Privacy Policy

This Privacy Policy explains how Osaurus, Inc. (“Osaurus”, “we”, “us”) handles information when you use the Osaurus application, the osaurus.ai website, and our related hosted services, including hosted inference, prepaid credits, and Workspaces. The open-source Osaurus source code is licensed separately under the MIT License; this policy governs the distributed application, the website, and the hosted services we operate.

1. The one thing to understand first

Osaurus runs on your Mac. How your information is handled depends on which model you choose for a given task.

1. Local model. When you use a local model, your prompts, chats, files, and provider keys are processed on your device and are not sent to us or to any third party for inference. They stay on your Mac.
2. Cloud model. When you choose a cloud model, the content needed to generate a response leaves your device and is sent to the AI provider that operates that model. This is the case whether you use Osaurus hosted inference or your own provider key. Your stored conversation history still lives on your device, but the content of each request is transmitted to a provider to produce the reply.

The rest of this policy describes each path in detail. Where our public materials say that your data stays on your Mac or never leaves your device, that statement describes local model use. It does not describe cloud model use, where request content is transmitted to a provider as described below.

2. Information we collect and process

2.1 Information that stays on your device

The following are stored locally on your Mac and are not transmitted to us:

1. Your conversations, prompts, and the responses you receive.
2. Files you provide to the application.
3. API keys you enter for third-party providers.
4. Local model files you download.
5. Application settings, personas, agents, skills, and related configuration.

We do not have access to this information. If you delete it on your device, it is gone, subject to any copies you have created yourself.

2.2 Information sent to AI providers when you use a cloud model

When you select a cloud model, the content required to fulfill your request is transmitted to an AI provider. There are two cloud paths:

1. Osaurus hosted inference. If you use the hosted option, your request content is sent from your device to our routing service, which forwards it to the provider that operates the model you selected: for example Anthropic for Claude models, OpenAI for GPT models, Google for Gemini models, and Venice for open models. Each provider processes the content under its own API terms and privacy policy, which may permit it to retain the content for a limited period, for example for abuse monitoring. Venice states that in its private inference mode it does not store prompts or responses (a commitment by Venice that we cannot independently verify). We do not retain the content of your requests on our servers. For routing and billing we process only usage metadata, such as the model used, token counts, and timestamps, not the content of your prompts or responses.
2. Your own provider key. If you connect your own key for a provider such as OpenAI, Anthropic, Google, xAI, or Venice, your request content is sent from your device to that provider under that provider's own terms and privacy policy. The provider may store, log, or use that content according to its policies. We do not control that provider's handling of your content, and we encourage you to review each provider's privacy policy.

In both cloud paths we transmit only the content needed to produce a response, such as the relevant messages, attached file content you have chosen to include, and model parameters.

2.3 Payment, credit, and subscription information

If you purchase prepaid credits or subscribe to Workspaces, payment is processed by Stripe and, where you use Apple Pay, by Apple. We do not receive or store full payment card numbers. We receive transaction metadata such as a payment confirmation, the amount, a token or identifier from the processor, and the status of the charge, which we use to credit your balance, activate and maintain your subscription, and keep records. For a Workspaces subscription we also keep the subscription status, billing interval, the workspaces on the subscription, and the email address you provide at checkout, which we use to send receipts, activation instructions, and billing notices. Stripe and Apple process your payment information under their own privacy policies.

2.4 Device identity

Osaurus uses a cryptographic key generated and held on your device to identify your installation for purposes such as authorizing balance top-ups, attributing usage to your balance or to a workspace pool, operating relay features if you enable them, and identifying you as a member of a workspace. This is not a traditional account. We do not require an email address or password to use the application. The key functions as an identifier for the services described in this policy. Within a workspace, the display name you choose is visible to other members.

2.5 Workspaces

To operate a workspace we process: the workspace name; the installation identifier and display name of each member; member roles; invite links and their status; the names and configuration metadata of shared agents (not the content of their conversations); the shared credit pool balance and usage metadata; and the subscription records described in Section 2.3. Conversations with shared agents are exchanged between members' Macs over an encrypted network hosted by the team, or sent to a cloud provider as described in Section 2.2. We do not store their content. Workspace owners and admins can see who is a member, their roles, and credit pool usage. If your workspace is operated by your employer or another organization, that organization is responsible for how it uses the workspace and may have its own privacy notice.

2.6 Relay and remote access

If you enable relay or remote access features, network traffic for those features is routed through infrastructure we operate (for example, subdomains under agent.osaurus.ai) so that the feature can function. If you do not enable these features, this processing does not occur.

2.7 Diagnostic and usage data

If you opt in, we collect de-identified diagnostic and usage data to find and fix problems and to understand how the application is used. This data is processed by Sentry on our behalf. It is de-identified and is not used to identify you, although some technical fields, such as IP address, may be processed transiently by Sentry. It does not include your chats, prompts, files, or keys. It may include information such as crash reports, error traces, feature usage events, and basic technical characteristics of your device and the application. You can change your participation at any time in Settings. If you do not opt in, this collection does not occur.

2.8 Website

1. Forms and email. If you contact us, submit an enterprise inquiry, or subscribe to our newsletter on osaurus.ai, we collect the information you enter, such as your name, email address, company, team size, and message. We use Resend to deliver these messages to us and to send you confirmations and newsletters. Newsletter and contact addresses are kept in our Resend audience so we can reply and, if you subscribed, send you updates; every newsletter includes an unsubscribe link.
2. Cookies and similar technologies. Our website shows a consent banner. Strictly necessary storage (such as your consent choice) is always used. With your consent for analytics, we load Google Tag Manager and the analytics tools it manages to understand how the site is used. With your consent for marketing, we load the Meta Pixel and the Reddit Pixel to measure the effectiveness of our advertising. You can change or withdraw consent at any time through the Cookies link in the website footer.
3. Hosting logs. Our website is hosted on Vercel, which processes standard server logs, such as IP address, browser type, and the pages requested, in order to deliver the site and protect it from abuse.

3. How we use information

We use the information described above to:

1. Provide the application and its features, including routing cloud requests when you choose a cloud model.
2. Process payments, maintain your prepaid credit balance, and operate your Workspaces subscription and shared credit pool.
3. Operate workspaces, including membership, roles, invites, and shared agents.
4. Operate relay and remote access features when you enable them.
5. Diagnose problems, maintain security, and improve the application, using opt-in diagnostic and usage data.
6. Respond to your inquiries and, if you subscribed, send you our newsletter.
7. Understand how our website is used and measure our advertising, only where you have given consent.
8. Comply with law and enforce our Terms of Service.

We do not use the content of your conversations to train models. This commitment applies to Osaurus; third-party providers reached through hosted inference or your own provider key handle your content under their own terms, which may permit training.

4. How we share information and our subprocessors

We do not sell your personal information. We share information only with service providers that help us operate, and only as needed for the purposes above. Where you have given marketing consent on our website, advertising pixels may collect information about your visit; see Section 7 for how this is treated under California law and how to opt out.

Our current subprocessors include:

• Anthropic, OpenAI, Google, and Venice — hosted inference; each receives the request content for the models it operates when you use a hosted cloud model
• Third-party model providers you select (OpenAI, Anthropic, Google, xAI, Venice, others) — inference when you connect your own key (request content sent under that provider's terms)
• Stripe — payment processing for credit purchases and Workspaces subscriptions (payment, subscription, and transaction metadata; checkout email address)
• Apple — Apple Pay payment processing (payment and transaction metadata)
• Sentry — opt-in application diagnostics (de-identified crash and usage data)
• Vercel — website hosting (server logs)
• Resend — contact form, enterprise inquiry, and newsletter delivery (name, email, company, message)
• Google (Tag Manager and analytics) — website analytics, only with your consent
• Meta and Reddit — advertising measurement pixels, only with your consent

We may also disclose information if required by law, to respond to lawful requests, to enforce our agreements, or to protect the rights, safety, and security of users, the public, or Osaurus. Enterprise customers can request a data processing agreement at enterprise@osaurus.ai.

5. The privacy filter

Osaurus includes a feature that attempts to detect and remove certain personal information from request content before it is sent to a cloud provider. This feature reduces the chance that detectable personal information is transmitted, but it cannot detect or remove all personal or sensitive information. Do not rely on it as a guarantee. You remain responsible for the content you choose to send to a cloud model.

6. Data retention

1. Information stored on your device is retained until you delete it.
2. Billing, subscription, and transaction records are retained for as long as needed to provide the service and to meet legal, tax, and accounting obligations.
3. Workspace records (membership, roles, shared agent metadata, and pool usage) are retained while the workspace exists, including while it is suspended, and are deleted within a reasonable period after the workspace is removed, subject to the billing retention above.
4. Contact and enterprise inquiries are retained for as long as needed to respond and follow up. Newsletter addresses are retained until you unsubscribe.
5. Opt-in diagnostic and usage data is retained for the period necessary for the purposes described above.

7. Your privacy rights

Depending on where you live, you may have rights regarding your personal information, such as the rights to access, correct, delete, or obtain a copy of it, and to object to or restrict certain processing.

1. California residents. Under the CCPA as amended by the CPRA, you may have the rights described above and the right not to receive discriminatory treatment for exercising them. We do not sell personal information. Our website's optional advertising pixels (Meta and Reddit) may be considered “sharing” personal information for cross-context behavioral advertising under that law. These pixels load only if you consent, and you can opt out or withdraw consent at any time through the Cookies link in the website footer.
2. European Economic Area, United Kingdom, and similar jurisdictions. If the GDPR or a similar law applies to you, you have the rights described above and may lodge a complaint with your supervisory authority. Our legal bases for processing are contract performance, legitimate interests, consent for opt-in diagnostics and for website analytics and marketing, and legal obligation.
3. Workspace members. If you are a member of a workspace operated by an organization, that organization controls the workspace and its membership. You can direct requests about workspace data to the organization or to us, and we will assist as appropriate.

To exercise a right, contact us at hello@osaurus.ai. Because much of your information is stored only on your device and is not accessible to us, some requests may be satisfied by you directly through the application.

8. International data transfers

If you use a cloud model, your request content may be processed by providers and infrastructure located outside your country. We rely on appropriate safeguards for such transfers where required by applicable law.

9. Security

We use technical and organizational measures intended to protect information we process. No method of transmission or storage is completely secure, and we cannot guarantee absolute security. Cloud request content and workspace traffic are transmitted over encrypted connections.

10. Children

Osaurus is not directed to children under 13, and we do not knowingly collect personal information from them.

11. Changes to this policy

We may update this policy from time to time. When we make material changes, we will update the date above and notify you through the application or on the website.

12. Contact

Questions about this policy can be sent to hello@osaurus.ai. For data processing agreements and enterprise privacy questions, contact enterprise@osaurus.ai.