Autobot · privacy model
Privacy model
The default is no network. This page describes what the code enforces, where the limits are, and how to check the record.
- Default network
- Offline
- Telemetry
- None
- At rest
- Encrypted
- Cloud
- Optional, redacted
- Accounts
- None
- Export
- Sealed .autobot file
Network
The global mode starts at Offline. A shared KillSwitch rejects every request before DNS or a socket exists. Loopback servers such as a local Ollama can be allowed or blocked.
The modes are Offline, Direct, Tor (Orbot SOCKS 127.0.0.1:9050, remote DNS) and SOCKS5. Each provider can override the route, but a Direct override can never downgrade a global Tor or SOCKS5 mode.
| Behaviour | Detail |
|---|---|
| Visible egress | The Privacy Center keeps a live, in-memory log of every request attempt: time, method, host, path, sizes, tag and whether it was blocked. Headers, query strings and bodies are not recorded. |
| Redirects | No automatic following. Model downloads follow redirects hop by hop, and every hop passes the kill switch and the audit log. |
| Cache and cookies | No HTTP cache, no cookies. |
| HTTPS | System CAs only. Cleartext is allowed only for localhost, 127.0.0.1 and 10.0.2.2. |
| User-Agent | The constant Autobot. No device identifiers. |
Redaction before cloud
On by default. Names, emails, phone numbers, addresses, card, IBAN and account numbers, and memory facts become placeholders such as [PERSON_1] before a cloud provider sees the request. The answer gets the real values back on the phone.
Each chat can switch it off. The receipt counts what was hidden. The rules are shared Kotlin and are checked against the same vectors as Invincible’s node: both ends hide the same things.
Phone first
Off by default. With it on, a plain chat on a cloud model is answered by the on-device model first. A small judge — rules plus one short self-check on the same model — decides whether the answer is good enough.
- Ask offers the cloud model after a weak local answer.
- Auto sends a weak answer’s prompt on its own, unless it looks personal.
- Never keeps everything on the phone.
Both answers stay on screen, the cloud request goes through redaction, and the receipt says why. A paired node can sit in the middle: phone → node → cloud, with “never” meaning “never beyond hardware I own”.
At rest
| Store | Android | iOS |
|---|---|---|
| Conversations | Room over SQLCipher | SQLite with CryptoKit |
| Database key | Random 256-bit key wrapped by an AES-256-GCM Keystore key, StrongBox when available | Keychain and Secure Enclave wrapping |
| API keys | Encrypted like the database key; never logged | Keychain; never logged |
| Screen and backups | FLAG_SECURE, recents screenshots disabled, backups and device transfer disabled | Data protection, privacy cover in the app switcher, backup exclusion |
Incognito chats are held in memory only and never touch the database. An optional app lock uses biometrics or the device credential, with an auto-lock timeout.
Panic wipe
Type WIPE to destroy Keystore keys, wrapped keys, databases, settings, secrets and caches. The process is then killed. A duress PIN and wipe-after-failed-unlocks are available for worse days.
Export
Settings → Export & import writes one .autobot file sealed with your passphrase: PBKDF2-HMAC-SHA256 at 600k iterations, AES-256-GCM in 1 MiB chunks, with the header, chunk index and final flag authenticated. Tampering, reordering and truncation are rejected.
API keys are never exported. An import never switches the app online or changes the app lock. The other platform opens the same file.
Permissions
Android asks for INTERNET and USE_BIOMETRIC, plus RUN_USER_INITIATED_JOBS, ACCESS_NETWORK_STATE and POST_NOTIFICATIONS so a model download can keep running with a progress notification. The notification permission is requested only when the first download starts.
RECORD_AUDIO is requested only when you first tap the microphone. Audio is transcribed on the phone and is never stored or sent. Diagnostics show the device, accelerators and benchmarks — never prompts, file paths or identifiers — and are never sent unless you copy them.
This website
Static HTML and one CSS file. No analytics, cookies, fingerprinting, session recording or third-party scripts. Fonts are self-hosted. Release data is baked at build time, not fetched by the browser. The only external requests are the links you click.
Limits
- A compromised phone is compromised. Encryption at rest protects a locked device, not an unlocked phone in an attacker’s hands.
- The Snapdragon accelerator paths still need verification on the 8 Elite Gen 5 hardware they were built for.
- The APK is signed and hashes are published, but there has been no independent security audit.
- No telemetry is code, not a promise: there is no SDK to disable because there is no SDK.