Privacy & Security

Sythoria has no Sythoria account, analytics service, or hosted prompt relay. It still connects to services you configure. Hosted models, search and fetch providers, remote MCP servers, cloud transcription, updates, and network-enabled artifacts can all send data off the device.

Network data#

Action	Data sent	Destination	How to prevent it
Use a hosted model	Prompt, selected history, attachments, and credential	Configured model endpoint	Use a trusted local model endpoint
Search the web	Query and search credential	Google, SearXNG, or Firecrawl	Turn web search off
Fetch a page	URL and fetch credential	Firecrawl or Jina Reader, then the requested site	Do not use page fetching
Call remote MCP	Tool arguments and transport credential	Configured MCP server	Disable or disconnect the server
Run stdio MCP	Tool arguments	Local child process	Disable the server; audit and sandbox the process yourself
Use cloud transcription	Recorded audio and credential	Configured speech endpoint	Use local Whisper
Refine a transcript	Transcript and model credential	Selected refinement model	Turn off LLM polish
Check for updates	Version and normal HTTP metadata	GitHub update infrastructure	Turn off automatic update checks
Enable artifact networking	Requests made by the preview	Hosts referenced by the artifact	Leave Network off

A local process can still use the network or read files available to your operating-system account. Running it on the same computer does not make it harmless.

Encrypted application data#

Sythoria stores settings in separate AES-256-GCM encrypted files such as models.enc, projects.enc, network.enc, and secrets.enc. Conversations use authenticated, content-addressed encrypted snapshots.

One random root key is stored in the operating system credential vault. Sythoria derives separate keys for each storage area from that root key. Credentials are decrypted by the Rust backend when a request needs them.

Custom skills are an exception. They are plaintext Markdown files under ~/.agents/skills. Files you export or save to a custom folder are also protected only by the permissions and encryption of that filesystem.

Encryption at rest does not protect an unlocked session from malware, clipboard capture, screenshots, memory inspection, or a provider that legitimately receives the request.

Network controls#

Private, loopback, link-local, unspecified, and cloud-metadata destinations are blocked by the native endpoint policy unless an exact local endpoint grant is present. Blocked-host rules are additive and take precedence over grants.

Settings provides:

Offline Mode, which blocks outgoing requests;
Local endpoint grants, for exact trusted scheme, host, and port combinations;
Blocked IPs / Hostnames, for additional destinations you never want Sythoria to contact; and
Disable background activity, which stops periodic connection checks and status polling.

Offline Mode prevents hosted model, search, fetch, remote MCP, cloud transcription, and update requests. It does not stop a separate local process from using its own network access.

Logs#

The native logger runs at warning level and writes to standard output. The interface keeps up to 500 recent log entries in memory. v0.4.4 does not promise a persistent rotating log file.

Redaction is a last line of defense, not a reason to publish a raw log. Remove keys, authorization headers, prompts, transcripts, local paths, private hosts, repository remotes, MCP arguments, and search terms before sharing diagnostics.

Deletion and backups#

Use Sythoria's controls to remove conversations, models, projects, MCP servers, skills, and downloaded Whisper models. Factory Reset removes the app's encrypted data and credential records. It cannot remove copies in backups, exported Markdown, custom Appshot folders, or files copied elsewhere.

When retiring a device, review its credential vault, backups, downloads, screenshots, and ~/.agents/skills directory as separate locations.