia (and, if you enabled Premium testing and pasted a Brave key, to Brave Search).
• Optional pasted model endpoints: conversation context to loopback Ollama or to an HTTPS /chat/completions URL you configure.
• Official GitHub update checks: after 18+, the desktop app can auto-check configured release channels (Settings can disable this). Any installer download still needs your confirm, and checksums are verified. Builds are Authenticode-unsigned. Public release assets are currently withdrawn during the distribution pause.
• Spotify/YouTube buttons: HTTPS search text in your system browser.
• Optional Eidovara service: after the 18+ gate, Settings Connect (or Ctrl+A Test service) may call /health, /v1/config, and /v1/status. Conversations and payment data are not sent. If the service is down, the local app still works.
• Website helper: answers from a fixed knowledge pack in this browser. If you paste an HTTPS service base (saved only in this browser), the site may POST a single question to /v1/assist. Transcripts are not stored. Desktop conversation history is refused.

Payments stay fail-closed. The application does not collect card numbers or security codes. Review and remove local data from Settings.

Age 18+

Eidovara is restricted to users age 18 or older and does not intentionally collect minors' personal information. Adult Mode additionally requires the age of majority where located. Local confirmation is not independent identity or age verification.