Privacy & security

OOMU is built for people who cannot be casual about data: lawyers, advisors, executives, clinicians, anyone under a confidentiality obligation. For them the question is not whether a tool is useful. It is where does this go?

Here is the honest answer, including the parts that are not absolute.

---

The default is your Mac

The strongest privacy property is the one where data never moves.

• Your assistant runs on this Mac. Gemma 4, through llama.cpp, on Apple Silicon. Ordinary conversation never touches the internet.
• The router runs on this Mac. The model that reads every request and decides what to do with it is local, always. There is no "send it up to classify it" step.
• Document extraction runs on this Mac. PDFs, Word files, spreadsheets, and CSVs are parsed natively. "Reading document locally…" is literal.
• Retrieval runs on this Mac. Ask Documents scores passages with BM25 and cosine similarity in native code and answers with the local model. The panel confirms: "Answered on this Mac in {seconds}s."
• Comparison runs on this Mac. "Review aligned clauses, commercial terms, and rate differences without sending source files off this Mac."
• Document generation runs on this Mac. Four native engines, no service dependency.
• Clipboard classification runs on this Mac. The quick-action suggestion is native code, not a lookup.

The cloud is reached only when you have configured a provider, the project permits it, and the router selects it, using your key, to the provider's own endpoint, directly from your machine. There is no OOMU server in the path. OOMU operates no service that sees your work.

---

Three gates before anything leaves

None of these is a request the model is asked to honor. They are structural.

---

Data at rest

One SQLCipher-encrypted SQLite database, oomu-beta2.sqlite.

• The key is held in the macOS Keychain, under a Beta 2-specific service namespace. Never in plain text on disk, never transmitted.
• cipher_memory_security wipes sensitive pages from memory; secure_delete overwrites removed content.
• OOMU verifies the database is actually encrypted after opening and refuses to proceed if it is not.
• A copied database file is not enough to read your data.

What the encryption does not cover

The database is the encrypted part. It is not the only part.

Files you export, documents OOMU generates, and cached copies can remain unencrypted on disk. A DOCX you asked for is an ordinary file in an ordinary folder, protected by FileVault and your account password like everything else on your Mac, and not by SQLCipher. The in-app notice says this in the same words, because a reader who assumes the encryption is total will make a worse decision than one who knows where it stops.

Secrets are not in the database

API keys, OAuth refresh tokens, and channel bot tokens live in the Keychain. The database holds only opaque references and non-secret metadata.

Two design details follow from this, and both are deliberate:

• Opening a settings screen does not read the Keychain. Credentials are loaded only when a route that needs one has actually been chosen.
• A key is verified against the real provider before it is stored. A key that does not work is never saved.

The Secure Enclave

Audit exports are signed by a key that lives in the Mac's Secure Enclave and cannot be extracted: not by OOMU, not by anyone with the file. OOMU verifies its own signature before accepting an export, and refuses to produce one that is not hardware-backed. See Enterprise security.

---

Device permissions belong to macOS

This is the largest change from Beta 1, and it is worth being direct about why.

Beta 1 built its own permission system on top of macOS: a file sandbox, a permission broker, trust policies with resource budgets, a capability gatekeeper. Beta 2 removed all of it.

Not because security mattered less. Because the layer was making things worse.

A second permission system creates a second thing to reason about. When two systems disagree, the more permissive one wins. And an in-app dialog in front of every action trains exactly one behavior: clicking through.

So macOS governs access to your machine, and every native macOS permission is enforced. It asks once, in its own dialog, in its own words, at the moment a feature needs it: and your answer lives in System Settings alongside every other application on your Mac, managed the same way, revocable the same way, auditable the same way.

Settings → Mac access shows you what macOS has granted across ten categories, in eight possible states. It is a report, not a control: OOMU cannot grant itself anything, and there is no override.

A split of responsibility, not an absence of one. macOS decides what OOMU may reach. OOMU decides what may leave, through the three gates above. Finer-grained gating over private information leaving the machine is in development for the Beta 2 release; everything on this page describes what the current build does.

What OOMU enforces itself

Beyond egress, what OOMU adds is integrity:

• Identity binding. Before acting on a file, OOMU resolves the real path (symlinks rejected) and records device, inode, size, and modification time. If the file changed between looking and acting, the action fails.
• Reference binding. Browser and screen actions target an element from a specific observation. A stale reference fails rather than clicking whatever is now in that position.
• Postcondition verification. Every action is checked afterwards. See Evidence & receipts.
• Human file selection. Every choose_* command opens a native macOS dialog. A path is never a parameter. No model output, prompt injection, or page content can direct OOMU at a file.

That last one is worth restating, because it is the strongest structural defence in the application against prompt injection. OOMU cannot be talked into opening a file. A human picked it, in a system dialog.

---

Untrusted content stays labeled

Every segment of context in a turn snapshot carries a source label recording its type, its principal, and a content digest. Text you typed and text that arrived from a web page or a document are distinguishable throughout the turn.

The router additionally marks non-command mentions: spans that mention an action without requesting one. "He asked me to delete the old drafts" is reported speech, and the router says so explicitly. The evaluation corpus tests this across twelve languages, alongside negation and reported speech.

Web content rendered in OOMU's browser cannot reach OOMU's commands: the Content Security Policy restricts connect-src to IPC and the analytics endpoint, and there is no capability to evaluate arbitrary JavaScript in a page.

---

Extensions cannot widen the surface

A Mod's signature identifies its publisher. It does not make the Mod safe, and OOMU does not conflate the two: Verified publisher and OOMU reviewed are separate badges answering separate questions.

---

What OOMU sends, and what you can turn off

Analytics, which is off until you turn it on

Analytics is opt-in. It is off when you install OOMU, it stays off if you ignore it, and nothing about the application is withheld or degraded if you leave it off. The choice is its own checkbox during setup and its own control in Settings → Storage & Privacy, separate from every other preference, so consent to one thing is never consent to another.

This changed. Earlier Beta 2 builds sent these events in the standard edition and treated Air-Gap Mode as the only way to stop them. That is no longer how it works, and the reason for the change is the one you would hope for: telemetry nobody agreed to is telemetry that should not be collected.

Three events can be sent, and only three: app_launch, first_run_completed, and session_start. The allowlist is enforced where the event is decoded, so an event name outside that set is rejected before anything is assembled. A test exists for exactly that, and it names theme_changed and action_executed as events the current build must refuse.

The request carries no values of yours at all. It is the measurement ID, a random installation identifier, the event name, a session number, a non-personalized-ads flag, and an engagement flag. There is no parameter for a theme, a locale, a file name, a prompt, or anything you typed, because there is no parameter.

Two further properties are worth stating plainly:

• Absent consent blocks dispatch before the identifier is generated, not after. With analytics off, there is no installation identifier to send, and an identifier left over from a previous choice does not grant consent.
• Withdrawing consent clears the stored identifier. Turning it back on later starts a new one. Withdrawal is not a flag that suppresses sending while the old identity waits.

Google receives your network IP address, because any connection to any server does. That is disclosed in the app rather than left for you to infer.

Air-Gap Mode still blocks analytics, along with everything else outbound, even if consent is enabled. It is now a second lock rather than the only one.

Update checks

OOMU checks once at launch against a signed manifest, verified with a minisign public key compiled into the build. You choose when to apply an update. Air-Gap Mode skips the check entirely.

Everything else

Cloud model calls, when you have configured a provider and the project permits it. Web search, when the router determines fresh information is needed. Connector calls, when you use a connected service. Messaging channel delivery, when you have configured one.

That is the complete list.

---

Deletion

Chats, projects, and workflows delete in two stages: staged with an Undo, then purged permanently when the undo period ends. secure_delete means the purge overwrites rather than merely unlinking.

The undo window is ten seconds, and it is enforced natively rather than by the toast you can see. Pressing delete a second time does not shorten the window on the first one.

What the permanent stage actually removes, for a chat:

• The session, its messages, and its attachment rows.
• The mutation replay payloads, scrubbed before the database cascade runs. This matters because a replay ledger that still held the text would make the deletion cosmetic.
• The cached attachment blobs on disk, unlinked after the commit. Your original file is untouched: OOMU deletes its own copy, not the document you imported.

Three boundaries, stated because each one is a place where a reasonable person would guess wrong:

Memory is separately visible in Settings → Profile, each entry showing its scope and its date, with a Forget button. Forget replaces the stored text and its digest, so the original wording is gone rather than hidden behind a flag, and the app declares the action irreversible because it is. Every memory record stores the session, turn, and goal it came from, so you can always see where a remembered fact originated.

---

GDPR and the EU AI Act

Settings → GDPR & EU AI Act, directly below Storage & Privacy, holds three disclosure cards. They are translated into all twelve supported languages, because a disclosure a reader cannot read is not a disclosure.

The cards open with a sentence that governs everything under them, and it is the sentence to keep:

"These disclosures describe product behavior, not legal certification."

That distinction is the whole posture. OOMU tells you what it does, in specific terms you can check against the application. It does not claim that doing those things makes anyone compliant, and neither does this page. Whether your use of any tool satisfies an obligation is a question for your counsel, who will want facts rather than a badge.

What the three cards cover

Provenance in generated documents

DOCX and XLSX files OOMU produces carry three markers in the OOXML package properties: a category of AI-Assisted Business Deliverable, OOMU_Generated set true, and OOMU_Generator naming the application.

The markers live in the document's properties, not in its visible content. There is no watermark across your text and no line added to your spreadsheet. A tool that reads file metadata can establish that OOMU generated the file; a reader opening it sees the document you asked for. Tests assert both halves of that.

Two limits, and both are deliberate:

• Metadata is not a signature. It is machine-readable provenance, not a cryptographic attestation, and it can be stripped by anything that rewrites the file. It supports an Article 50(2) marking obligation; it does not discharge one on its own, and the application says so in those terms.
• It covers DOCX and XLSX. PDF and PowerPoint output from the other native engines does not carry these properties in this build.

The narrow router is not a legal classification

The micro-router is deliberately small and deliberately constrained: it reads a request, picks local or cloud, and holds no rights to execute a tool or touch a credential.

It would be convenient to argue from that narrowness to a conclusion about how the model is classified under the AI Act. OOMU does not make that argument. A LoRA adapter changes weights, and a narrow integration does not by itself prove that general-purpose capability has been removed. The classification record kept alongside the model documents lineage, artifact hashes, and runtime limits precisely so that the question can be answered with evidence rather than with an assertion that happens to suit us.

---

The honest caveats

A page like this is only worth reading if it includes the parts that are not absolute.

• A cloud call is a cloud call. If you enable a cloud model and use it, that content goes to that provider under their terms. OOMU makes the decision visible and governable; it does not make it private.
• macOS access is coarse. Granting Automation for an app grants it for that app, not for one folder within it. That is macOS's model, and OOMU inherits it.
• A Mod is content you chose to trust. OOMU verifies its files and constrains it to three capabilities. It does not evaluate whether the content is good advice.
• A local MCP tool is a program on your Mac. You picked the executable. It runs with your privileges, and OOMU's read-only marking is a routing decision, not a kernel-level restriction.
• Encryption covers the database, not the folder. Exports, generated documents, and caches sit on disk as ordinary files.
• Deletion is not forensic erasure. Rows, replay payloads, and cached blobs go. Backups, snapshots, and unreused SSD blocks are outside what any application can promise.
• Provenance metadata is not a certification. It marks a file as AI-assisted. It does not make anyone compliant, and it survives only as long as nothing rewrites the file.
• This is a beta.

---

Related

• Enterprise security: Air-Gap Mode and the signed audit ledger.
• Local database schema: exactly what is stored.
• Evidence & receipts: how OOMU proves what it did.
• Connecting services: what each connection grants.