Privacy Policy

1. The one thing to understand first

Osaurus runs on your Mac. How your information is handled depends on which model you choose for a given task.

1. Local model. When you use a local model, your prompts, chats, files, and provider keys are processed on your device and are not sent to us or to any third party for inference. They stay on your Mac.
2. Cloud model. When you choose a cloud model, the content needed to generate a response leaves your device and is sent to an AI provider to process your request. This is the case whether you use Osaurus hosted inference or your own provider key. Your stored conversation history still lives on your device, but the content of each request is transmitted to a provider to produce the reply.

The rest of this policy describes each path in detail. Where our public materials say that your data stays on your Mac or never leaves your device, that statement describes local model use. It does not describe cloud model use, where request content is transmitted to a provider as described below.

2. Information we collect and process

2.1 Information that stays on your device

The following are stored locally on your Mac and are not transmitted to us:

1. Your conversations, prompts, and the responses you receive.
2. Files you provide to the application.
3. API keys you enter for third-party providers.
4. Local model files you download.
5. Application settings, personas, agents, skills, and related configuration.

We do not have access to this information. If you delete it on your device, it is gone, subject to any copies you have created yourself.

2.2 Information sent to AI providers when you use a cloud model

When you select a cloud model, the content required to fulfill your request is transmitted to an AI provider. There are two cloud paths:

1. Osaurus hosted inference.If you use the hosted option, your request content is routed through Venice, our inference partner, to generate a response. Under Venice's stated policy for its private inference mode, Venice does not store prompts or responses (a contractual commitment by Venice that we cannot independently verify). We do not retain the content of your requests on our servers. For routing and billing we process only usage metadata, such as token counts and timestamps, not the content of your prompts or responses.
2. Your own provider key.If you connect your own key for a provider such as OpenAI, Anthropic, xAI, or Venice, your request content is sent from your device to that provider under that provider's own terms and privacy policy. The provider may store, log, or use that content according to its policies. We do not control that provider's handling of your content, and we encourage you to review each provider's privacy policy.

In both cloud paths we transmit only the content needed to produce a response, such as the relevant messages, attached file content you have chosen to include, and model parameters.

2.3 Payment and credit information

If you purchase prepaid credits, payment is processed by Stripe and, where you use Apple Pay, by Apple. We do not receive or store full payment card numbers. We receive transaction metadata such as a payment confirmation, the amount, a token or identifier from the processor, and the status of the charge, which we use to credit your balance and keep records. Stripe and Apple process your payment information under their own privacy policies.

2.4 Device identity

Osaurus uses a cryptographic key generated and held on your device to identify your installation for purposes such as authorizing balance top-ups, attributing usage to your balance, and operating relay features if you enable them. This is not a traditional account. We do not require an email address or password to use the application. The key functions as an identifier for the services described in this policy.

2.5 Relay and remote access

If you enable relay or remote access features, network traffic for those features is routed through infrastructure we operate (for example, subdomains under agent.osaurus.ai) so that the feature can function. If you do not enable these features, this processing does not occur.

2.6 Diagnostic and usage data

If you opt in, we collect de-identified diagnostic and usage data to find and fix problems and to understand how the application is used. This data is de-identified and is not used to identify you, although some technical fields, such as IP address, may be processed transiently by our diagnostics provider. It does not include your chats, prompts, files, or keys. It may include information such as crash reports, error traces, feature usage events, and basic technical characteristics of your device and the application. You can change your participation at any time in Settings. If you do not opt in, this collection does not occur.

3. How we use information

We use the information described above to:

1. Provide the application and its features, including routing cloud requests when you choose a cloud model.
2. Process payments and maintain your prepaid credit balance.
3. Operate relay and remote access features when you enable them.
4. Diagnose problems, maintain security, and improve the application, using opt-in diagnostic and usage data.
5. Comply with law and enforce our Terms of Service.

We do not use the content of your conversations to train models. This commitment applies to Osaurus; third-party providers reached through the hosted path or your own provider key handle your content under their own terms, which may permit training.

4. How we share information and our subprocessors

We do not sell your personal information, and we do not share it for cross-context behavioral advertising. We share information only with service providers that help us operate, and only as needed for the purposes above.

Our current subprocessors include:

• Venice — hosted inference for the Osaurus hosted path (request content you submit to a hosted cloud model)
• Third-party model providers you select (OpenAI, Anthropic, xAI, Venice, others) — inference when you connect your own key (request content sent under that provider's terms)
• Stripe — payment processing for credit purchases (payment and transaction metadata)
• Apple — Apple Pay payment processing (payment and transaction metadata)
• Diagnostics provider — opt-in diagnostic and usage data (anonymous, aggregated technical and usage data)

We may also disclose information if required by law, to respond to lawful requests, to enforce our agreements, or to protect the rights, safety, and security of users, the public, or Osaurus.

5. The privacy filter

Osaurus includes a feature that attempts to detect and remove certain personal information from request content before it is sent to a cloud provider. This feature reduces the chance that detectable personal information is transmitted, but it cannot detect or remove all personal or sensitive information. Do not rely on it as a guarantee. You remain responsible for the content you choose to send to a cloud model.

6. Data retention

1. Information stored on your device is retained until you delete it.
2. Billing and transaction records are retained for as long as needed to provide the service and to meet legal, tax, and accounting obligations.
3. Opt-in diagnostic and usage data is retained for the period necessary for the purposes described above.

7. Your privacy rights

Depending on where you live, you may have rights regarding your personal information, such as the rights to access, correct, delete, or obtain a copy of it, and to object to or restrict certain processing.

1. California residents. Under the CCPA as amended by the CPRA, you may have the rights described above and the right not to receive discriminatory treatment for exercising them. We do not sell or share personal information as those terms are defined under that law.
2. European Economic Area, United Kingdom, and similar jurisdictions. If the GDPR or a similar law applies to you, you have the rights described above and may lodge a complaint with your supervisory authority. Our legal bases for processing are contract performance, legitimate interests, consent for opt-in diagnostics, and legal obligation.

To exercise a right, contact us at hello@osaurus.ai. Because much of your information is stored only on your device and is not accessible to us, some requests may be satisfied by you directly through the application.

8. International data transfers

If you use a cloud model, your request content may be processed by providers and infrastructure located outside your country. We rely on appropriate safeguards for such transfers where required by applicable law.

9. Security

We use technical and organizational measures intended to protect information we process. No method of transmission or storage is completely secure, and we cannot guarantee absolute security. Cloud request content is transmitted over encrypted connections.

10. Children

Osaurus is not directed to children under 13, and we do not knowingly collect personal information from them.

11. Changes to this policy

We may update this policy from time to time. When we make material changes, we will update the date above and notify you through the application or on the website.

12. Contact

Questions about this policy can be sent to hello@osaurus.ai.