Skip to main content

Privacy And Safety

Row-Bot is local-first: the app and its data live on your machine. Local-first does not mean every feature is offline. Hosted models, web search, browser actions, account tools, channels, MCP servers, plugins, realtime voice, and media providers can send data outside the app when you configure and use them.

Local Data​

Conversations, memories, documents, workflows, logs, Designer projects, Developer workspaces, skills, plugins, Buddy assets, and settings are stored in the active local Row-Bot data directory.

External Calls​

External calls happen when you choose or enable something that needs them: hosted models, subscription providers, API providers, web search, browser automation, account tools, messaging channels, MCP servers, plugin tools, realtime voice, and media generation.

Computer Use is a distinct opt-in boundary. Row-Bot downloads the pinned Cua Driver only after an explicit Install or Repair action, verifies the selected archive, and requires a telemetry disclosure before any executable invocation. The reviewed upstream telemetry includes installation and platform metadata but excludes typed content, screenshots, prompts, files, memories, tool arguments, secrets, and channel content. See Computer Use for the full boundary.

Credentials​

Enter credentials only in the relevant Settings tab or provider sign-in flow. Row-Bot stores secrets in the operating system key store when available and keeps local metadata for status and diagnostics.

Approvals​

Use approvals to review file writes, command execution, browser actions, account actions, channel sends, MCP calls, plugin tools, Developer changes, and other sensitive actions. Reject anything that does not match your request.

Approval mode is policy, not a model choice: blocked actions stay blocked, ask-mode actions wait for you, and auto-approved actions follow the configured policy. Some prompts include a short model-written reason for readability, but the underlying approval gate and action details are system-controlled.

Sharing Logs Or Screenshots​

Before sharing logs, screenshots, documents, thread exports, or review packages, check for names, file paths, account names, message contents, tokens, private documents, or misleading real data.

Safer Defaults​

  • Start with local models when privacy matters most.
  • Keep channels, MCP, and plugins disabled until needed.
  • Keep Computer Use disabled until a local interactive task needs native application control.
  • Use narrow workspaces for file tools.
  • Review approvals before external or destructive actions.
  • Keep a final human review step before publishing screenshots or docs built from a personal app state.