On-device understanding. Your choice of AI. Knowledge you own.

Sentient uses on-device inference to understand the local sources you enable, keeps your knowledge in a folder on your Mac, and lets you choose the AI that organizes it and helps you act. The app and supporting infrastructure are open source. We do not sell personal information or share it for cross-site targeted advertising.

This document explains the implementation's security boundaries and how to report vulnerabilities. The in-app privacy policy describes the associated data practices and controls.

Email security@sentient-os.ai. Please do not report vulnerabilities through public GitHub issues. Include the issue and its impact, steps to reproduce, the version or commit tested, and any suggested fix. We will acknowledge reports within 48 hours and keep you informed while we work on a fix.

Everything Sentient ships is in scope: the macOS app, hosted MCP mirror and server code, covered Magic Reply relay, feedback-contact storage and its Auth boundary, and release/update infrastructure. For live testing, use your own data and accounts. Avoid disruptive testing or resource exhaustion. If you believe you can reach another user's knowledge or records, stop at the minimum proof needed and report it.

The local model analyzes enabled files, saved screenshots, Apple Notes, selected iMessage and WhatsApp conversations, Apple Mail and Apple Calendar. That analysis does not upload the source material to an inference service. Useful summaries then go to the chosen frontier model for knowledge organization and proactive preparation. That model can be local or hosted.

On-device prompts and deterministic checks help exclude irrelevant material and common sensitive identifiers. These are filters, not a guarantee that every personal detail has been removed. The resulting knowledge is intentionally personal. Rejected items do not become knowledge summaries; local progress checkpoints and counts still support reliable processing.

Magic Reply writing examples are a separate one-time snapshot of selected sent messages. They retain original wording and recipient/conversation context, are editable as writingstyle.md, and travel with Magic Reply requests and the knowledge folder if sharing is enabled.

• Sidekick and proactive intelligence: use the selected ChatGPT/Claude account, compatible API provider, or supported local model. Requests can include knowledge, task context and screenshots. Hosted inference follows the chosen provider's processing settings.
• Email and calendar: Apple Mail and Apple Calendar are analyzed locally and work without a ChatGPT or Claude subscription. Hosted connectors use the supported AI account; direct MCP connections use the service the user authorizes, with credentials stored in Keychain.
• Magic Reply: has an independent provider setting. For low latency, the covered default uses Sentient's OpenAI API route with Zero Data Retention. A screen image, knowledge including writing examples, and instructions pass through the relay to produce an unsent draft. Users can choose their own provider, including a compatible model running locally. store: false is not, by itself, evidence of a provider's contractual retention policy.
• Summarize: sends bounded content from the requested document or conversation, source metadata and an accompanying window image through Sentient's relay to OpenAI. Accessible offscreen text, local PDF pages and a verified continuation of the same WhatsApp or Messages chat may be included. YouTube summaries send the canonical video URL to Supadata to retrieve a native transcript. This explicit action does not use the knowledge base or save its result into conversation history.
• Proofread: sends selected text through Sentient's relay to OpenAI. Surrounding field content stays local for target verification. An explicit action uses normal Copy to obtain the selection, then requires a complete correction and an exact match before Paste. Changed or unsupported targets stop without insertion; no automatic second paste is attempted. Home drafts use an app-owned text snapshot.
• Voice: sends microphone audio directly to ElevenLabs Scribe after an explicit dictation action. Sentient's relay issues the short-lived access token. Finalized words can be edited before sending or submitted by the hold-and-release gesture. Provider processing and retention settings apply; the included configuration does not request zero retention for voice audio.

Summarize and Proofread use covered cloud routes independently of the Sidekick provider. Their requests use store: false; this alone does not establish a provider retention contract. The relay stores bounded usage/accounting metadata, not captured documents, screenshots or corrections.

These distinct paths are why a product-wide claim that all files, messages or screenshots can never leave the Mac would be inaccurate. Local source analysis, cloud drafting, user-requested actions and optional sharing each have their own boundary.

The source also includes Sentient-funded Anthropic inference and hosted connectors. The provider picker remains hidden, an unset gateway URL keeps the service unavailable, and the database policies install disabled. Source publication does not deploy or activate these services.

When configured and enabled, task context passes through Sentient's gateway to Anthropic. This can include knowledge summaries and notes, user instructions, screen/app content and actual message text from enabled research or connected services. Hosted connectors use Composio for provider credentials and execution; those credentials are not confined to the Mac's Keychain. Provider processing, retention and temporary-file policies apply and must be disclosed for the deployed configuration.

A separate anonymous installation credential authenticates hosted usage. The server records bounded operational metadata, run/account identifiers, usage and accounting records. Run capabilities bind tools to an account generation and read or action scope. Background work is read-only; requested writes have separate authorization and uncertain outcomes do not trigger automatic replay. Explicit source selections survive failed reads and are reconsidered on the next processing attempt.

Hosted inference and optional knowledge sharing have separate identities and controls. Disabling sharing does not disable hosted inference. See hosted inference and hosted connectors for configuration, limits and rollout checks.

Full Disk Access supports local readers, including Apple Mail, Notes and conversations. Source selection controls what regular analysis reads; writing-style setup has its separate sample scope. Sidekick and native computer-use setup do not require Full Disk Access. Helper readiness is checked against a temporary Sentient-owned window, with a unique accessibility marker and a decoded screenshot; an unreadable permission database is unknown, never an inferred denial or grant. Apple Calendar requests EventKit Full Access because macOS offers no read-only calendar grant, while Sentient's source reader only reads selected calendars.

Sentient's Screen Recording permission supplies screen context. All current computer-use backends use OpenAI's signed native helper, with its own Accessibility and Screen Recording grants and Sentient's Automation permission. Magic Reply and Proofread use Sentient's Accessibility permission to paste requested text. Summarize uses Accessibility for document text and Screen Recording for its accompanying image. Available file access may extend a verified active conversation from local storage. Setup uses macOS consent surfaces; it does not modify TCC databases. Permissions can be revoked in System Settings → Privacy & Security.

Overnight analysis prepares knowledge and suggested work. Proactive research uses read-only invocations and connector tool restrictions; it does not start computer use or execute the proposed action. A user starts execution by choosing a card or making a Sidekick request. The live notch shows progress and provides STOP for the shared task.

Computer-use tasks have broad ability to act in the user's apps. Their prompts scope the work to the request, treat retrieved content as data, and require verification before reporting success. Connector actions have their own tool policies and validation. These are layered safeguards, not a claim that model instructions are a security sandbox or that prompt injection is impossible.

The hosted MCP mirror is off until enabled. Sentient encrypts the knowledge folder with AES-256-GCM on the Mac before upload. The relay stores encrypted knowledge without persisting the decryption key. The private link supplies the secret for authorized requests; the relay decrypts in memory when serving them. The app and relay implementations are open source.

This protects the stored copy without claiming that the running relay cannot access plaintext during an authorized request. The full link is a bearer credential and must be kept private. The mirror's secret is separate from diagnostics, contact-write authentication and invitation identities. Sharing includes the one-time writing snapshot and files the user adds to the knowledge folder.

Access metadata records times, tool names, client information and hashed note references. Request paths must not be logged because they contain the secret. Turning sharing off stops sync and requests deletion; network failures can delay that request. Periodic cleanup removes copies and access history after 30 days without sync. The local knowledge folder remains the user's primary copy.

The founder-feedback list stores email addresses only, separately from private knowledge and product analytics. Done in supported Gmail/Outlook connection flows discloses this collection. feedback_contact_emails has one column, email; it contains no installation ID, connector metadata or contact timestamps. Anonymous Supabase Auth authorizes a bounded append-only RPC but is not linked to a contact row. App clients cannot directly read the list or delete it. The compatibility RPC drops metadata sent by older clients. Administrative database access remains privileged.

Reset and uninstall preserve the feedback list and invitation/lifetime-access records. Uninstall clears local contact credentials. Requests for removal or help can go to feedback@sentient-os.ai; any founder feedback outreach will include an opt-out. Covered inference uses its own random installation credential and usage limits.

See connected email storage for the schema, migration and synthetic-data tests.

Release builds enable crash reports and extended analytics by default, with separate controls in Settings → System. Sentry receives technical crash/error reports and a random installation identifier; content scrubbing and disabled URL-capture defaults help exclude private material. Technical agent reports use bounded tool categories, outcomes and app-generated correlation IDs. Provider identifiers, tool arguments and output text are not reporting fields.

TelemetryDeck receives basic usage counts, task outcomes and fixed interruption categories, and short AI-written workflow descriptions for eligible Sidekick attempts. Timings, setup and health signals use the extended-analytics setting. Turning that setting off leaves the basic counts, outcomes, interruption categories and workflow descriptions enabled, as disclosed in the app.

The selected task model writes the phrase under instructions to omit identifying and sensitive details. Local checks restrict its length, word count and characters. There is no separate model review. Invalid, withdrawn or unavailable phrases are omitted. These instructions and format checks do not guarantee that every phrase is free of personal information. Raw requests, conversations, screenshots, knowledge files and final responses are not sent to the task-description analytics sink. Generated installation identifiers allow repeat events to be associated without using a name or email.

The optional computer-use check operates a temporary Sentient test window. Its report contains app, OS and tool versions, permission observations, test results and bounded technical error codes. It excludes screenshots, messages, account details and document contents. The report stays local unless the user reviews it and chooses Send report. That separate action sends the displayed report to Supabase using a dedicated anonymous support identity, separate from feedback contacts and invitation records. A local save is also available. Automatic crash/analytics controls do not authorize this upload.

The support-report schema and RPC are included in source. Applying the server migration is a separate release operation; publishing source does not deploy it. The diagnostics guide describes the reporting boundaries and limits. Do not describe the controls as disabling every report or promise anonymity.

• Feature and architecture map
• On-device triage
• Native computer use
• MCP encryption and sync
• Diagnostics
• Overnight scheduling and the wake helper

Sentient is under active development. Security fixes land in the latest release only; please check whether an issue reproduces against the newest version.

Please give us reasonable time to fix an issue before public disclosure. 90 days is a good default; hosted issues will typically be fixed sooner. We can credit you when the fix ships or keep you anonymous. We do not currently run a paid bounty program.