Privacy and local data

Local storage and model-provider calls are separate boundaries.

What stays on this Mac

Selected sources, local memory, receipts, Ask conversations, Work, session metadata, paths, settings, and detailed usage history stay in the local Recon data folder, normally ~/.recon.

What can leave this Mac

During model-backed work, bounded source passages and questions go directly to the Claude Code, Codex, Anthropic, OpenAI, or Google account you selected. They are not proxied through a Recon model server.

If your selected provider processes a passage, that provider's account and data terms apply.

Anonymous diagnostics

The Mac app waits for your explicit Share diagnostics choice during onboarding or in Settings. Diagnostics use a random install ID and bounded outcomes such as first open, source readiness, and Ask success.

Diagnostics never include:

• work or source content
• prompts or answers
• paths or file names
• memory text
• raw errors
• contact identity
• receipt or conversation IDs

Turn diagnostics off at any time. DO_NOT_TRACK=1 and RECON_TELEMETRY=off also keep them off.

The public website uses a separate anonymous browser identity for page and download events. It is never joined to the Mac app's installation identity.

Removing Recon

Moving Recon from Applications to the Trash removes the app but preserves local memory. Delete ~/.recon only when you intentionally want to permanently remove the local store, settings, receipts, and history.