For One Person
For a TeamWhat we can and can’t see.
What leaves your computer when Archie works, who receives it, and how to check.
What your AI company receives.
The text your agent works on: to summarize an email, it sends the email.
Your own AI account
Your agent uses your account, and that company bills you under your agreement with it.
Your own account connects directly
Archie calls your AI company directly from your computer. There is no Otian server in that path.
Free credits and included AI pass through our server to Anthropic. We record usage costs, never conversation content. Your own AI account bypasses that route from each agent’s next start.
Your AI company’s training policy
Anthropic, OpenAI and Groq say API content is not used for training by default. Google and Mistral say that only of paid usage. DeepSeek trains on it; we could not verify xAI’s API terms.
Email and text reading need your own AI account. Our starter credits and included AI do not run them.
We keep no copy of your conversations that we can read. See the operational records we keep.
Web searches also reach your AI company’s search service. On your own AI account they never pass through us.
Read each AI company’s policy and source
In their own words
Every company Archie connects to, on training with what goes through its API: quoted where we can, linked either way. All checked in August 2026.
-
Anthropic (Claude)
“Anthropic may not train models on Customer Content from Services.”
Commercial Terms of Service -
OpenAI (ChatGPT)
OpenAI’s API data usage policy states that content sent through its API is not used to train its models by default, and is retained for up to 30 days.
Read it directly: OpenAI API data usage policies -
Google (Gemini)
“Google doesn’t use your prompts (including associated system instructions, cached content, and files such as images, videos, or documents) or responses to improve our products.”
Paid tier only. Google’s free tier trains on what you send, and an AI Studio key can be either kind; your own Google billing says which yours is. Gemini API Additional Terms of Service -
Groq
“Groq is not permitted to use Inputs or Outputs for training or fine-tuning any AI Model Services or other models, unless explicitly granted permission or instructed by Customer.”
Groq Services Agreement -
xAI (Grok)
We cannot vouch for xAI either way: its primary terms refuse automated readers, so we have not verified them from the source. What is corroborated is that the consumer Grok app trains on conversations by default. If you connect xAI, read its API terms yourself before deciding what to send.
Read it directly: xAI Privacy Policy and Enterprise Terms -
Mistral
Mistral splits the way Google does: its free mode trains on what you send by default, and pay-as-you-go does not. Your own Mistral billing says which your key is.
Mistral Commercial Terms and their opt-out note -
DeepSeek
Read this one before you connect DeepSeek. Its terms say nothing about training. Its privacy policy says personal data is used “to train and improve our technology” and is collected, processed and stored “in People’s Republic of China”, with no end date on retention.
Its opt-out is regional: the EEA, the UK and Switzerland have it, and nobody else is told they do. Its models are open weight, so a copy you run on your own hardware and point Archie at sends DeepSeek nothing; that is the only form of it we would call safe.
Read it directly: DeepSeek Privacy Policy
What Archie sends, and where.
| What | Where it goes | What’s actually in it | Your content? |
|---|---|---|---|
| Your agent thinking | Your AI company: directly, never through us | Your prompt, the conversation, and whatever file, message, or transcript the agent is working with. | Yes |
| Your agent thinking, while you are on free credits or the plan with the AI included | Our billing service, archie-4f35.onrender.com, then Anthropic |
The same as above. Free credits and the plan’s $25 a month are spent on our Anthropic account, so our server forwards each request. It records your account ID, the word count each way and the cost, never a message or reply. Your agent reads no email or texts here. An AI account of your own ends this row from each agent’s next start. | Yes, in passing |
| Signing in | Google Firebase (our account system) | Your email address. | No |
| License check | Google Firebase, and our billing service, archie-4f35.onrender.com |
Your account ID and a sign-in token, to read your own account record and fetch a signed copy of your license from our billing service. Both return only facts about your own account. It runs for as long as you use Archie, on any AI account. | No |
| Update check | otianai.com | Nothing. A plain request carrying no version number, nothing identifying your computer, no account. The site is hosted on GitHub Pages behind Cloudflare, so both companies’ servers see the IP address and the usual request details. We run no server for it. | No |
| Downloading an update | GitHub | The app file. Signed, and verified on your computer before it installs. | No |
| Adding an add-on | Our billing service, archie-4f35.onrender.com |
Which add-on, and your sign-in token so the count can’t be faked. We add one to that add-on’s public install total and keep no record of who you are. It happens on every add-on you add, on any AI account, and does not stop when the free credits do. | No |
| Your connected accounts | Google, Microsoft, iCloud, Fastmail, Yahoo, AOL, Zoho Mail, GMX, Telegram, Discord, Slack, Matrix, Todoist, Fireflies, GoHighLevel, and any service you connected with a key of your own: directly. Lights you added from your own wifi (Philips Hue, WiZ, LIFX): over that wifi, and the request never leaves your network | Whatever you asked your agent to do there, on your own tokens. It reaches them, the way it would if you did it yourself. It does not reach us. | Yes, to them |
| Crash and error reports | Our database | Where in our code a crash happened and a shortened trace; the crash message stays on your disk. Error reports name an add-on that keeps failing and its tool, or give the error line. Each carries your account ID, version, edition and Mac or Windows, scrubbed of anything secret-shaped. Five a launch at most; no crash older than a week. Switched off in Settings, it stops and deletes anything waiting. | None |
| Which version you are running | Our database | Once every six hours: your account ID, version and edition, Mac or Windows, and the time. It overwrites itself, and tells us which versions are still out there before we switch one off. There is no analytics service in Archie. Two counts exist, both on this page: each add-on’s public install total, and your free-credit ledger. The crash-report switch in Settings turns this off. | None |
Find Archie sending something this page does not describe? Tell us, publicly if you like.
Everything our servers hold.
This page keeps the whole list, and anything we start holding appears here that day. If a shorter version elsewhere does not link here, believe this one and tell us.
What we hold
- Your email address, so you can sign in
- Whether you have a current plan
- Which version of the Terms you agreed to when you signed in, and when
- Which version of Archie you are running, until you turn that off
- Crash reports and error reports, if you leave them on: where in our code it broke, the error line when something keeps failing, and, for an add-on, its name and the tool that failed. Never what you wrote
- On free credits or the plan with the AI included, the ledger of what each call spent. Beside it, a scrambled one-way stamp of the computer and internet address that claimed them, so one computer cannot claim them over and over. We can only tell that two stamps match, never read a computer or address back out of one
- Second-factor records, guided-session invoices if you book one, and a record of a checkout that was refused (the account, the country, the amount)
- Your address on the weekly letter’s list, marked on or off. Turning it off leaves a note that you said no, so a later run cannot put you back; deleting your account removes the address and the note together
- If you turn on phone access, the messages between your computer and your phone, sealed with a key we never receive. Three things about each one are not sealed: when it was left, which version left it, and whether it has been picked up. So we can see that a phone is running a computer, and roughly when, but not a word of what it did
- With phone access on, the name your phone reported when it paired
What we don’t
- Your prompts and your agent’s replies. On free credits or the plan with the AI included, they pass through our server on the way to Anthropic, and nothing there writes them down
- Your files, notes, and knowledge base
- Everything your agent remembers
- Your calendar, your emails, and any message we could read
- Your API keys
- A record of which add-ons you use
- A record of what you open or run, beyond the credit ledger and add-on failure reports above
Where a chat app carries your agent’s messages
If you connect a chat app, what your agent says to you crosses that company’s servers like any other message there. iMessage on a Mac is the exception, because Apple encrypts it end to end.
With Archie Mobile, your computer seals every message before it leaves, under a key it makes itself and hands to your phone through a code you scan. The key never passes through us, so we hold the sealed messages and cannot open them, in the same mailbox listed above. The app does not run your agent; your computer does.
Get it from the App Store on iPhone, or as a file on Android. See what Archie Mobile will and will not do, with what stays readable to us and what sealing cannot protect you from.
Where your information goes puts this list on one page to print, beside what stays on your computer, what goes to your AI company, and how to turn each one off.
Where we fall short.
When any of this changes, it changes here the same day.
Read what your agent asks you to approve.
Your agent proposes the exact action first, and the app enforces that rather than asking the AI to behave. A text goes out when you press Send, and an email when you send it or set a time, which your agent cannot set for itself. A calendar change applies only on a later message of yours, exactly as proposed and never while you are away.
The AI is what reads that message as a yes, and what the gate cannot stop is a wrong proposal. If it misreads you and you approve without looking, it carries the mistake out faithfully. The full version →
Your agent buys only if you switch that on, at shops you pick, up to a limit you set, and after you tap to approve each order. It never types a card you pay with.
The limit is checked against the price it reads on the page, so a shop that adds a charge at the last step can go over it. For a ceiling nobody gets past, give it a card from your bank that works at one shop, with its own limit. What buying looks like →
Unprompted, it messages only you (on a shared Archie for Teams agent, also the people you let in). Anything it writes to anyone else waits for you, and a web form it fills stops before the button that submits it.
Untrusted text can reach your agent, and the gate won’t fully fix it.
A hostile message hidden in a Slack attachment, a meeting transcript or a web page your agent reads could try to talk it into something you never asked for. The approval gate stops that from changing anything in your connected accounts that is not easily reversible.
It does not stop everything. An injected instruction can still add items to your lists and write a note into your agent’s memory, and a note like that can steer a later job.
The worst case is a leak: a web address or a search whose text carries something from your conversation. Since Archie 0.3.5, your agent shows you any address it came up with itself and waits for your yes. A skill that searches is given only its task, never your memory or files.
We know of two ways out that remain. Text typed into a page already open goes wherever that page sends it. And a service you connect through its address for AI assistants can open pages on its own.
Asking first has a cost: a page your agent wants to open on its own judgment now waits for you. For about ten messages after your agent reads new mail or texts for you, so does a search it hands on or a site you name in passing. The full version →
Archie checks your plan each time it opens and can reach us.
So it isn’t a fully offline product. The check carries your account ID and a sign-in token, and brings back what your account can open.
The Terms say we delete nothing on your computer, in either ending. If we cease operations, they oblige us to publish “a final version of Archie that requires no license check, within 30 days of shutting down.” The full version →
If we get bought, the promises go with us or the sale doesn’t happen.
Our Terms bind any successor to the privacy commitments in them and in the Privacy Policy, and oblige us not to complete a sale that does not carry them. That covers every item on the list above. It does not need to cover your conversations, your files or your keys, because those sit on your computer and were never ours to sell.
We keep no list of which add-ons are yours.
All we keep is each add-on’s public install total. So moving your add-ons to a new computer is your backup file’s job: it holds every add-on on each agent, with your setup answers and each routine’s times. Without a backup, you add them again there.
Nobody has audited us but us.
We have no third-party penetration test and no SOC 2 report. What we offer instead is the check below, which you can run without trusting us at all.
If you say you are in trouble.
If you tell your agent you are thinking about hurting yourself, about ending your life, or that someone is putting you in danger, it stops being the character you gave it. It says plainly that this is bigger than anything it can help you with.
It names where to get help now: in the US, call or text 988, and anywhere else your local crisis line, your emergency number, or your doctor. Then it is told to stay in the conversation and follow your lead: no lecture, no condition on helping with anything else, and no raising it again once said.
The rule is in the instructions every agent is built with, rather than a filter laid over the top or something a personality supplies, so no personality can leave it out. A test in our code checks that it survives a personality written to stay in character no matter what, and holds in skills and specialists as well as chat.
Three things the rule is not. It is not monitoring: nobody at Otian AI sees the conversation, no alert reaches us, and nothing is reported to anyone. It is not reliable: your agent is a language model reading what you typed, and it can miss someone who does not say it plainly.
And it is not help in itself: it stops, says it cannot be the one for this, and tells you who can.
If you are in trouble right now, please do not wait for software. In the US, call or text 988. Elsewhere, your local emergency number.
What your computer records.
Archie writes down the things that decide what your agent can reach. That means a key saved or handed to an agent, a service connected or disconnected, and someone allowed to message an agent or stopped from doing so.
It is not a transcript. What your agent read in your mail, wrote in a reply, or said to you is not in there.
The record shows when any line in it has been changed.
Each line carries a fingerprint taken over the line before it, so changing one breaks the chain. Rewrite every fingerprint under it and the chain holds again, but now ends on a different number from the one Archie last wrote into your keychain. Archie checks both when it opens and says which way it came out. Work the switch to watch.
Nothing has been changed. Five lines, chain checked.
This record hangs together, and it is not the record this computer ended on. The last fingerprint here is 372b…c7e8. Archie wrote down 6a5f…f1f2.
- A key was saved on this computer.
25cf…f84a25cf…f84a - A Google account was connected.
dad7…7f6cdad7…7f6c - Someone was approved to message an agent.Someone was blocked from an agent.
64b3…1f3b7bda…2b7f - An outside service was disconnected: Todoist.
a394…487e7f65…3784 - Someone’s access to an agent was taken away.
6a5f…f1f2372b…c7e8
Where this computer left off, kept in the keychain: 6a5f…f1f2 Last fingerprint in the record: 6a5f…f1f2
Those fingerprints are real SHA-256 over the same bytes Archie hashes, computed in your browser. Retype any line, beside the command that reproduces it in your terminal →
On Archie for Teams you can export the whole record as a file, fingerprints included; Archie refuses to write it if the chain does not check out.
Two things the record does not do. It shows tampering but cannot stop somebody destroying it: delete the whole record and the mark of where it ended, and there is nothing left to check. That is different from nothing having happened.
And it is evidence for you about your own computer that we cannot vouch for. If you want us to prove what your agent did, we cannot.
Taking access back.
Disconnect any account from inside Archie; taking its key off the computer too is a second step, in Settings under Saved keys. Taking somebody’s access to a shared agent away is in Archie too. All of it lands in the record above.
Or do it from the other side without involving us: Google and Microsoft let you withdraw what you gave in your own account settings, and an app password can be canceled where you made it.
Taking your agent with you.
Everything you built saves to one file, from the Account page under Backups: your agents, what each one can do and remembers, your records, your writing style and the conversations. Archie can write one every week while it is open and keep the last three, once you pick a folder.
Restore it on another computer signed in as you and that one picks up where this left off. It leaves out your keys, the websites your agent signed into, the permissions your computer granted, a paired phone, and the tools it downloads, which come back by themselves. You get a list of what to connect again.
It is an ordinary, unsealed file. It holds your conversations and your records, so keep it where you would keep a tax return. It opens in Archie and nothing else. See what is inside it →
Check us in about 10 minutes.
Four of our claims you can test in this browser tab before you install anything: run those four now →
Install a network monitor.
LuLu is free and open-source. Little Snitch is paid and friendlier. Either one shows you every connection an app on your Mac tries to make, and lets you block them.
Open Archie and use it properly.
Sign in, install an add-on, and give your agent a real task with a file or your calendar. Then read the list of connections it made.
The connections you should see.
Your AI company on your key, the accounts you connected, any website your agent opens for you, and the short list of hosts of ours in the window below, each with what it carries. Anything else carrying your content means we lied or made a serious mistake: tell us. The hostnames to expect →
api.anthropic.comyour agent thinking, on your key: whichever of the 7 you connectedthe accounts you connectedyour mail, calendar and chat, on your own tokensarchie-4f35.onrender.comyour license note, add-on install countsblockedfirestore.googleapis.comsign-in and plan check; the version ping until you turn it offotianai.comthe update check, carrying nothing about youblockedassets.otianai.comonly when an add-on needs a tool, like a voicegithub.comonly while an update downloads
Block our two hosts, and on your own AI account your agent keeps thinking.
The switch above shows what happens. Then do it for real: add otianai.com and archie-4f35.onrender.com to your firewall’s block list, and on an AI account of your own your agent’s thinking carries on exactly as before. Nothing of ours is in that path.
What does stop is what those hosts are for: updates, tool downloads, the install count, and the plan check. After about two months of blocking us, everything past Personal’s free tier stops until Archie can check in once. Run the test before you connect an account and the free credits stop instead, because that one path does run through us.
Read the long version of everything on this page →
Putting Archie on a work computer? The page to send whoever approves software →
An add-on is a text file.
Nothing in an add-on can run as a program, so it cannot itself read files off your disk or open a network connection: Archie has no mechanism for it to use.
But your agent follows an add-on’s instructions and can fetch public web pages, so a malicious add-on has the same leak channel as any hostile text your agent reads. Read what an add-on says it does before you install it.
An add-on can also declare which of your connected accounts it needs, and today that is blunt: declaring “calendar” grants reading, creating and deleting together, rather than asking you about each. Connect your calendar with reading alone and no add-on gets the tools to create or delete, whatever it declared. How that works, in full →
Every add-on is read by a human before it is listed: one of the two of us, every line of every submission. This sentence changes the day that stops being true.