aricode and AriCore are built to keep your work where it belongs — on your devices, under your control.
This policy covers AriCore (the iOS companion app) and aricode (the desktop agent). They are built by the same author and share the same data-handling philosophy: keep it local, keep it encrypted, don't collect what we don't need.
Nothing automatically. Neither AriCore nor aricode has a backend that collects personal information from you. There is no account system, no analytics pipeline, and no crash-reporting SDK phoning home. We don't know how many people are using the app, what they're doing with it, or what models they're running.
The only data we ever see is what you deliberately publish to the AriCore Marketplace — and that's a public posting, by design. See Marketplace below for the details.
AriCore stores the following locally, inside the iOS app sandbox:
Models/.When you delete the app, iOS removes all of this. There is nothing to delete on our side because there is nothing stored on our side.
AriCore uses CloudKit private database sync so your conversations, memories, personas, notes and canvases follow you across your own iPhone, iPad and Mac. This sync runs through your personal iCloud account.
Apple operates the infrastructure. Your data is encrypted in transit and at rest in your iCloud account. We have no access to it — Apple's CloudKit explicitly forbids developers from reading users' private data, and we have no server-side component that could.
If you aren't signed into iCloud, AriCore still works — sync simply pauses until you sign in. To stop sync entirely, sign out of iCloud or disable iCloud for AriCore in iOS Settings.
When you run a local model (a .gguf file you imported), prompts and responses are processed by llama.cpp embedded in the app binary, on your device's CPU and Neural Engine. The model weights and your prompts do not leave your phone. Airplane mode confirms this — local inference continues to work.
When you pair AriCore with an aricode desktop instance over the QR code handshake, the two devices derive a shared secret using X25519 elliptic-curve Diffie–Hellman. After that, every message, file, and command between your phone and your desktop is sealed with ChaCha20-Poly1305 authenticated encryption.
Traffic flows through a relay server we operate so your phone and desktop can reach each other without being on the same network. The relay exists only to forward encrypted bytes.
Random pairing IDs, message sizes, timestamps, and source/destination IP addresses (intrinsic to any network service).
Message content, code, files, prompts, model responses, or anything that identifies you — because we never collected any of that.
Relay metadata is held only long enough to route a message between your devices. There is no persistent traffic log.
You can verify the pairing is direct and uninterrupted by comparing the six-digit fingerprint shown on both devices during pairing. A mismatch means something intercepted the handshake — cancel and try again on a trusted network.
AriCore lets you bring your own API keys for remote providers — OpenAI, Anthropic, DeepSeek, Groq, Ollama Cloud, or any OpenAI-compatible endpoint. When you add a key:
AriCore includes an optional Marketplace where users can share plugins, skills and personas with each other. It runs on the CloudKit public database of the same container — a shared, public surface that everyone running AriCore can read.
You don't have to use it. It's only activated when you choose to publish, rate, comment, flag or claim a handle. Before your first publication you pick a display handle; that handle and an opaque per-account identifier are stored on each record you create so other users can attribute it to you.
What gets stored when you publish:
Treat anything you publish as fully public. You can edit or delete items you've created at any time from inside the app, and deletion removes them from the public database.
Moderation: flagged items are reviewed by the project author. Reviewers can read the flag report (your handle, the reason you provided) so they can act on it. Items with multiple flags are hidden from the gallery pending review. There is no separate moderation team — it's a small project.
AriCore is not directed at children under 13 and does not knowingly collect information from them. It is a developer tool.
If the data picture ever changes — for example if we ever add anything resembling telemetry — this page will be updated and the effective date at the top will change. Material changes will also be surfaced inside the app the next time you open it.
Since we don't collect personal data, there's nothing on our side to access, export, or delete. To remove everything AriCore has stored on your device, uninstall the app — iOS handles the rest.
Questions, concerns, or a specific request?
Get in touch