privacy_

last updated August 27, 2026 · effective August 27, 2026

The short version

Intaglio Labs runs on your Mac. Your calendar, messages, mail, notes, photos, files and health data are read on your machine, stored on your machine, and answered by an AI model that also runs on your machine.

Intaglio Labs does not receive any of it. We have no server that holds your content. There is no Intaglio Labs account, no login, no analytics, no crash reporting, no telemetry. We could not produce your data if we were asked to, because we never have it.

What Intaglio Labs does send over the network is narrow, named, and listed in §6. Nothing sends your data to us. An optional frontier-model handoff can send only the exact prompt you review, may edit, and explicitly approve to ChatGPT or Claude.

1. Who we are

Intaglio Labs, Inc. ("Intaglio Labs," "we," "us") makes a private personal AI that runs locally on macOS.

• Contact: hi@intaglio.io
• Mailing address: 30 Otis St, San Francisco, CA 94103
• For EU/UK residents: we are the controller only for the limited website data described in §3. For everything Intaglio Labs reads on your Mac, you are the controller and we are not a processor, because we never receive it. See §12.

2. Scope

This policy covers:

• The Intaglio Labs macOS application and the local services it installs (the connectors daemon, the local context store, and the local onboarding page).
• The Intaglio Labs website.

This policy does not cover the third-party services you choose to connect (Apple, Google, Granola, Oura, Notion, Meta/WhatsApp/Messenger/Instagram, LinkedIn, X, Telegram, Discord and Slack). Those providers handle your data under their own policies and their own terms.

3. What we collect about you

From the website

When you visit our site, our hosting provider records standard web-server data (IP address, user agent, page requested, timestamp). Our site also loads a webfont from Google Fonts, which means Google receives your IP address and user agent when a page loads. We are removing this dependency by hosting the font ourselves. The landing page additionally asks GitHub’s public API how many times the app has been downloaded, so GitHub likewise receives your IP address and user agent when that page loads. Neither request carries anything about you beyond what any web request carries, and neither sends anything to us.

We use no analytics, no advertising pixels, no cookies for tracking, and no session recording.

From the app

Nothing. The Intaglio Labs application:

• Creates no account and asks for no email address.
• Sends no usage statistics, no crash reports, no device identifiers, no license checks, and no "phone home" of any kind. There is no analytics or error-reporting SDK anywhere in the product.
• Writes its diagnostic logs to a file on your Mac (~/.hazlie/logs/) and never transmits them. Those logs are restricted by design to counts, timings, record IDs and error types; the logger refuses to write fields named like message content (text, body, subject, content, snippet, message, transcript, note).

If you email us for support, we receive whatever you put in the email.

4. What Intaglio Labs reads on your Mac

This is the part that matters, so it is stated in full. Everything in this section stays on your computer unless §6 says otherwise.

Intaglio Labs reads only the sources you switch on, one at a time, from the local setup page. Nothing is connected by default.

Reading Messages, Photos and Notes requires you to grant Full Disk Access to Intaglio Labs' runtime in macOS System Settings. That is a macOS permission you grant explicitly, and you can revoke it at any time in the same place.

The microphone

Intaglio Labs' voice feature is off until you tap the orb. One tap arms exactly one spoken turn; it disarms itself when you stop talking, when you tap again, or after 12 seconds of silence. There is no wake word and no always-on listening. Speech is turned into text by models running on your Mac. Audio is never written to disk and never sent anywhere. If the local speech models are missing, the feature refuses to run rather than falling back to a cloud service.

5. Where it is stored

• Your content lives in a SQLite database at ~/.hazlie/context/context.db, plus a smaller connector state database at ~/.hazlie/connectors/state.db. Both are created readable and writable only by your user account (mode 0600), inside a directory only your user account can open (mode 0700).
• Access tokens and API keys are stored as individual files in ~/.hazlie/secrets/, under the same permissions, and are re-checked on every read.
• If you connect a bridged chat platform, its local Matrix homeserver and bridge store synchronized messages and that platform's session material in ~/.hazlie/matrix/. This directory is created for your user account only (mode 0700) and is never sent to Intaglio Labs.
• While a connector is running, it makes a temporary private copy of the source database (Messages, Notes, Contacts, WhatsApp) in ~/.hazlie/cache/, then deletes it when the scan finishes.
• If you use the optional frontier handoff (§6), the provider's official client runs from a private folder at ~/.hazlie/frontier/, created for your user account only (mode 0700). The working folder there, and the ChatGPT client's own private folder beside it, are emptied and rebuilt before every handoff; the ChatGPT folder holds only a link to that client's own sign-in, plus whatever the client writes during that single run. The Claude client keeps its sign-in in its usual location and is run with its configuration, tools and session persistence disabled. Nothing in the frontier folder is sent to Intaglio Labs.
• One versioned upgrade from the former 10,000-message social limit creates a recoverable, owner-only copy of the old local Matrix and bridge runtime at ~/.hazlie/matrix/backups/full-history-v1-<timestamp>/ before rebuilding it. That copy can include synchronized messages and live platform session material. It stays only on your Mac and can be removed by deleting that backup directory after you have verified the reimport.
• Intaglio Labs does not add its own encryption layer. Protection at rest comes from macOS file permissions and from FileVault. We strongly recommend turning FileVault on. File permissions protect you from other user accounts on the same Mac; they do not protect a stolen or unencrypted disk.
• We make no routine backups of your data. The one-time bridge migration copy described above is the sole product-created exception. If your Mac's own backup system (Time Machine, or a cloud backup tool) includes your home folder, your Intaglio Labs database will be inside those backups, under that tool's protections rather than ours.

6. What leaves your Mac, exactly

Every source connection below is off until you connect it. None sends your data to Intaglio Labs. Separately, after a local answer, you may choose to send one visible, editable prompt to ChatGPT or Claude. The app does not attach raw database rows, quotes or hidden snippets, but the local answer in that prompt can contain private facts. Nothing is sent until you press the button named for the provider, and the exact sent text stays visible in the conversation.

This section does not give a total, on purpose. The complete, current list of every host this software's own code contacts — with the reason, the direction and what credential is used — is checked into the source repository as ops/EGRESS.json, and a test fails the build if the code reaches a host that file does not name. The one boundary stated rather than enumerated: the frontier handoff's installed provider clients manage their own vendor connections, so the ledger names their root service hosts and records that narrower boundary instead of pretending to enumerate another vendor's internals. A number written out here is a number that goes stale; that is exactly what happened to an earlier version of this section.

Sources that pull your own data down to your Mac. Data flows provider → Mac.

1. Google's Gmail API (www.googleapis.com), authorized by you with read-only sign-in. Pulls your own mailbox down to your Mac. Intaglio Labs holds a token you can revoke at any time from your Google account; it never asks for or stores your mail password.
2. Granola's REST API (public-api.granola.ai). Pulls back notes and transcripts Granola already holds. Intaglio Labs deliberately does not use Granola's server-side AI query tools, because those would run inference on Granola's servers.
3. Oura's API (api.ouraring.com, cloud.ouraring.com for the one-time authorization). Pulls back your own ring data, which Oura's cloud already holds because that is how the ring syncs. The requested scopes are read-only and exclude your email address.
4. Google Calendar's API (oauth2.googleapis.com, www.googleapis.com). Pulls back your own calendar. The requested scope is calendar.readonly and nothing else.
5. Notion's API (api.notion.com). Pulls back only the pages you explicitly share with the integration.

Google user data, specifically. The Google sign-in asks for two read-only permissions: gmail.readonly and calendar.readonly. They are used for one purpose: to build your own, private index of who you talk to and what was said, on your Mac. Intaglio Labs’ use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. In plain terms: Google data is not sold, is not used for advertising, is not used to train general-purpose models, and is not read by any person at Intaglio Labs. It is stored only on your Mac, and deleting the app’s data directory or revoking the token at myaccount.google.com/permissions removes it. Where an optional feature sends excerpts of your messages to a model outside your Mac, the feature is off until you turn it on — struck 2026-09-20: the reconnect card's judgments (which line to quote, how a conversation ended, how close and how professional a relationship is, whether a reminder is worth showing) are made by a hosted decision model, TypeSafe's Jev, and are on by default when an API key for it is present on your Mac. Structured facts and short excerpts of your messages leave your Mac for that purpose, unreviewed. The model returns only numbers and choices, never text; TypeSafe states it does not train on inputs. The Claude reading-and-drafting switch is unchanged and still off until you turn it on. The destination and the decision are recorded in ops/EGRESS.json under api.typesafe.ai.

Chat platforms, if you connect them, and these are different. Messenger, Instagram, LinkedIn, X, Telegram, Discord and Slack are reached through mautrix bridges that run directly on your own Mac, alongside a Matrix homeserver that also runs on your Mac. Two things follow, and both are worth stating plainly:

• These connections are bidirectional. A chat bridge is a live connection to your account, not a download — that is what makes messages arrive as they are sent.
• Connecting one requires that platform's login flow, which may use an in-app login window, a phone/code flow, or a QR approval. The app keeps the resulting session cookie, token, or other connection credential. That credential is a bearer for your account. It is stored on your Mac, used only to talk to the platform it came from, and never sent to us. Disconnecting the source and logging out on the platform ends it.

Setting these up also downloads the bridge software itself. The bridge programs are published by mautrix and fetched from github.com (raw.githubusercontent.com, release-assets.githubusercontent.com); the Matrix homeserver and its Python dependencies come from pypi.org and files.pythonhosted.org. Each bridge program is checked against a checksum recorded in the app before it is run. These are downloads of software, like installing an app: nothing of yours is uploaded.

Model downloads. Choosing a model during setup downloads its weights from huggingface.co, and the app does this itself rather than a script you run. Installing the voice feature downloads speech models from their publishers (Moonshine, jsDelivr, Hugging Face). These are downloads of software, like installing an app: nothing of yours is uploaded, and those local models do not phone home afterwards. The initial answer and speech inference run on your Mac; only a frontier prompt you separately approve runs at the named provider.

Optional frontier-model handoff. The first answer is produced locally. If you choose ChatGPT or Claude, Intaglio Labs shows the complete outbound prompt in an editable box. It contains the current question, the bounded local answer and source labels; it contains no automatically attached database row, quote, file or hidden retrieval context. You may edit or cancel it. Pressing the provider-named send button hands exactly that text — together with a short, fixed instruction written by the app telling the model to treat it as reference material and to use no tools; the instruction contains nothing of yours — to the official client installed and signed in on your Mac. That client owns its subscription login and connection to the provider; Intaglio Labs does not read its credential. The provider receives and processes the text you approve under your account and its terms.

If you click a help link in the app — for example to Google's app-password page or to Notion's integrations page — Intaglio Labs hands that address to your normal browser. That is a link, not a request from Intaglio Labs.

7. What Intaglio Labs never does

• Never automatically attaches a database row, quote, file or hidden retrieval context to an AI-provider request. A frontier handoff sends only the text visible in the review box after you explicitly approve it.
• Never sends a frontier prompt in the background or because of a persistent toggle. Approval is per prompt and names the receiving provider.
• Never uses your data to train or improve any model of ours — we have no training pipeline and no copy of your data to feed one. Text you approve in a frontier prompt is processed by the named provider under your account and its own terms, which may include model-improvement uses that provider lets you control in its settings.
• Never sells, rents, shares or discloses your data. We cannot: we do not have it.
• Never routes your messages through any server we operate. If you connect a chat platform, the bridge that talks to it runs on your Mac and connects your account directly to that platform — the same place those messages already live. Nothing is proxied through Intaglio Labs, and we operate no server in that path.
• Never writes your message content, mail subjects, note text, transcripts, contact names or approved frontier prompt into an Intaglio Labs log file.

8. Sensitive categories

Some of what Intaglio Labs can read is treated as sensitive under privacy laws. Named plainly, so nothing is a surprise:

• Health and wellness data — your Oura sleep, heart-rate variability, readiness, stress and activity data.
• Precise geolocation — the GPS coordinates stored inside your own photos.
• Face grouping labels — the names and group IDs Apple's People feature has already assigned in your Photos library. See §9.
• Contents of your communications — message, mail, WhatsApp and meeting text.

The underlying database, rows, files and source text stay on your Mac, and Intaglio never receives them. A local answer can summarize sensitive facts; if you leave those facts in a frontier prompt and approve it, the named AI provider receives that text under your account. Intaglio still does not receive, collect, sell or retain it.

Intaglio Labs is not a medical device. Nothing it says about your sleep, energy, recovery or activity is medical advice, a diagnosis, or a treatment recommendation. See the Terms.

9. Faces and voices (biometrics)

We want to be exact here, because the law in this area is exact.

Photos. Apple's Photos app groups faces in your library on your own device, as a feature of macOS. Intaglio Labs reads the result of that grouping — a name you typed, or a group identifier — so it can say "this photo is from the trip with Sam." Intaglio Labs does not read the photographs themselves, does not compute or store a face template, faceprint, face geometry, or any other biometric measurement, and does not run face recognition of its own. Intaglio Labs receives none of this.

Voice. The Intaglio Labs application does not create a voiceprint. It does not enroll, identify, or recognize speakers by voice, and it does not store voice embeddings. Speaker labels in its store come from the source data — the name on an email, the contact behind a phone number — never from analyzing audio. Audio captured through the microphone is transcribed on your Mac and discarded.

The software we distribute collects no biometric identifiers and no biometric information, from you or from anyone else. Intaglio Labs receives none, and we do not sell, lease, trade or otherwise profit from biometric data.

Retention. Because Intaglio Labs holds no biometric identifiers, there is no biometric retention schedule that applies to your use of it. If a future version of Intaglio Labs ever collects one, we will publish a written retention and destruction schedule, and obtain the consent the law requires, before that version ships — not after.

10. How long Intaglio Labs keeps things, and how to delete

• By default, Intaglio Labs does not automatically delete ordinary ingested data. Data stays in your local store until you remove it. You can set a per-source retention window (for example, "keep 30 days of mail") in your local configuration, and the daemon will enforce it. The versioned bridge-runtime replacement described in §5 is the exception: it moves the old runtime into a recoverable local backup before recreating it.
• Calendar entries are reconciled every scan: if an event is cancelled or moved out of the window, Intaglio Labs deletes its row rather than keeping a stale copy.
• You can delete everything from one source at any time. That operation removes the rows, rebuilds the search index, compacts the database file, and clears that connector's cached state and cursors. Contact lookups and undecoded-message records are cleared with it. For a bridged chat source, it does not delete the local Matrix bridge's separate copy or a migration backup; deleting ~/.hazlie/ removes those copies too.
• Individual records can be removed one at a time, by id, through the local admin interface hermes serves on your own machine.
• Deleting the ~/.hazlie/ directory removes everything Intaglio Labs holds, including tokens and migration backups.
• Revoking a source's access at the provider (Google, Notion, Oura, Granola) or turning off Full Disk Access in macOS stops any further reading immediately.

11. Other people's data

This is the honest part, and you should read it before connecting anything.

Intaglio Labs reads your accounts. But your accounts are full of other people: the person on the other end of a text message, everyone on an email thread, the attendees on a meeting invite, the names in your contacts, the faces your Photos library has grouped, your LinkedIn connections. When Intaglio Labs reads your mailbox or your messages, those people's names, addresses, phone numbers and words are stored in your local database alongside your own.

Two things follow.

First, this is your copy of your own communications. It is the same information already sitting in Mail.app and Messages.app on the same computer. Intaglio Labs moves it into a form an AI on your machine can search, and it does not send it to us. The optional frontier review deserves special care: a local answer may summarize another person's words or facts even though no raw message is attached. Remove anything you do not want the named provider to receive before approving it.

Second, you decide what to point Intaglio Labs at, and you are responsible for that decision. Nobody else's consent has been collected. If you are in a jurisdiction with rules about processing other people's personal data, or if you plan to point Intaglio Labs at work accounts governed by an employer's policy, that is on you, not on us. The Terms of Service says this in the language lawyers use.

If someone contacts us asking what Intaglio Labs holds about them: we hold nothing, and we cannot reach your machine. Requests about a specific person's data have to go to the Intaglio Labs user whose Mac it is on.

Suggestions, if you care about the people in your data: connect only the sources you actually need, set a retention window, and use the delete commands. And do not use Intaglio Labs to keep a file on someone.

12. Your privacy rights

Because your Intaglio Labs data lives on a computer you own, you already have more control than any rights request could give you: you can read the database with any SQLite tool, and you can delete it with one command.

For the small amount of website data we do hold (§3), and for anything you send us by email, the following applies.

• California (CCPA/CPRA). You may request to know, delete, or correct personal information we hold, and you may opt out of sale or sharing. We do not sell or share personal information, and we have not in the preceding 12 months. We do not use or disclose sensitive personal information beyond the purposes permitted without a right to limit, and we do not discriminate against anyone who exercises a right. Text you deliberately send through the frontier review is processed by the provider you name under your account and that provider's terms, not collected by Intaglio Labs.
• Other US states (Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana, Delaware, and others as they take effect). You have comparable rights of access, deletion, correction, portability, and opting out of targeted advertising, sale, and profiling. We do no targeted advertising, no sale, and no profiling.
• EEA/UK (GDPR). For website data our lawful basis is legitimate interest in operating and securing the site. You have rights of access, rectification, erasure, restriction, portability, and objection, and you may complain to your supervisory authority. Intaglio Labs does not receive the data read on your Mac. If you approve a frontier prompt, you direct the installed provider client to transmit that text to the provider under your own account.
• Washington My Health My Data Act, Nevada SB 370. Consumer health data Intaglio Labs reads from Oura is not collected, sold or retained by us. A local answer may derive health information; do not approve a frontier prompt containing it unless you intend to send that text to the named provider.

To make a request, email hi@intaglio.io. We will respond within the time the applicable law allows. We may need to verify your identity. You may use an authorized agent.

13. Children

Intaglio Labs is not for children. It is intended for adults 18 and over, and we do not knowingly collect personal information from children. If you connect sources that contain messages, photos or contact details involving children, that content is read and stored locally on your Mac under your control, and Intaglio never receives it.

14. Security

• Local database and secret files are restricted to your user account (0600 inside a 0700 directory), and secret file permissions are verified on every read rather than trusted.
• The local onboarding page and the local services bind to your Mac's loopback interface only. They are not reachable from your network. The onboarding page enforces a host allowlist to block DNS-rebinding attacks and sends no CORS headers.
• The app's own interface blocks network requests at the browser level, refuses to navigate to anything other than local files, and can reach only two local ports.
• Text that arrives from someone else — an email, a message, a note — is treated as data, never as an instruction to Intaglio Labs. Commands are accepted only from your own pinned Messages thread and only with an explicit hz prefix. This is deliberate protection against someone trying to steer your AI by sending you a crafted message.
• Facts Intaglio Labs derives about you are held back until you approve them one at a time. There is no bulk-accept button, on purpose.
• No system is perfectly secure. Intaglio Labs is early software. Turn on FileVault, keep macOS updated, and use a strong account password — those three do more for your Intaglio Labs data than anything we can do from here.

To report a vulnerability, email hi@intaglio.io. Please give us a reasonable window to fix it before publishing.

15. Changes

If we change this policy we will update the date at the top and post the new version at this address. For a change that materially reduces protection, we will give notice in the app or by a reasonable means before it takes effect. Older versions available on request.

16. Contact

Intaglio Labs, Inc. 30 Otis St, San Francisco, CA 94103 hi@intaglio.io