This is the version of the privacy story that's longer than the marketing copy and shorter than the legal page. If you want the legal version, see the Privacy Policy.

The default: local-first

By default, your Corivo data lives on your device. Not on our servers, not on a partner's servers, not in a cloud database keyed by your email. Your machine is the source of truth.

Corivo's desktop app is open source under Apache-2.0, so you can inspect the local-first implementation directly at https://github.com/Principle-Labs/corivo-desktop. Treat that as implementation evidence alongside this policy, not as a replacement for the privacy commitments below.

Concretely:

Captures (accessibility text plus foreground app/window metadata) are written to a local SQLite database. The default path is ~/Library/Application Support/Corivo/ on Mac and %APPDATA%\Corivo\ on Windows.
Tokens for connected tools — Notion, Slack, Gmail, Google Calendar, Google Docs, GitHub, GitLab, Linear, Feishu, Sentry, Intercom, Mem, and more — live on your device, in the operating system keychain (macOS Keychain on Mac, Credential Manager on Windows). The data flows from each tool directly to your computer, not through a Corivo server.
Screen content is processed locally as it arrives. Raw screen text doesn't leave your device unless you send it as part of a model call (see below).

The permissions Corivo needs

Corivo is a desktop app for Mac and Windows that watches your work and acts on your commands. To do both, it needs two permissions on each platform:

Accessibility access — required. The primary screen-reading mechanism (macOS Accessibility on Mac, UI Automation on Windows).
Disk access — required. Corivo's agent executes tasks on your behalf — reading files, running commands you authorize, drafting replies that incorporate your work. That needs broad disk access (Full Disk Access on Mac, user-folder access plus on-demand UAC prompts on Windows).

You can revoke either permission at any time:

Mac: System Settings → Privacy & Security.
Windows: Settings → Privacy & security.

What gets stored, and for how long

Capture frames — one SQLite row per capture, with accessibility text plus the foreground app/window metadata. No screenshots or image files are stored. Captures older than 90 days are dropped automatically.
Conversations — your /ask and Quick Ask threads, plus the frames each answer cited. These don't auto-expire — you control them from the chat UI.
Connector tokens — only for tools you've connected, stored in the operating system keychain; revocable from inside that tool any time.

What Corivo will never do

These are the rules:

Never sell your data. Not to advertisers, not to data brokers, not to anyone.
Never use your captures, your tool data, or your conversations to train ML models — neither ours nor anyone else's.
Never share your data with third parties for advertising profiling.
Never route your tool data through Corivo's servers. Connected-tool reads go directly from the tool to your computer.
Never take or store screenshots. Corivo reads structured accessibility text, not pixels — on Mac and Windows.

If we ever change one of these rules, we'll tell you in a way that's hard to miss, and we'll give you a clean way to opt out before the change applies to your data.

What does leave your device

To make Corivo useful, something has to leave your device:

Anonymous telemetry — only if you've opted in. Disabled by default.
OAuth callbacks — when you connect a tool, the OAuth handshake flows through that tool's servers, the way OAuth always does.
Model API calls — Corivo's agent uses LLMs to reason about your captures and tool data. The prompt and the relevant pieces of context go to the model provider, the same as any LLM call. Corivo is up-front about this and you can see what's being sent.

Controls that ship today

Per-app exclusion list — Settings → Capture & Privacy. Skip specific apps by bundle ID (Mac) or executable (Windows).
Pause capture — from the menu bar on Mac, system tray on Windows.
Revoke connector access — from each tool's own settings (Notion, Slack, etc.).
Delete captures — open a frame in the timeline and remove it, or wait for the 90-day retention sweep.

What's still on the roadmap

We'd rather be honest about what's not built than ship a docs page that overpromises. These privacy controls are planned but not yet shipped:

Auto-skipping for password managers, banking apps, health apps.
Respecting incognito / private browsing windows.
A one-click "export everything" command.
A one-click "clear all captures" command in-app (today you remove frames individually or wait for retention).

Until those exist, the available controls are the ones in the section above; if you want a bulk deletion, email [email protected].

Multi-device and team data (later)

Today, Corivo is single-device on Mac and Windows. The Team plan, when it launches, will introduce shared team context. We'll publish a separate doc on the encryption, RBAC, audit-log, and data-residency behaviors when those land. Until that doc exists, assume Team-tier features are not live.

Privacy and local storage