OHarness
Download
Legal

Privacy Policy

Legal documents are published in English only: a contract in ten languages needs a clause deciding which one governs, and a translated term of art is a changed term.

Last updated: October 5, 2026

This policy is published by Litbox LLC, 30 N Gould St, Ste N, Sheridan, WY 82801, United States, which operates OHarness and is responsible for the personal data described here. The Terms of Service use the same names for the same things.

The short version

The software runs on your machine and keeps its history there. Used without an account, it sends your prompts to the model provider you configured and nothing to us, except an update check from the desktop app and analytics you have opted into. Once you sign in, three more things reach us: requests to models on our plan, which our gateway forwards and meters without storing their content; your sessions and memory notes, which sync to our servers by default and which you can turn off; and your account and billing records. The iPhone app keeps its conversations on the phone, and when it controls your Mac the relay in between cannot read what passes through it. This website sets cookies and runs analytics. We do not sell personal data, show advertising, or track you across other companies’ apps and sites.

1. This website

Cookies. Two kinds, both described below. Analytics writes one called ph_<project key>_posthog, which holds a random identifier for your browser and is set on every visit, and Google Analytics writes two more — _ga and _ga_<measurement id>, which do the same job for the same reason and are the reason the paragraph on consent below is not rhetorical. Signing in adds a small group of cookies whose names begin with sb-, holding the access and refresh tokens for your session; every request you make refreshes them, so a tab left open overnight is still signed in. Signing out and clearing site data both remove them. We use analytics on the basis of our legitimate interest in understanding how the site is read and improving it. You can block these cookies in your browser, or with a content blocker, without losing anything else on the site.

Analytics. We use PostHog to count visits and see which pages people read. It records page views, including the ones that happen when you move between pages without a reload; clicks and form submissions, described by the element you interacted with rather than by anything you typed; the page address and the referrer that sent you; your browser, operating system and screen size; and an approximate location derived from the IP address the event arrives with. Events go to PostHog Cloud in the United States — us.i.posthog.com, unless a deployment points NEXT_PUBLIC_POSTHOG_HOST elsewhere — and no further. Nothing is captured at all from a development build. Session replay — a recording of what happens on the page — is turned off.

Two more counters, named because they are here. Alongside PostHog the site loads DataFast, a traffic dashboard which records the same shape of thing — page address, referrer, browser, approximate location from the IP the request arrives with — and Google Analytics, which does that and is also what Search Console and anything advertising-adjacent attach to. Neither is asked for anything you type, and neither is given a name or an email address by this site. DataFast is served from datafa.st and Google’s tag from www.googletagmanager.com, with its events going on to Google. Both rely on the same legitimate interest as PostHog and can be blocked the same way; section 13 covers data that goes to the United States.

No other third-party scripts, and nothing else loaded from another host. There is no error-reporting service and no embedded widgets. The fonts are the ones already on your system and the images are served from this domain. Analytics are the exception to that list, and one of the three reaches its vendor through this domain rather than directly: PostHog’s script and events are addressed to /ingest here, and this server forwards them on. That is done so content blockers, which block posthog.com by name, do not quietly remove a slice of the readership from the numbers — not to disguise where the data ends up, which is what these paragraphs are for. The other two are loaded from their own hosts and are blocked or not on their own merits.

Local storage. Choosing light or dark in the header writes oharness.theme to your browser’s local storage so the choice survives a reload; that one never leaves your browser. PostHog keeps its own entries alongside it, under the same ph_ prefix as its cookie. Clearing site data removes both.

Language. Your browser sends an Accept-Language header with every request; we read it once to redirect you to the matching version of the page, and do not store it.

Server logs. This site, the gateway and the sync service are hosted on Railway, which keeps standard request logs, including IP addresses. Railway keeps them for at most 90 days. We use them to run the services, investigate errors and keep them secure, which is our legitimate interest.

2. The software on your machine

What is stored, and where. Sessions, transcripts, settings and credentials live in a directory on your machine — ~/.oharness by default, or wherever OHARNESS_HOME points. Credentials are written with file mode 0600 inside a 0700 directory. Deleting that directory deletes your local history; deleting your account does not touch it.

What leaves your machine without an account. The prompts you write, and whatever file contents, command output or tool results the agent includes in a request, are sent to the model provider you configured, directly. If you point it at a model running locally, none of that leaves your machine. Besides that, the desktop app checks cdn.oharness.ai for updates, which tells us the request’s IP address and the app’s version.

Analytics, only if you opt in. The official builds of the desktop app and the browser interface can send usage analytics to PostHog, and the desktop app to DataFast as well. Both are off until you turn them on in Settings, and you can turn them off there again. What they send is named events for actions — a panel opened, a prompt submitted, a permission answered, a model switched — and never their content: no prompts, file paths, diffs or transcripts, and no session replay. A build you make yourself from the source cannot send analytics anywhere. The command line and terminal interfaces contain none.

What changes when you sign in. The sections below: requests to models on our plan go through our gateway (section 4), sessions and memory sync by default (section 5), and cloud connectors become available (section 6).

Your own sync server. If you run the sync server yourself and point the agent at it, what it stores is on your server and is your data.

3. Your account

Accounts live in Supabase. For each account we hold:

  • Identity: your email address, an account id, how you sign in, and the name and profile picture your sign-in provider gives us. With a password, Supabase stores it as a hash and never gives it back. Signing in with Google tells us the address on the Google account. Signing in with Apple tells us the address you chose to share — if you choose “Hide My Email”, that is a private relay address that forwards to you, and we never learn the real one.
  • Billing: your plan, its status and billing period, the Stripe customer and subscription ids, and your auto top-up setting and amount.
  • Credits and usage: a ledger of every grant, purchase and charge. A charge records the model, the input and output tokens or the units of media (images, seconds or characters), the credits charged, which of your API keys made it if one did, a request id and the time. Generation jobs are tracked the same way until they finish. This is what your usage page shows.
  • API keys: a name, a short prefix, a hash of each key and when it was last used — not the key itself.
  • Teams: which teams you belong to and your role, invitations (with the invited email address), and a breakdown of the team’s usage by member, which the team’s admins can see.
  • Things you send us on purpose: feedback messages and any files attached to them, with the app version and platform; and artifacts you publish, whose content is stored so that the link can serve it.

If you have not signed in, we hold no account data about you — only the website analytics and logs described above.

4. Prompts and outputs through the gateway

On our plan, the agent and the iPhone app send model requests — your prompts, and whatever files, images, command output or tool results are included — to our metering gateway. The gateway forwards each request through OttoPort (ottoport.ai), the upstream model gateway that Litbox LLC also operates, to the vendor that serves the model: OpenAI, Anthropic, Google, DeepSeek, Moonshot, Alibaba, ByteDance, MiniMax, Kuaishou, Midjourney or another vendor in the catalogue. Depending on the model, OttoPort reaches the vendor directly or through an inference provider that resells the vendor’s models — OpenRouter, Atlas Cloud, WaveSpeed, fal, Kie or LegNext. The provider and the vendor process the request under their own terms and privacy policies.

The gateway does not store the content of your requests or of the responses. It reads the request to find the model and to price it, and it writes the usage record described in section 3. Its logs carry the account id, the model, a request id and timings, not prompts or outputs. We apply the same practice at OttoPort: it reads a request to route and price it, and does not store the content of requests or responses; its records of a request carry the model, what it cost, a request id and timings; they are kept as part of our billing records (section 11). A generated image or video is delivered by the vendor or by OttoPort; a file OttoPort delivers stays available at its address for 3 days and is then deleted, so save anything you want to keep.

Dictation in the desktop app and the browser interface. When you dictate a message there, the recording is sent through the gateway and OttoPort to a speech-to-text model — Alibaba’s Qwen recogniser for Chinese, OpenAI’s otherwise, reached directly or through OpenRouter — and the text comes back. If you are not signed in and have set your own OpenAI key, the recording goes to OpenAI directly instead. On a plan, or with your own key, the recognised text is then sent to a fast model to tidy it. Neither the gateway nor OttoPort stores the recording or the text; a recording is limited to five minutes.

5. Sync and memory

When you are signed in, the agent mirrors to our sync service, by default:

  • Session feeds — transcripts, artifact revisions and session metadata — so a session can be picked up on another machine. A session synced to a team can be read by the team’s members.
  • Memory — the Markdown notes the agent keeps about you and your projects — stored in a private Cloudflare R2 bucket.

Both travel over TLS and are stored privately, but they are not end-to-end encrypted: our service can read them. You can turn sync off for a machine, a repository, a single run or memory alone, and the agent then sends nothing further; turning it off does not delete what was already uploaded. Free accounts have limits on how many notes sync and how large each is. Session logs, files and credentials are never part of memory sync. Session feeds are stored by the sync service on Railway, in the United States.

6. Cloud connectors

Connecting an app such as Gmail, Slack or GitHub is done on a page hosted by Composio, and the app’s OAuth credentials are held by Composio, not by us. When the agent uses a connected app, the request — and the data the app returns, such as an email or an issue — passes between the agent, our site and Composio, and from there into the conversation with the model. We do not store that data. Composio’s handling of it is described in its own privacy policy.

7. The iPhone app

  • On the phone. Your session token is kept in the iOS Keychain, and so is the phone’s own key for remote control and the keys of the Macs it has paired with. Your conversations, and the images and videos you generate, are stored on the phone in the app’s private storage, not on our servers. Deleting the app deletes them.
  • Chat and generation go through the gateway exactly as section 4 describes; connected apps as section 6 describes.
  • Microphone and speech recognition are used only while you are dictating a message, to turn your speech into text. Recognition runs on the device where the iPhone supports that, and otherwise through Apple’s speech service, under Apple’s privacy policy. Audio is not sent to us. On a plan, the recognised text — not the audio — is sent through the gateway to a fast model to tidy it, as section 4 describes for any request.
  • Camera and photo library are used only when you take or choose a photo to attach to a message; only the photo you attach is sent.
  • No analytics, advertising or tracking SDKs. The app does not track you across other companies’ apps or websites.
  • Purchases are processed by Apple. RevenueCat receives the purchase record and an id for your account, so that it can confirm the purchase and tell us to grant the credits. Apple does not give us your payment details.

8. Remote control

When remote control is on, your Mac and your phone each connect to our relay. The relay checks your sign-in and knows your account id; the id and name of each Mac that is online and each phone that connects; and which phone has a channel open to which Mac. It logs when a Mac connects and disconnects. Everything after the pairing handshake — your prompts, the agent’s replies, files you send, what it shows you from the Mac — is sealed end to end between the phone and the Mac, and the relay cannot read it. It keeps none of it. The relay is hosted on Railway, in Singapore.

9. Payments

Purchases on the web are processed by Stripe. Card details are entered on Stripe’s own page and never reach us; we receive the customer and subscription ids, the plan, its status and the payment events Stripe sends. Purchases in the iPhone app are processed by Apple, with RevenueCat as described above. Each of them handles your data under its own privacy policy and keeps its own records as the law requires of it.

10. Who we share data with

We share personal data only with the service providers that run OHarness for us, each receiving only what its part needs:

  • Supabase — accounts, sign-in, billing and usage records, feedback, published artifacts.
  • Railway — hosting for this site, the gateway and the sync service.
  • Cloudflare — R2 storage for synced memory and for app downloads and updates.
  • Stripe — web payments.
  • Apple and RevenueCat — in-app purchases; Apple also for Sign in with Apple and speech recognition.
  • Google — Sign in with Google, and Google Analytics on this site.
  • The model vendors listed in section 4 — the content of requests made on our plan, passed on to them by OttoPort, our own upstream gateway.
  • OpenRouter, Atlas Cloud, WaveSpeed, fal, Kie and LegNext — the inference providers OttoPort may route a request through on its way to the vendor (section 4), including dictation recordings from the desktop app.
  • Composio — cloud connectors.
  • PostHog and DataFast — website analytics, and app analytics if you opt in.
  • Resend — sign-in links, invitations and account email.

We may also disclose data where the law requires it, to protect our rights or users’ safety, or to a successor if the business is sold. We do not sell personal data or share it for cross-context behavioural advertising, and we do not use it to show you ads.

11. How long we keep it, and deleting it

We keep account data for as long as you have the account. You can delete the account yourself, from the dashboard settings on this website or in the iPhone app. Deleting it, in this order:

  • stops a subscription billed through Stripe from renewing — it is not cancelled immediately, but ends with the period already paid for, and the rest of that period is not refunded;
  • erases everything the account synced — session feeds and memory — and blocks further uploads from devices still signed in;
  • deletes the account and, with it, its billing record, credit ledger and usage history, API keys, feedback and published artifacts.

If you own a team, you must delete it or hand it over first. A team’s own usage records stay with the team, with your name removed from them. Stripe and Apple keep their own records of past payments, and we keep invoices and payment records we are required to retain for tax and accounting for seven years. Server logs expire on the host’s schedule (at most 90 days). Screenshots and recordings you attached to feedback are removed from storage with the account. A subscription bought through the App Store must be cancelled by you in Settings › Apple Account › Subscriptions; deleting the account does not stop Apple billing it. Data on your own machines and phone is not touched by deleting the account.

12. Your rights

Depending on where you live — including the EU, the UK and several US states — you may have the right to access, correct, delete or receive a copy of personal data we hold about you, and to object to or restrict how we use it. Much of it you can see and act on yourself: your usage and billing in the dashboard, and deletion as described above. For anything else, write to [email protected] from the address on your account, and we will respond within 30 days, or sooner where the law where you live requires it. We will not treat you differently for exercising these rights. You may also complain to your local data protection authority.

Why we may use your data. To provide what you signed up for — your account, the services, payments and support — because it is necessary for our contract with you; to keep the services running, secure and improving, and for the analytics described in section 1, because we have a legitimate interest in doing so; to keep tax and accounting records, because the law requires it; and with your consent where the law asks for it, which you can withdraw at any time.

13. International transfers

Litbox LLC is in the United States, and most of the providers above process data there. Model vendors may process requests in other countries, including China for some of the models in the catalogue. Where personal data of readers in the EU or the UK goes to the United States or elsewhere, we rely on the EU–US Data Privacy Framework where the provider is certified under it, and on the European Commission’s standard contractual clauses (with the UK addendum) otherwise.

14. Security

Connections to our services use TLS, card details never reach us, API keys are stored as hashes, remote-control traffic is sealed end to end, and access to the databases is limited by row-level security and service credentials. No system is perfectly secure; if we learn of a breach affecting your data we will tell you as the law requires.

15. Children

OHarness is not directed at children. You must be at least 13 to have an account [16 where local law sets a higher age of digital consent], and we do not knowingly collect data from anyone younger. If you believe a child has given us data, write to us and we will delete it.

16. Changes

Material changes will be reflected here, with the date at the top and foot of the page. If you have an account we will email you about a change that matters; if you do not, this page is the only notice there is.

17. Contact

Litbox LLC, 30 N Gould St, Ste N, Sheridan, WY 82801, United States — [email protected].

Last updated: October 5, 2026← Back to home