Privacy

Short, because there is not much to say.

The app sends us nothing

Kumo has no telemetry. No usage events, no crash reporting, no analytics of any kind. The app contacts a server of ours in exactly these situations:

• when you sign in;
• once every 24 hours, to check whether your subscription is still active, and to refresh the list of your Macs;
• while you are signed in and Kumo's window is open — when it opens, and once a minute while it stays open — or you open Settings › Account, to see which of your other Macs are on your account and which of them you can work on;
• once a minute while this Mac accepts control from your other Macs, to see whether one of them is asking to;
• while Remote Control is switched on, to stay connected to the relay, and while you control another of your Macs through it;
• when you talk to a Pilot or a group, to get the reply — this one carries what you said, see Pilots below.

If you never sign in and never turn on Remote Control, Kumo never talks to us at all. During the beta that is the normal case, because no account is needed.

Your code and your conversations stay on your Mac

Kumo does not store a copy of your conversations. History is replayed by the agent CLI you were talking to, from that CLI's own files on your disk. Your repositories, worktrees, files and terminal output never leave your machine through us — with one exception you choose to use, Pilots.

What the agent CLI itself sends to its own provider is between you and that provider. Kumo does not hold your API keys or sign you in to anything; every agent keeps its own credentials where it always did.

Log files (~/Library/Logs/kumo-runtime.log and kumo-gui.log) stay on your Mac and are never uploaded. They record starts, stops, method names and errors, and occasionally a short truncated excerpt of a prompt when something failed.

If you make an account

We store:

• your email address;
• the identifier your sign-in provider gives us, if you used GitHub or Google — never a password, because we do not have one;
• a list of the Macs signed in to your account: an identifier the app generates, a name, and when each was last active. This is how the five-Mac limit and remote sign-out work. You can see and remove them on your account page, or in Kumo under Settings › Account. For Full Remote, each of those Macs also has the public half of its key pair, its relay room identifier, whether it accepts control from your other Macs, the list of Macs it has allowed, the list of Macs it has asked to be allowed on, and what kind of Mac it is and which chip it has (for example Mac mini, Apple M4) so your other Macs can draw it — never its serial number. A request is only an identifier and is dropped after a day; it lets that Mac show a notification, it never lets anyone in.
• if you use Pilots, how many model tokens they used each day, and how many times a group asked who should speak next. Counts only, never content.

Sign-in emails are sent through Resend, which processes your email address to deliver them.

If you subscribe

Payments are handled by Stripe. Stripe holds your card details; we never see or store a card number. We store the Stripe identifier for your customer and subscription so we know whether your plan is active.

Pilots

Pilots are the one place where your words go through us. A Pilot runs on Kumo's own engine, and unless you have put a model key of your own on this Mac, each step it takes is sent through our account service to the model provider, which today is DeepSeek. A step carries the Pilot's whole working context: what you said, its instructions and memory, what the agents it works with reported back, and the output of the tools it used. That includes the contents of any file it read in your project.

In a group, deciding who should speak next works the same way. The recent conversation goes through us to TypeSafe.

We pass this along and keep none of it. We do not store or log the content. For each call we record your account, the model, how long it took and how many tokens it used. That is how the daily allowance works. The provider handles the content under its own policy. DeepSeek processes and stores data in the People's Republic of China.

Pilots need an account. If you don't use them, none of this happens.

Remote Control

Your Mac and your phone exchange encrypted frames through a relay running on Cloudflare. For a phone, the encryption key is created during pairing and lives only on those two devices — it travels in the fragment of the pairing URL, which a browser never sends to a server. The relay cannot decrypt anything it carries.

Between two of your own Macs there is no pairing code. Each Mac creates a key pair the first time it needs one, and the private half never leaves that Mac. The public half, and the Mac's relay room identifier, go to our account service. Each Mac then derives the same 256-bit key from its own private key and the other Mac's public key (X25519 key agreement). The key itself is never sent anywhere, and the account service, which holds only public halves, cannot work it out.

The account service is also what hands those public halves out, so in principle it could swap one for a key of its own. That is why pairing takes a click on each Mac. You click Pair on one Mac, and the other shows the same six digits, worked out on each Mac from the two public keys it holds. You click Pair there too, after checking that the digits match. A key the service swapped in would give two different sets of digits. The digits never travel over the network. Unpairing takes effect at once on the Mac you click it on, and on the other Mac at its next check of the account. What a click cannot check is the name shown next to a Mac, because the service supplies that too.

The relay sees a random room identifier, so that it can put the two ends together, and — if you turned notifications on — an opaque push subscription. Notification text is one of two fixed sentences (An agent needs you / An agent finished); no name, project or content is ever sent.

This website

No analytics, no third-party scripts, no cookies, no fonts loaded from anyone else's server. Our hosting provider keeps ordinary short-lived request logs, as every web server does.

What we never do

We do not sell your data, share it with advertisers, or use it to train anything. We have no advertising business to sell it to.

How long we keep it

Account data for as long as the account exists. Ask us to delete your account and we delete the account, the device list and the subscription record; Stripe keeps what it is legally required to keep for financial records.

Your rights and how to reach us

Write to privacy@amkumo.com to see, correct, export or delete what we hold. Kumo is operated by Wiseria LLC, a Wyoming limited liability company, 30 N Gould St, STE R, Sheridan, WY 82801, USA.

Changes

If this page changes in a way that matters, we will say so in the release notes rather than quietly updating the date.

Effective 15 October 2026.